I understand that proof of work prevents a node from creating a new version of the blockchain unless they have >50% of the hash rate, but what if the attacker is also able to intercept the victim's internet traffic?

In that case, it would be able to mine a few blocks (or if that's too difficult, start a new blockchain from the genesis block) and then replace traffic to any node on the network with traffic to their fake node with a different version of the blockchain. The victim would then not know that a longer chain exists, so would believe the attacker.

What prevents someone from doing this?

1 Answer 1


In the scenario you describe, in which the only peers a bitcoin core node can connect to are owned by an attacker or colluding attackers, there is a minimum-chain-work-required for the block headers, so the client will not accept a chain which has a total amount of work less than the amount hardcoded into it here. There may be more forms of protection too, my knowledge is incomplete, but that at least provide a lot against such a situation. The node performs headers-first-sync which means it will know what the work of the chain is before it spends a lot more bandwidth and processing power validating the blocks themselves.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.