A 51% attack is an exploit where a single entity or coordinated group gains control of more than 50 percent of a blockchain network's total mining hash rate or validating power.
How a Majority Attack Operates
In proof-of-work and proof-of-stake distributed ledgers, consensus rules dictate that the longest or heaviest valid chain represents the true history of the network. When an attacker captures majority consensus control, they can mine or validate blocks faster than the rest of the honest network combined.
This majority position allows malicious actors to isolate their privately produced chain until it outpaces the public chain. Once released, the network reorganizes according to consensus rules, replacing the honest record with the attacker's alternative chain.
With this control, the attacker can execute critical security breaches:
- Double Spending: Sending cryptocurrency to an exchange or merchant, waiting for fulfillment, and then broadcasting a private fork that erases the original payment transaction.
- Transaction Censorship: Systematically excluding specific addresses or transactions from being included in newly minted blocks.
- Confirmation Reversal: Rewriting recent transaction blocks to disrupt settlement finality and invalidate completed transfers.
Limitations and Practical Distinctions
While a majority attack severely undermines network trust, it does not grant unlimited control over the underlying protocol. Attackers cannot fabricate tokens out of thin air, alter base protocol parameters, change historical consensus rules, or steal funds from private keys they do not own, because the remaining honest nodes will reject mathematically invalid cryptographic signatures.
A 51% attack should also be distinguished from a Sybil attack. A Sybil attack involves creating thousands of fake peer identities to disrupt communications across peer-to-peer networks. In contrast, a 51% attack relies on monopolizing computational or economic stake within the core consensus mechanism itself, making smaller capitalization networks significantly more vulnerable due to lower barrier-to-entry costs for securing surplus hashing equipment.