90

Actually, it's very easy to do damage to the network once you have 51%; just build your own chain faster than the network, and broadcast it whenever you like. If you send some of your coins to a new address in your own chain, all the transactions issued in the live network by spending those same coins will be reversed at the moment the longer chain is ...


35

In theory, this attacker owns enough computing power that they could execute a "double spend" attack. They could spend coins in one place, allow the coins to enter the block chain as normal until the required confirmations are met, then fire up their 51% of the miners to craft a fraudulent fork of the block chain in which those coins were never spent, ...


35

Disclaimer: I believe this question may be primarily opinion-based and not very appropriate for this site, but there are a number of technical misunderstandings that can be clarified along with it, so I'll give it a shot. There are many nuances involved here, and I fear that a large part of them didn't reach as much of an audience as the exchange announcing ...


28

The distinction is of theoretical importance only. But if the attacker controls exactly 50%, then it's true that the attacker will eventually catch up, but he won't stay caught up: the honest population will eventually overtake his chain, and we'll be in an unstable situation where control of the "best" chain will bounce back and forth between them forever....


19

The 51% attack is emergent behavior of the system. It's not because there's a "50%" buried somewhere in the protocol that can just be changed to 60% or 75%. Someone with more hashing power than everyone else combined can, given enough time, always build a longer chain than everyone else.


17

Adding to David's quote of $65,415 per hour here's a quick analysis of non-EC2 attacks (i.e. buy and run ALL the hardware to sustain a 51% attack) Since power efficiency will be HUGE for this scale of an operation, let's use the most power efficient card we can find. This lovely pastebin doc tells us that is the Radeon 5850 at 1.595 MH/W. At present you ...


17

Can such attacks be detected? Yes. What you would see is a chain reorganization that invalidates a large (greater than three) number of previously-accepted blocks. The standard client will actually log this -- you'll see a REORGANIZE in the client's debug.log file. The client doesn't currently log the number of blocks invalidated by the reorganization, but ...


16

It's not just about the miners, it is also about people using bitcoin. If miners decide to fork the chain and keep block bounty at 50btc, they cannot use those bitcoins in any place where people have not also modified their non-mining bitcoin client. Protocol changes are not just about >50% of miners, but about >50% of user clients. In this case, since ...


16

An NVIDIA Tesla “Fermi” M2050 is not as fast as an ATI 5870. According to the wiki, the NVIDIA card makes around 70Mh/s and the 5870 makes around 400Mh/s. If they were similar and if Amazon had that amount of cards available for rent, then it would be possible. Just don't forget that you would be paying $65415 per hour to sustain an attack that will not ...


15

There are too many issues rolled up into this question, I'll try to address each separately. The fact that the miner does not include transactions is not a problem. Miners have a right to exclude transactions, even all transactions. Senders can include tx fees if they want to improve the chances of being included quickly (if the miner excludes transactions ...


13

The issue is that you assume a majority attack is an attack that can be prevented. It is not. It is a fundamental breakdown of the security assumptions. Proof of work (PoW)'s assumption is that the majority of the hashrate will cooperate and converge on a single chain, because it is most financially advantageous thing to do. When that is no longer the case, ...


12

A comment about “starting from scratch”. Several check-points have been hardcoded in the client source (hashes of blocks are regularly added in new versions of the client) precisely to reduce the impact of large rewrites of big chain chunks. The transaction history generated in the early days of bitcoin could easily be rewritten with all the processing ...


11

A miner can always lose out if someone else mines a block at approximately the same time as he does. A miner will always continue building on his own block if he finds one before he processes a block found by someone else. It is never to a miner's advantage to ignore a block found by someone else unless he himself has found a block at almost exactly the same ...


11

Ripple solves the double spend problem by consensus. Everyone who wants to run a server on the Ripple network picks a set of validators and tries to reach a consensus with them on which transactions are valid. The Ripple equivalent of Bitcoin's 51% attack would be if some group obtained control over enough validators that the consensus process failed. ...


9

Yes, if you have 51% of the network you can reject all other blocks, thus making sure you receive all rewards. The difficulty will adjust to match just your own hashrate, making sure you mine the expected 144 blocks per day. In fact, with a clever strategy you can get more than your fair share of block rewards even if you're below 50%. This was discussed ...


9

This post by ArtForz on the forums explains the attack: https://bitcointalk.org/index.php?topic=43692.msg521772#msg521772 Quote: "By exploiting the fact that retargeting ignores one block interval every period, it's possible for an attackers' fork chain to "jump backwards in time" and create lots of blocks at low difficulty without running nTime off into ...


9

My question then is: why doesn't bitcoin specify a maximum duration of time and/or a maximum number of confirmations, after which a competing/forking block is rejected even if it's backed by a longer chain of (secretly premined) child blocks? Because you can't prove that to nodes that weren't on the network at the time of the attack. Which means that either:...


9

(adding some color) Some discussion I saw suggested that people promoting this believed they only needed to achieve >50% hashpower, which caused them to overestimate the feasibility. Reorging with only slightly over 50% would take weeks-- even months, creating massive disruption if successful, and virtually guaranteeing an effective public initiative to ...


8

I think this question primarily relates to the integrity of BTC, and withstanding a government mounted attack against it (from what I understand, any currency which could undermine the value of our US dollar is a threat to national security). Take into account another factor or two. DDoS attacks have taken place against several smaller mining pools, which ...


8

And then there is the denial of service possibility of suddenly withdrawing from the service, taking the necessary computing resources away to continue to solve blocks every ten minutes until the difficulty is adjusted down again (which could take a long time if there is only a block every day for example). Of course, for that one would need much more than ...


8

There are two basic fronts on which they can defend, and they really do have to do both. First, they need to increase their total hashing power. 51% of a very large number is much harder for an attacker to muster than 51% of a small number. Merged mining is probably the most realistic way for these currencies to accomplish this. Second, they need to fix ...


8

A double-spend would be blackletter law illegal, guys. Fraud and theft include a wide variety of intentional deception wrongfully depriving someone of property - use of a government-minted currency is not, and never was, a required element. Look at any larceny or fraud statute - it will refer to loss of or damage to person and property not "dollars." ...


8

When performing a 51% attack, you will need to find new blocks faster than the remainder of the network combined. This way, your block chain will become the longest and clients will consider it the main chain. Theoretically, this is achieved (on long term) when you have >50% of the hash power. But as we know, a lot of luck is involved in mining. It's ...


8

First, a quick clarification: assuming two chains both have valid blocks, it's the chain with the most proof of work that wins, not necessarily the chain with the most blocks. Second, thanks for the psuedocode. It's always nice answering a question written in clear code. The answer is that we want nodes to be able to agree on the best block chain based ...


8

There is a handy chart at https://en.bitcoin.it/wiki/Mining_hardware_comparison. If we assume that it is complete, and that the figures listed there are accurate (I have not verified them), and that the attacker must buy the hardware, then the most economical device is the Antminer S5+, which produces 7.7 TH/s (7.7e12 H/s) and costs US$2300. It draws 3.4 ...


8

As long as both competing chain-tips are adhering to the same rules, the chain with the most aggregate difficulty ("heavier") will win, regardless of height. Nodes performing the initial sync would automatically end up on the heavier chain by comparing the aggregate difficulty of the chain-tips offered by their peers due to headers-first synchronization. ...


7

There's no cooperation involved in mining, and they won't be trying the same hashes because (for example) they have different transaction pools and (possibly) different destination addresses. Mining pooling is just like non-pooled mining, except that the revenue is spread over time instead of getting blocks of 25BTC. Even when the pooled miners have a ...


7

Conceptually it isn't difficult to understand conflicts of interests (COI) principles. If a pool has over 50% of the computing power required to demonstrate adequate "proof of work" to add entries to the Blockchain Ledger, this absolute centralized power will eventually "absolutely corrupt". That centralized pool could be used to change the history of ...


7

There are two assumptions in your question that aren't completely correct. 1) Each node would then require 68 minutes to find a proof of work (trying 2^52 hashes). The process of finding a new block is not a linear task of work that needs to be accumulated. Rather it is a random process. Instead of a pile of work you are going through that has a fixed size,...


6

The answer to the title question "Why is BitcoinEXress planning a 51% attack on Namecoin?" has been given in the linked post itself: Goals Developing protection for Bitcoin against exploits Developing a lethal alt chain killer. Making developers aware that when the "bad guys" make you aware of an exploit, FIX IT! We know the 51% attack ...


Only top voted, non community-wiki answers of a minimum length are eligible