by AK Arora 
In May 2018, an unknown attacker rented enough computing power to briefly seize majority control of the Bitcoin Gold network. Within days, they had double-spent over $18 million worth of BTG across multiple exchanges, including Bittrex — which subsequently delisted the coin entirely.
This was not a theoretical exercise. It was a real, successful 51% attack, and it is far from the only one. Ethereum Classic has been hit multiple times. Vertcoin, Verge, and Feathercoin have all suffered the same fate. Combined losses across these incidents run well into the tens of millions of dollars. Read our can crypto be hacked guide for a broader look at crypto security threats.
Bitcoin itself, however, has never been successfully attacked this way in its entire history. Understanding why requires understanding exactly what a 51% attack is, how it actually works, and why network size changes everything.
What Is a 51% Attack?
A 51% attack — also called a majority attack — occurs when a single entity or coordinated group gains control of more than half of a blockchain network’s total mining power (hashrate) or, in Proof-of-Stake networks, more than half of the staked tokens.
This majority control does not let an attacker create new coins out of thin air, steal coins from other people’s wallets, or change the network’s fundamental rules. What it does allow is far more specific and, in practice, far more damaging:
- Double-spending — spending the same coins twice by secretly mining an alternative version of the blockchain, then revealing it to replace transactions the network had already accepted
- Transaction censorship — blocking specific transactions or wallet addresses from being confirmed
- Mining monopoly — excluding other miners from successfully adding blocks, collecting all block rewards for themselves
Satoshi Nakamoto’s original Bitcoin whitepaper assumed that acquiring 51% of the network’s hashrate would simply be impossible at scale, and largely did not address the economic incentives behind such an attack in detail. Read our Bitcoin whitepaper explained guide for the complete original vision. That assumption has held for Bitcoin specifically. It has not held for smaller blockchains.
How a 51% Attack Actually Works
The mechanism relies on exploiting how Proof-of-Work blockchains determine the “true” version of transaction history: whichever chain has the most accumulated computational work is treated as valid by the network.
Step 1 — Gain majority hashrate. The attacker acquires more than 50% of the network’s total mining power, either by building enough hardware or — far more commonly for smaller coins — renting hashrate from services like NiceHash for a limited time window.
Step 2 — Mine a secret, parallel chain. While continuing to interact normally with the public blockchain, the attacker secretly mines an alternate version of the chain that does not include certain transactions, such as a deposit they made to an exchange.
Step 3 — Spend the coins on the public chain. The attacker deposits coins to an exchange on the legitimate, public chain, then withdraws something of value (often a different cryptocurrency) in exchange.
Step 4 — Release the longer secret chain. Because the attacker controls the majority of hashrate, their secret chain accumulates more total computational work faster than the public chain. Once it is longer, they broadcast it to the network. Under the “longest chain wins” rule fundamental to Proof-of-Work, the network adopts this new chain as the valid history — erasing the original deposit transaction as though it never happened.
The attacker now holds both the withdrawn funds and the original coins they “spent” — a successful double-spend. The blockchain did not malfunction. It executed exactly as designed. The vulnerability lies in the underlying assumption that no single party would ever control the majority of honest mining power.
Real 51% Attacks: Documented Case Studies
These are not hypothetical scenarios. Each of the following attacks actually happened, with real, quantifiable financial losses.
Bitcoin Gold (May 2018)
Bitcoin Gold, a 2017 fork of Bitcoin designed to be resistant to specialised mining hardware (ASICs), was hit by attackers who deposited BTG to exchanges, traded it for other cryptocurrencies, withdrew the proceeds, and then broadcast a secret chain that erased the original deposits. Bittrex alone reportedly lost over $18 million and subsequently delisted Bitcoin Gold entirely. A second, smaller attack followed in January 2020, demonstrating the underlying vulnerability had never been fully resolved.
Ethereum Classic (January 2019 and August 2020)
Ethereum Classic — the original chain that continued after the 2016 Ethereum/DAO hard fork split — has been attacked multiple times. In January 2019, attackers reorganised over 100 blocks and double-spent approximately $1.1 million worth of ETC. In August 2020, a more severe round of attacks reorganised over 4,000 blocks across three separate incidents, with losses reaching approximately $5.6 million. The repeated targeting of ETC eventually led the network to implement consensus upgrades specifically to raise the cost of future attacks.
Verge (2018)
Verge’s attack was structurally different and arguably more alarming. Verge used a multi-algorithm Proof-of-Work system, and attackers exploited a timestamp manipulation bug rather than pure brute-force hashrate accumulation. By sending blocks with falsified timestamps, attackers generated new blocks roughly every second instead of the intended 30-second interval — effectively forging new supply at an accelerated rate, something a typical 51% attack normally cannot do.
Vertcoin (December 2018)
Vertcoin, another ASIC-resistant coin, suffered a 51% attack resulting in 22 block reorganisations and an estimated $100,000 in double-spent funds — smaller in dollar terms than Bitcoin Gold or Ethereum Classic, but demonstrating the same underlying vulnerability across multiple distinct blockchain projects.
Why Has Bitcoin Never Been Successfully Attacked?
Bitcoin’s security against 51% attacks comes down almost entirely to its sheer scale.
As of early 2026, Bitcoin’s network hashrate sits at approximately 950–990 exahashes per second — a figure so large it is difficult to express in intuitive terms. Acquiring just 51% of this would require an attacker to either build an enormous, dedicated mining operation from scratch, or rent a quantity of specialised SHA-256 mining hardware that simply does not exist in sufficient volume on any rental marketplace.
Current estimated cost of a one-hour Bitcoin 51% attack: hundreds of millions to billions of dollars, once hardware acquisition, energy consumption, and logistics are factored in. By comparison, the block rewards and transaction fees an honest miner would earn during that same hour represent only a small fraction of that cost — making the attack spectacularly unprofitable even before accounting for the near-certainty that a successful attack would crash Bitcoin’s price, destroying the value of whatever the attacker managed to steal.
This dynamic — where attacking the network is dramatically more expensive than the maximum possible reward — is precisely the economic security model Bitcoin was designed around, and at its current scale, it functions exactly as intended. Read our what is Bitcoin mining guide for a deeper understanding of how this hashrate is actually generated.
Cost Comparison: 51% Attack by Network (2026 Estimates)
| Network | Approximate Cost (1 hour) | Vulnerability Level |
|---|---|---|
| Bitcoin | Hundreds of millions to billions of dollars | Effectively impossible |
| Ethereum (now Proof-of-Stake) | Over $100 billion to acquire majority stake | Extremely high cost, self-defeating |
| Bitcoin Cash | ~$2 million per day (historical estimate) | Low-moderate, large network effect |
| Ethereum Classic | $5,000–$50,000 per hour | Genuinely vulnerable, repeatedly attacked |
| Bitcoin Gold | ~$200,000 per day (historical estimate) | High vulnerability, previously attacked |
Smaller Proof-of-Work coins remain vulnerable precisely because rentable hashrate services like NiceHash allow attackers to temporarily redirect computing power from larger networks without investing in dedicated hardware — dramatically lowering the cost and commitment required compared to attacking a network like Bitcoin directly.
How Proof-of-Stake Changes the Equation
Networks that have moved to Proof-of-Stake — most significantly Ethereum since its 2022 transition — face a structurally different version of this risk. Read our Proof of Work vs Proof of Stake guide for the complete technical comparison.
Rather than controlling hashrate, a Proof-of-Stake attacker would need to acquire and stake over 50% of the actively staked token supply. On Ethereum, this currently means controlling more than half of the roughly 37 million ETH staked — representing a market value around $112 billion as of early 2026.
This creates several built-in disincentives that Proof-of-Work lacks:
- Buying pressure raises the cost as you go. Acquiring a majority stake drives up the token’s price in real time, making the attack progressively more expensive the closer you get to your goal.
- Slashing penalties destroy dishonest stakes. Modern Proof-of-Stake systems can detect provably dishonest validator behaviour and financially penalise it by destroying a portion of the attacker’s own staked capital.
- A successful attack craters the token’s value. Just as with Proof-of-Work, a confirmed attack would likely collapse market confidence, making the attacker’s own remaining holdings worth a fraction of what they paid.
These mechanisms make Proof-of-Stake 51% attacks expensive, detectable, and largely self-defeating on major networks — though smaller, less-staked Proof-of-Stake chains remain potentially vulnerable, mirroring the same network-size dynamic seen in Proof-of-Work.
What a 51% Attack Cannot Do
It is worth being precise about the genuine limits of this attack, since misunderstanding often inflates the perceived threat.
An attacker with majority control cannot:
- Create new coins beyond the network’s programmed supply schedule
- Steal coins directly from wallets they do not control the private keys to
- Change the network’s fundamental rules, such as block rewards or total supply caps
- Reverse transactions that occurred before they gained majority control, beyond a practical limit tied to how many blocks they can realistically reorganise
An attacker with majority control can:
- Double-spend their own recent transactions
- Prevent specific new transactions from confirming for as long as they hold majority power
- Exclude other miners from successfully mining blocks during the attack window
How Networks Defend Against 51% Attacks
The cryptocurrency industry has developed several practical defences since the wave of attacks in 2018-2020:
Longer confirmation requirements — exchanges and services increasingly require more block confirmations before treating a deposit as final, making short-duration attacks less profitable.
Checkpointing — some networks now implement periodic checkpoints that make it computationally infeasible to reorganise blocks beyond a certain depth, directly limiting how much historical damage an attack can cause.
Merge mining — allows smaller chains to share hashrate security with larger, more established networks, raising the effective cost of attacking the smaller chain.
Slashing (Proof-of-Stake) — as discussed above, financially penalising detected dishonest validator behaviour by destroying a portion of their staked capital.
FAQ
Has Bitcoin ever been 51% attacked?
No. Bitcoin has never suffered a successful 51% attack. Its hashrate is so large — approximately 950-990 exahashes per second as of early 2026 — that acquiring majority control would cost hundreds of millions to billions of dollars for even a single hour, far exceeding any possible profit from the attack.
Which cryptocurrencies have actually suffered 51% attacks?
Several smaller cryptocurrencies have been successfully attacked, including Bitcoin Gold (2018, approximately $18 million double-spent), Ethereum Classic (2019 and 2020, combined losses over $6 million), Vertcoin (2018, approximately $100,000), and Verge (2018, via a timestamp manipulation exploit).
Can a 51% attacker steal my crypto directly from my wallet?
No. A 51% attack does not grant access to private keys or allow direct theft from wallets the attacker does not control. The risk is specifically double-spending and transaction manipulation on the network level, which primarily threatens exchanges and merchants accepting deposits, not individual wallet holders who are simply holding coins.
Is Ethereum vulnerable to a 51% attack now that it uses Proof-of-Stake?
Ethereum’s Proof-of-Stake design requires an attacker to acquire over 50% of actively staked ETH — currently worth over $112 billion — while facing built-in penalties (slashing) for detected dishonest behaviour. This makes a 51% attack on Ethereum extraordinarily expensive and largely self-defeating, though theoretically not impossible at a sufficiently extreme cost.
Why are smaller cryptocurrencies more vulnerable to 51% attacks?
Smaller coins have proportionally less total hashrate or staked value securing their network. Combined with the availability of hashrate rental services that let attackers temporarily borrow computing power from larger networks, smaller coins present a far lower barrier to acquiring majority control compared to networks like Bitcoin.
What happens to a cryptocurrency’s value after a 51% attack?
Successful attacks typically cause severe reputational and financial damage. Bitcoin Gold was delisted by Bittrex following its attack. Exchanges and users generally lose confidence in the network’s security, often leading to a sustained decline in the coin’s market value and trading volume.
Final Word
The 51% attack is not a theoretical curiosity — it is a documented, repeatedly exploited vulnerability that has cost the cryptocurrency industry tens of millions of dollars across multiple real-world incidents. Bitcoin Gold, Ethereum Classic, Vertcoin, and Verge all serve as concrete proof that this attack vector is genuinely dangerous for smaller, less-secured blockchains.
What protects Bitcoin specifically is not some special immunity to the attack itself, but the sheer scale of computational power securing its network — a scale so large that attacking it would cost more than any conceivable reward, while simultaneously destroying the value of whatever was stolen in the process.
The lesson generalises beyond Bitcoin: network size and distributed participation are not just abstract decentralisation talking points. They are the actual economic security model that determines whether a blockchain can be trusted to settle transactions, and the coins that have skipped this scale have paid for it directly. Read our list of all crypto consensus mechanisms guide for a broader look at how different blockchains approach this security tradeoff.
Disclaimer: This article is for informational and educational purposes only and does not constitute financial advice. Always conduct your own research before making any investment decisions.
