What Is the Double Spend Problem? How Blockchains Stop It, and How 51% Attacks Break It

Digital money has an obvious weakness. A file can be copied, so what stops someone from sending the same coin to two people at once?

That question is the double spend problem, and for decades it was the reason online payments needed a bank or card network sitting in the middle. Bitcoin's main achievement was solving it without one.

The solution works well, but it is not absolute. Understanding where it holds and where it bends explains why exchanges wait for confirmations, and why smaller coins have been robbed through 51% attacks.

What is the double spend problem?

Cash solves double spending physically. Once you hand over a banknote, you no longer have it, and you cannot give the same note to someone else.

Digital money has no such limit. A coin is just data, and data can be duplicated. Without some way to agree on which payment came first, a sender could pay a shop and a friend with the same funds, and both would think they had been paid.

Traditional finance answers this with a trusted ledger. Your bank keeps the balance, checks every payment against it and refuses the second one. It works, but everyone has to trust the bank and accept its rules.

Satoshi Nakamoto's 2008 Bitcoin white paper names the issue directly: a payee cannot verify that an earlier owner did not double-spend the coin. The paper's goal was to fix that without a central authority.

How Bitcoin solves double spending

Bitcoin replaces the bank with a public ledger that thousands of nodes keep a copy of. Each node checks that the coins in a new transaction exist and have not been spent before.

That check works because Bitcoin tracks individual pieces of value rather than account balances. Each transaction spends specific outputs, and once an output is spent, every honest node rejects any later attempt to spend it again. Our guide to UTXOs explains that model in more detail.

The harder part is ordering. If two conflicting transactions appear at about the same time, nodes need a shared answer to which one counts. Bitcoin settles this with proof of work.

Miners bundle transactions into blocks and compete to find a valid hash for each one. Nodes follow the chain with the most accumulated work, and once a transaction is buried in that chain, its conflicting twin is invalid everywhere.

Why confirmations matter

A transaction that has been broadcast but not yet mined sits in the mempool, the waiting room for unconfirmed payments. At this stage nothing is final.

Each block added on top of the block containing your payment counts as one confirmation. Rewriting it would mean redoing the work for that block and every block after it, faster than the rest of the network.

The white paper includes a table showing how quickly this gets hard. An attacker with 10% of the hash power has roughly a 0.1% chance of catching up from five blocks behind, and the odds keep falling with every extra block.

That is where the familiar habit of waiting for six confirmations on Bitcoin comes from. It is a convention, not a protocol rule. Merchants and exchanges choose their own number based on how much money is at stake.

Common double spend attacks

Most real double spend attempts are not dramatic. They target people who accept payments before they are confirmed.

In a race attack, the sender broadcasts a payment to a merchant and, almost at once, a conflicting payment back to themselves. If the second one gets mined first, the merchant's payment never confirms.

A Finney attack, named after early Bitcoin developer Hal Finney who described it in 2011, needs a miner. The miner secretly mines a block that sends coins to themselves, pays a merchant with the same coins, then releases the block.

Replace-by-fee also matters here. It lets a sender swap an unconfirmed transaction for a version with a higher fee. Bitcoin Core 28.0, released in 2024, enabled full replace-by-fee by default, which made it even clearer that zero-confirmation payments should not be treated as settled.

The defence against all three is simple: wait for confirmations before handing over anything valuable.

What is a 51% attack?

The bigger threat targets the ledger itself. A 51% attack, sometimes written as a 51 percent attack, happens when one person or group controls more than half of a proof-of-work network's hash power.

With that majority, the attacker can mine a private chain faster than everyone else combined. They spend coins on the public chain, wait until the payment is accepted, then publish their longer private chain where that payment never happened.

Nodes switch to the longer chain because that is the rule they follow. The original transaction disappears in what is called a reorganization, and the attacker keeps the coins as well as whatever they received for them.

A 51% attacker cannot take coins from wallets they do not control, create coins out of nothing or break the cryptography. Their power is limited to reordering and reversing recent transactions, including their own.

Real 51% attacks on smaller coins

Bitcoin has never suffered a successful 51% attack. Its total hashrate is enormous, and the specialised hardware needed to match it is not available to rent on short notice.

Smaller proof-of-work coins are a different story, especially those that share a mining algorithm with a larger network. Hash power can be rented from marketplaces such as NiceHash and pointed at a smaller chain for a few hours.

In May 2018, an attacker took majority control of Bitcoin Gold and double-spent against exchanges. More than 388,000 BTG, worth about $18 million at the time, passed through an address linked to the attack, and some reorganizations went back 22 blocks.

Ethereum Classic was hit several times. In August 2020 alone it suffered three deep reorganizations. Blockchain analytics firm Bitquery traced about 807,000 ETC, roughly $5.6 million, double-spent in the first one, against about $192,000 spent on rented hash power.

The pattern is the same each time. The attacker deposits coins at an exchange, trades them for something else, withdraws, then reverses the deposit. The exchange is left holding the loss, which is why many raised their confirmation requirements sharply afterwards.

Can proof of stake be 51% attacked?

Proof of stake changes the economics. Instead of renting hardware, an attacker needs a large share of the staked coins, which usually means buying them on the open market and pushing the price up.

Ethereum also adds finality. Blocks are grouped into epochs of about 6.4 minutes, and a block is normally finalized after two epochs, around 13 minutes. Reversing a finalized block would mean at least a third of all staked ETH being destroyed through slashing.

That does not make proof of stake immune. A large enough staker could still censor transactions or stall finality. But the cost of an attack falls on the attacker's own capital. Our comparison of proof of work and proof of stake covers these trade-offs in more depth.

How to protect yourself from double spending

For most people, double spending is something exchanges and merchants worry about. Still, a few habits help if you ever accept crypto directly.

Treat unconfirmed payments as promises, not money. For small amounts between people you trust, one confirmation may be fine. For larger sums, wait for more.

Be more cautious with smaller proof-of-work coins. A coin with little hash power, or one that shares an algorithm with a much bigger chain, is cheaper to attack, so it deserves a higher confirmation count.

If you are selling something valuable for crypto, do not release it until the payment has settled to a level you are comfortable with. That small delay is what the whole system relies on.