This question already has an answer here:
As far as I understand, an attacker (in the role of a malicious miner) controlling a large portion of the current hash power could replace previously accepted blocks with alternatives.
But, what does that mean? He could
- Collect the block reward
- Add previously unconfirmed transactions, making them confirmed
- Omit formerly confirmed transactions
But what would an attacker gain with this?
- Block rewards are easier collected with real mining
- Unconfirmed transactions may eventually confirm anyway
- Omitted transactions may confirm just a while later anyway, too
So what's the danger with majority attacks?