The 51% Question: Can a Mining Pool Attack Bitcoin?

Every few weeks a chart makes the rounds on crypto social media. It slices Bitcoin’s hashrate into a handful of colored wedges, and two of those wedges, stacked together, reach almost halfway across the circle. The caption is always a version of the same warning: a couple of mining pools are close to controlling the network, and if they wanted to, they could rewrite the ledger, reverse payments, and break the one promise Bitcoin was built to keep. It is the oldest fear in the protocol, and in the autumn of 2026 it has a fresh set of numbers behind it.

The fear is not imaginary. As of late September 2026, three pools together settle more than 60% of Bitcoin’s blocks, and it takes only those three to cross the majority line. But the distance between three companies could in principle coordinate a majority and Bitcoin is about to be attacked is enormous, and most of the alarming charts skip straight over it. This article walks that distance: what a 51% attack actually is, what it can and cannot do, the handful of times it really happened to smaller chains, why Bitcoin has never suffered one, and why the more realistic danger from concentrated pools is quieter than a reorg and much harder to photograph.

A pool holds two things, and only one of them is dangerous

Start with what a mining pool is for. Solo mining is a lottery. A single machine pointed at the Bitcoin network today has odds of finding a block measured in thousands of years, even though a block arrives roughly every ten minutes somewhere on the network. A pool fixes that by combining the hashpower of thousands of miners and sharing the rewards in proportion to the work each contributed. It turns a jackpot you will probably never hit into something closer to a salary. That part of a pool’s job, smoothing out variance, is pure accounting, and it threatens nothing.

The second thing a pool holds is the part that matters here. Under Stratum V1, the protocol that still coordinates most of the network in 2026, the pool operator, not the individual miner, assembles the block template: it chooses which pending transactions go into the next block and in what order. The thousands of machines contribute raw hashpower, but the operator addresses the envelope. Concentration is worrying not because it concentrates electricity, but because it concentrates that editorial power over block contents, and, at the far extreme, power over the order and history of the blocks themselves. Keep those two functions separate in your head, payout-smoothing and block-building, and most of the 51% debate becomes legible.

Three pools, one coefficient: the 2026 map

Here is where the hashrate actually sits. The figures below are a live snapshot from Hashrate Index, taken with the network running near 934 EH/s and Bitcoin trading around $80,400.

The number analysts watch is the Nakamoto coefficient: the smallest group of entities that, acting together, would cross 50%. Add Foundry and AntPool and you get about 44%; add F2Pool and you clear 60%. So the coefficient is three. TFTC put the point plainly in a July 2026 analysis, noting that three pool operators, acting together, can control the majority of Bitcoin’s block space today. A coefficient of three is not comfortable. It is also not new; the figure has hovered at three for most of 2026 even as individual pools traded places, and it is a long way from the coefficient of one that a genuine single-operator takeover would require.

What 51% actually means

Bitcoin has no referee to declare which version of history is correct. When two competing chains exist, every node independently follows the one with the most cumulative proof-of-work piled on top of it, the heaviest chain. That rule, and only that rule, is what a 51% attack exploits. An entity that controls a majority of hashrate can, given enough time, always build a heavier chain than the rest of the network combined, because it is laying down proof-of-work faster than everyone else together.

In practice the attack looks like this. The majority miner quietly builds an alternative chain in private, starting from some recent block, while the public network extends the chain everyone can see. Because the attacker has more hashpower, its secret chain eventually becomes longer, that is, heavier, than the public one. When the attacker publishes it, honest nodes see a heavier chain and switch to it, following the rules exactly as written. Every transaction in the blocks that got replaced is wiped out as if it never happened. This is called a chain reorganization, or reorg. It is not a bug or an exploit of broken code; it is the longest-chain rule working as designed, turned against the network by someone with more hashpower than everyone else. And it is probabilistic, not a switch that flips at exactly 50%: more than half the hashrate makes a deep reorg eventually certain, but even a large minority can pull off a shallow one with luck.

What a majority miner can, and cannot, do

The word attack does a lot of unearned work in headlines, so it helps to be precise about the powers a majority miner actually gains. They are narrower than most people assume.

As the education material from the oracle provider Chainlink puts it, the damage is focused on the immutability of recent history rather than the cryptographic security of individual accounts. Your coins in cold storage are not at risk from a 51% attack; the private keys that protect them are untouched. The threat is to transactions in flight and to the finality of recent blocks, not to the ownership of anyone’s stack. That is a crucial distinction, because it means the failure mode people fear most, someone draining wallets, belongs to an entirely different category of risk: leaked keys, malicious signatures, and smart-contract bugs, the kind of failure that let attackers drain a fully audited protocol in the Kelp DAO hack. A 51% attack cannot touch any of that.

How a double-spend actually works

If a majority miner cannot steal coins, how does anyone profit from an attack? Through the one power on the can list that has an obvious payday: double-spending. The mechanics almost always route through a custodian, an exchange, a bridge, or any service that hands you something irreversible in return for a Bitcoin deposit.

The sequence goes like this. The attacker deposits a large amount of BTC to an exchange and, once the deposit confirms, trades it for another asset and withdraws that asset off the platform, or sells for dollars and pulls them out. Meanwhile the attacker has been mining a secret chain in which that deposit never happened. Once the withdrawal is irreversible, the attacker publishes the heavier secret chain. The network reorganizes, the deposit transaction vanishes, and the BTC reappears in the attacker’s wallet, while the withdrawn asset is already gone. The exchange eats the loss. This is why the exit is always some external service that offers fast, irreversible settlement, and why the same venues that absorb bridge exploits and custody failures are also the natural targets of a reorg; the recurring lesson that the weak point sits at the edges, not in the base protocol, applies here too. A 51% attack is expensive precisely because the attacker has to out-mine the whole network for long enough to let a withdrawal clear, then throw away the honest rewards it could have earned in that window.

GHash.io, 2014: the pool that backed away from the line

There is exactly one time in Bitcoin’s history that a single pool actually crossed the majority threshold, and the way it resolved tells you more about Bitcoin’s security than any equation. In mid-2014 the pool GHash.io briefly exceeded 50% of network hashrate. There was no attack. What happened instead was a panic, and then a retreat. Developers and commentators warned that the situation was dangerous regardless of the pool’s intentions; miners began leaving to reduce its share; and GHash.io publicly pledged to keep itself below 40% of the network and asked other pools to adopt similar self-limits. CoinDesk covered the episode as the moment the community confronted the 51% issue in earnest. The pool shut down entirely in 2016.

The lesson is that the correcting force was social and economic, not cryptographic. No line of code stopped GHash.io from crossing 50%; miners and the market did, because a pool seen as a threat to Bitcoin is a pool whose customers leave and whose product, denominated in a currency it might destroy, loses value. That dynamic, more than any technical safeguard, is why concentration has repeatedly built up and then dispersed rather than tipping into catastrophe.

When it really happened: Bitcoin Gold and Ethereum Classic

To see an actual 51% attack, you have to look at smaller chains, where the security budget is low enough to buy. Two cases are the canonical examples.

Bitcoin Gold, a 2017 fork of Bitcoin that used a different, GPU-friendly mining algorithm, was hit in May 2018 by an attacker who double-spent an estimated 388,000 BTG, worth around $18 million at the time, against exchanges before they could react; the exchange Bittrex ultimately delisted the coin. Ethereum Classic, which kept proof-of-work after Ethereum’s main chain moved away from it, was hit repeatedly: a first round of reorgs in January 2019, then a remarkable cluster of three deep reorganizations within weeks in mid-2020, one of them rewriting thousands of blocks. Coinbase, which watches such chains closely, responded by dramatically raising the number of confirmations it required for ETC deposits, and the Ethereum Classic community later adopted a defensive change called MESS (ECIP-1100) that makes deep reorgs far costlier to attempt.

The common ingredient in every real attack is a rental market. Bitcoin Gold and Ethereum Classic each shared a mining algorithm with larger coins, which meant an attacker did not have to own hardware; they could rent enough hashpower by the hour from a spot market to briefly overwhelm the smaller chain. That single fact is most of the reason Bitcoin has never been hit.

Why Bitcoin is not Ethereum Classic

Bitcoin’s immunity so far is not luck; it rests on several reinforcing barriers that the small chains lacked.

The first is the absence of a rental market deep enough to matter. You cannot rent 470 EH/s of SHA-256 hashpower by the hour, because no such idle supply exists; to attack Bitcoin you would have to acquire the machines. The second is the ASIC supply chain itself, a duopoly dominated by Bitmain and MicroBT. Quietly buying hundreds of exahashes of new machines is not possible without the manufacturers, and the market, noticing. The third is the sheer size of the security budget. At roughly $80,400 per coin, the network pays miners about 450 BTC a day in fresh issuance, close to $36 million, and that honest reward flow is the current an attacker has to fight upstream.

Then there is the raw cost. Campbell Harvey, a finance professor at Duke University, modeled a one-week majority attack on Bitcoin in 2025 at roughly $6 billion: about $4.6 billion in hardware, $1.34 billion in data-center construction, and $0.13 billion in electricity, or around a quarter of a percent of the network’s value at the time. In mid-2026 he refined the model in a more unsettling direction, estimating that pairing the hashrate acquisition with a large short position in offshore Bitcoin derivatives could make an attack profitable at around $8 billion, because the attacker would earn on the price crash it caused. “The cost is about 50 basis points of the value of bitcoin,” Harvey said; the difference today, he added, is the derivatives markets. Even so, skeptics note how fragile the plan is in practice. “Economic feasibility kills the 51% thesis,” argued Matt Prusak, president of American Bitcoin Corp, pointing out that accumulating that much hardware would take years and that exchanges would freeze suspicious flows long before the payday arrived.

There is a deeper point buried in Harvey’s number. Bitcoin’s economic weight has grown so large that it is now being re-used as a security primitive for other systems, through Bitcoin staking arrangements like Babylon that let holders pledge BTC to help secure external chains. A security budget big enough to rent out is a security budget expensive enough to make direct attack irrational.

Selfish mining, the attack that does not need a majority

51% is the number everyone quotes, but it is not the threshold where misbehavior becomes profitable. In 2013 two Cornell researchers, Ittai Eyal and Emin Gün Sirer, published a paper with a deliberately provocative title, Majority Is Not Enough, showing that a pool could earn more than its fair share of rewards without ever reaching half the network. The strategy, called selfish mining, works by withholding a freshly found block instead of broadcasting it, secretly extending a private lead, and releasing blocks at moments that cause honest miners to waste work on what turns out to be an orphaned chain.

Their result was that selfish mining becomes profitable once a pool passes roughly a third of the network, and with an advantage in how quickly it can propagate its blocks to peers, the threshold slips closer to a quarter. That matters in 2026 because the leading pool sits around a quarter of the network on its own and the top two together are near 44%. Selfish mining is subtler than a reorg: it does not rewrite settled history or double-spend anyone. It quietly skews the reward split and, more corrosively, gives smaller miners a financial reason to join the misbehaving pool, which makes the pool larger, which makes the strategy more effective. It is a centralizing feedback loop rather than a single dramatic event, which is exactly why it gets less attention than it deserves.

The lever that actually gets pulled: censorship, not attack

For all the attention paid to double-spends, the realistic misuse of concentrated pool power in the past few years has not been an attack on the ledger. It has been quieter: leaving certain transactions out of blocks. Because the Stratum V1 operator decides what a block contains, a pool can choose to omit transactions that touch sanctioned addresses, and at least one large pool has done exactly that. The researcher known as 0xB10C documented that F2Pool was filtering transactions linked to addresses on the US sanctions list, dropping them from the blocks it produced. F2Pool co-founder Chun Wang initially defended the practice in blunt terms before backing away, writing that he had every right not to confirm transactions from people he considered criminals, then disabling the filter and saying it would stay off until the community reached a broader consensus.

This is soft censorship, and its limits are instructive. A pool with a 16% share cannot actually prevent a transaction from confirming; it can only decline to include it, after which another pool almost certainly will within a handful of blocks. Filtering delays a payment, it does not block it, unless a majority of hashrate cooperates. But the episode shows the mechanism, and it is a reminder that the value locked up in choosing block contents is not only about censorship. Deciding what goes into a block and in what order is also where MEV lives, the profit extracted by reordering or inserting transactions, the same one-block, atomic mechanics that make tricks like flash loans possible. Whoever builds the block captures that value, which is one more reason control over block construction, not raw electricity, is the asset worth watching.

When the leaderboard understates the risk

There is a further wrinkle that makes the Nakamoto coefficient of three look optimistic. The public leaderboard treats each pool logo as an independent company, but that assumption may not hold. In 2024 the same researcher, 0xB10C, compared the actual block templates different pools were producing and found several of them were near-identical: AntPool and Poolin matched about 99% of the time, AntPool and BTC.com about 98%. He identified a cluster of nine interconnected pools that together were mining roughly 37.6% of all blocks, more than Foundry commanded on its own at the time, while carefully stating that this did not prove a single entity sat behind all nine.

If even some of those relationships reflect shared infrastructure or coordination, the effective number of independent block-producers is smaller than the leaderboard suggests, and the true Nakamoto coefficient could be lower than three. This is the strongest version of the concentration worry, and notably it does not require anyone to attack anything; it only requires that the entities we count as separate are less separate than their branding implies. It is also the hardest version to verify from the outside, which is part of what makes it durable.

The game theory of not pulling the trigger

Put the pieces together and the puzzle inverts. The real question is not why hasn’t Bitcoin been attacked, but why would anyone with the power to do it choose to. The entity best positioned to attack Bitcoin is a large mining operation, and a large mining operation is precisely the party with the most to lose from a successful attack.

Consider what an attacker sacrifices. The hardware, hundreds of millions or billions of dollars of SHA-256 ASICs, is single-purpose; it is worth its price only as long as Bitcoin is worth something. A visible attack would crater the coin’s price, vaporizing both the attacker’s mining revenue and the resale value of the machines that carried out the attack. Miners watching a pool misbehave would redirect their hashpower elsewhere within hours, as they did to GHash.io. And in the last resort, the wider community can respond with a user-activated soft fork or even a change to the mining algorithm, orphaning the attacker’s entire hardware investment in a single coordinated move. The security model was never no one can attack Bitcoin; it is that no rational, profit-seeking entity wants to. That is why TFTC and others describe a coordinated pool attack as economically irrational rather than technically impossible. The honest-majority assumption has held for fifteen years, through repeated bouts of concentration, because the incentives point that way, not because the option is unavailable.

The fixes already shipping: Stratum V2, DATUM, and solo mining

None of this means the concentration is fine and nothing should change. The structural answer to the operator picks the block is straightforward: let the miner pick the block. That is the central idea behind Stratum V2, a ground-up rewrite of the mining protocol whose Job Declaration feature lets an individual miner running a full node build its own block template, with the pool reduced to validating the payout and smoothing variance. The pool keeps the part that is genuinely useful, insurance against luck, and gives up the part that concentrates power, control over block contents.

Momentum is real but uneven. In May 2026 seven pools representing roughly three-quarters of global hashrate, including Foundry, AntPool, and F2Pool, joined a formal Stratum V2 Working Group, and in June a pool called DMND, working with GoMining, mined the first-ever block whose template was built by the miner under Job Declaration. “A miner just mined the first Stratum V2 block to power their own product end to end,” DMND’s Alejandro De La Torre said at the time. Ocean’s DATUM system reaches for the same goal by a different route, letting miners build templates locally on top of existing Stratum V1 firmware, no ASIC upgrade required. The caveat is that joining a working group is not the same as shipping: as of mid-2026 only Ocean and Braiins had production job negotiation actually running, while most of the large pools that signed on had not yet deployed it. And at the extreme end sits solo mining, where hobbyists running a cheap Bitaxe device or renting hashpower occasionally find an entire block themselves; it decentralizes template construction perfectly, at the cost of near-lottery odds.

The proof-of-stake mirror, and where the rules land

Bitcoin is not the only network with a concentration debate, and the comparison is clarifying. Ethereum ended proof-of-work at the Merge in 2022, so its analog to a mining pool is a staking pool, and its analog to Foundry is Lido, a liquid-staking protocol that in 2026 accounts for roughly 23% of all staked ETH and about 62% of the liquid-staking segment specifically. Concentration among the entities that order blocks is a cross-consensus problem, not a Bitcoin quirk.

But proof-of-stake has a defense proof-of-work lacks: slashing. A validator that signs two conflicting versions of history can have its staked capital automatically burned by the protocol, an in-band, cryptographic penalty for the exact behavior a 51% attacker relies on. Bitcoin has no such lever; its only penalty for a misbehaving miner is the opportunity cost of wasted electricity and the external, social response of a falling price and fleeing customers. That trade-off, an automatic protocol penalty versus a purely economic one, is one of the sharper distinctions between the two security models, and it is why the design of staking systems, from big liquid pools down to an individual running a solo validator in a 4% world, gets scrutinized as closely as mining pools do.

For readers in the United States, it is worth being clear about which regulator any of this touches, because the answer is mostly none of the obvious ones. The SEC’s Division of Corporation Finance stated in March 2025 that proof-of-work mining, including participation in a mining pool, is not a securities transaction, a position the agency broadened in a March 2026 interpretive release to cover staking as well. A 51% attack, then, is not a securities-law matter; it is a question of market and network integrity. The censorship variant implicates the Treasury’s sanctions authority (OFAC), not the SEC, and the derivatives that make Harvey’s refined attack pencil out fall under the CFTC. The uncomfortable truth is that no financial regulator can compel Bitcoin’s miners to keep the network decentralized; that job belongs to the protocol’s incentives and to the people who run the machines.

Frequently Asked Questions

Can a mining pool actually steal my Bitcoin?

No. A 51% attack cannot touch coins sitting in a wallet, because the attacker never gains the private keys that control them. The only funds at risk are those an attacker double-spends through an exchange or similar service in the moments around a chain reorganization. Coins in your own custody, especially in cold storage, are unaffected by any amount of hashrate.

How many pools would it take to 51% attack Bitcoin in 2026?

As of late September 2026, three: Foundry USA, AntPool, and F2Pool together settle more than 60% of blocks, so those three acting in concert could cross the majority line. That is the network’s Nakamoto coefficient of three. No single pool is close to 50% on its own, and coordinating three independent, competing companies into a self-destructive attack is a very different proposition from one operator flipping a switch.

Has Bitcoin ever suffered a 51% attack?

No. Bitcoin has never experienced a successful 51% attack. The closest it came was in 2014, when the pool GHash.io briefly exceeded 50% and then voluntarily capped itself after community pressure. Real 51% attacks have hit smaller proof-of-work chains such as Bitcoin Gold in 2018 and Ethereum Classic in 2019 and 2020, which shared mining algorithms with larger coins and could be attacked with rented hashpower.

What is the difference between a 51% attack and censorship?

A 51% attack rewrites recent history to double-spend or orphan blocks and requires a majority of hashrate. Censorship simply leaves chosen transactions out of the blocks a pool produces and needs no majority at all. A single pool can censor, but with a minority share it only delays a transaction, because another pool will include it within a few blocks. Censorship is the more realistic day-to-day concern; a double-spend attack on Bitcoin is not.

Does Stratum V2 fix mining-pool centralization?

It addresses the most dangerous part. Stratum V2’s Job Declaration lets individual miners build their own block templates, so a pool no longer decides what goes into a block; it just smooths payouts. That removes the censorship and block-ordering power that concentration creates, even if a few pools still command a large share of raw hashrate. Adoption is underway but incomplete: many large pools joined the working group in 2026, but as of mid-year only a couple had switched on production job negotiation.

Yuki Tanaka covers mining, staking, and network security for HOGE Wire.