How to extract maximum value from a 51% attack If an attacker were to gain 51% of the network, they can essentially forge arbitrary transactions double spend. But that would quickly lead to a completely loss of trust in bitcoin. In fact, that would probably happen as soon as someone was suspected of having a majority.

What strategies could a majority-attacker use to extract maximum value? What could they do without detection?
If an attacker were to gain 51% of the network, they can essentially forge arbitrary transactions.


With control over a majority of hash rate (either directly, or by using something like selfish mining to incentivize other miners to follow your policies), you can only forge arbitrary transactions for SPV clients.

For full nodes, you can only change your own confirmed payments, or (if you go more than 100 blocks back) eliminate any transactions from the chain which descend from recent coinbase (generation) transactions.


  In fact, that [a completely loss of trust in Bitcoin] would probably happen as soon as someone was suspected of having a majority.


This contradicts history, as Ghash.io exceeded 51% in 2014.  This was controversial, but did not seem to affect Bitcoin's exchange rate at the time nor did pool miners immediately leave the Ghash.io pool.


  What strategies could a majority-attacker use to extract maximum value? What could they do without detection?


Again, I think we can look at history for a useful example.  Before Ghash.io obtained it's 51% majority, back when it had about 35%, it used double spends to steal about $100,000 USD worth of bitcoin from gambling site Betcoin Dice.

The attack seems to have worked like this:


The attacker placed an on-chain bet.
If they won, they worked to confirm that transaction.
If the lost, they worked to confirmed an alternative version of the transaction that returned the money to themselves.


This effectively meant that the attacker won significantly more often than they should have by Betcoin Dice's probability expectations.

Back to your question, this was obviously not undetectable because I'm linking to a BitcoinTalk post about it---but it was something that didn't disrupt anyone outside of Betcoin Dice's operators, and it worried such a small part of the community that Ghash.io was later allowed to control a majority of hash rate despite this prior behavior.

(Note: Ghash.io claimed that the attackers had compromised them, and that the attack was not initiated by them even though it used their resources.  I don't think it matters either way: I think it's an import historical example of the dangers of centralized mining.)

The attack above worked on unconfirmed transactions, which Betcoin Dice foolishly accepted at the time, but with a large share of hash rate, the attack can be reasonably attempted against even confirmed transactions.

An attacker with 35% of hash rate has a high chance of being able to reverse a single-confirmed transaction; plenty high enough to tip most gambling games in their favor enough to extract a large amount of value over repeated attempts.  And reversing a single-confirmation from time to time can be somewhat hard to detect because one-block accidental forks (orphans/stale blocks) happen moderately often.

Nakamoto's Bitcoin paper says a 30% attacker can succeed at reversing 5 blocks 17.7% of the time, which is still plenty enough to give a reasonable edge in many low-margin online gambling games---although a 5-block fork would stand out in the stale block data.



The other attack a 51% miner, or even a 30% selfish miner, can perform is making stale any blocks the miner doesn't like.  This can allow them to ultimately extend their 30% or greater control to 100%, ensuring they profitably receive all block subsidies and transaction fees.

A clever miner performing this strategy would make themselves look like multiple pools all below the danger threshold and would slowly put their competition out of business by not making too many blocks stale at once.

Alternatively, I've heard it proposed that they could help advocate changing the system in ways that would allow them to put other miners out of business much faster, such as by raising mining's fixed costs in way that they could easily bear as a large miner but which their smaller competition could not.