A bit about Bitcoin and the controversial topic of security

Blockchain technologies present opportunities for disruptive innovation. However, they also present controversy, especially with regards to the security of cryptocurrencies like Bitcoin. Released as open source software in 2009, Bitcoins are created as a reward for a process known as mining and can be exchanged for other currencies, products, and services. Much has been discussed about its robustness, so could the notion that a 51% attack on a blockchain could move from ‘theoretical’ to ‘possible’?

Traditional money is created through (central) banks, but Bitcoins are “mined” by Bitcoin miners: network participants that perform extra tasks. Specifically, their computers perform complex mathematical operations in order to find the ‘solution’ for a block of transactions. Once this problem has been solved, the miner submits their solution, along with the block itself, to the distributed ledger.

At this point, all transactions in this block are locked in and since each solution to the newest block is dependent on every block that has come before it, it creates a long chain of trust in which every transaction can be proved to be valid. This prevents a user from spending the same Bitcoin twice; it solves the “double spend” problem. All blockchain miners are effectively in a race with eachother. The first one to find the solution to the current block is the winner and gets awarded the prize of some amount of Bitcoin.

Since the mathematical problem for each block is cryptographically based, each miner has, in theory, as good a chance as any other miner to find the solution. The only way to have a better chance of being the winner is to control more miners. In theory, the larger the distributed network of blockchain miners, the harder it is to create a majority share. For example, the rate at which an individual might discover the correct block hash is extremely low – around 12.5 Bitcoins per block. To increase their earning potential, miners grow collective processing power in mining pools by partnering with others.

“Today, attacks against cryptocurrencies are generally against the users of the system and not the cryptography itself. Therefore, 51% attacks still seem unlikely”

For organised criminals wanting to control a blockchain, possibly to submit their own fraudulent blocks which might allow them to double-spend, they would need to control over 50% of all miners for a particular blockchain. There are an estimated 2.4 million Bitcoin miners today and this increase in miners on the network means 51% attacks on Bitcoin are practically impossible.

Recalling this attack requires a majority share in miners and a coordinated attack on the Bitcoin network would require over 1.2 million miners to ensure their fraudulent blocks were accepted by the rest of the miners. However, even if this were possible, in order to ensure your fraudulent block was permanently accepted by the blockchain, a series of consecutive bad blocks is required before they are accepted by the rest of the Bitcoin network. The likelihood is that before any attacker can create this scenario, other miners on the network would have noticed this attack and invalidated the fraudulent blocks.

These attacks are still uncommon as it remains unfeasible, even for the big players, to finance and operate the huge number of miners required to attack Bitcoin. It used to be possible to mine for Bitcoin on relatively inexpensive computer graphics cards (GPUs). However, due to the sheer number of miners on the network and the current pay-out of 12.5 bitcoin per block, specialist chips (known as ASICs) are now the only affordable way to mine.

Yet this raises the bar further in terms of what is required to run a significant Bitcoin mining pool because it shifts the balance of power. Depending on the currency you want to mine (or attack), the initial outlay would be higher, and the attacker would need significantly fewer ASICs compared to GPUs.

Today, attacks against cryptocurrencies are generally against the users of the system and not the cryptography itself. Therefore, 51% attacks still seem unlikely. It is easier to steal any cryptocurrency by getting access to a user’s wallet private key or by attacking a cryptocurrency exchange. Nevertheless, it’s undeniable that they are possible and we’re starting to see more of them occur. For example, Shift and Krypton, both based on Ethereum, were subject to a 51% attack in 2016 and in May of 2018, Bitcoin Gold (distinct from the more popular Bitcoin) was also subject to the same attack.