Cost to perform a 51% attack on the BTC blockchain?

[Abiky]

I'm curious to know what will be the cost in terms of USD for performing a 51% attack on the Bitcoin blockchain? I'm guessing that it might take a lot of money to do so, considering how many miners are backing the entire chain. A formula on how to calculate such cost would be great to know, in order to make things easier when working on a cryptocurrency project of my own. Knowing beforehand the costs involved for attacking a PoW blockchain, could encourage developers to reinforce security on the same.

Of course, a 51% attack on Bitcoin is not feasible right now. But it might be on smaller chains like Bitcoin Cash, and Bitcoin SV. Any helpful advice on how to calculate 51% attack costs on the Blockchain will be greatly appreciated. This of course, will be for learning/educational purposes than anything else. Thanks in advance.

[Chlotide]

https://www.crypto51.app/

If any of you are too lazy to click :  $468.961 / h (would have assumed a higher number tbh)

The price can be calculated in many ways. The way they do it is

Using the prices NiceHash lists for different algorithms we are able to calculate how much it would cost to rent enough hashing power to match the current network hashing power for an hour

But also mention that it's purely theoretical at least un BTC case. BCH is another discussion )

[AdolfinWolf]

Hmmm. I think you can look at it a number of ways.. If you actually plan on buying all your machines, a simplified version would be something like

 number of miners = ( total network hashpower ) / hash power per miner
 number of miners * price per miner = $$$$$$


If you rent them, i guess it could be significantly cheaper.

Nicehash offers 1PH/s on the bitcoin chain for ~ 0.0168BTC

Bitcoin sees ~ 120 exahash. https://www.blockchain.com/charts/hash-rate
 = 120000 pentahash (?)

120000*0.168 = ~141.120.000 $ (For, lets say - a month?) to get 51% hashing power (this doesn't seem that expensive.)

Although they obviously don't have that much mining power for rent (I see nicehash only has ~ 180 PH).

Purely theorethically speaking (if we forget about the practicalities of renting 120 ph worth of hashing equipment/however many hashes/s a chain has, (let alone buying it, in which case i highly doubt it would be profitable.)) i could see a number of scenario's where it could definitely be profitable to do a 51% attack.

[Chlotide]

Nicehash offers 1PH/s on the bitcoin chain for ~ 0.0168BTC

Bitcoin sees ~ 120 exahash. https://www.blockchain.com/charts/hash-rate
 = 120000 pentahash (?)

120000*0.168 = ~141.120.000 $ to get 51% hashing power (this doesn't seem that expensive.)

Although they obviously don't have that much mining power for rent (I see nicehash only has ~ 10 TH), but theorethically speaking, i think such an attack could perhaps be profitable, that is if my calculations are correct..
 

Seems you need to remove a 0 and you get $14M /day.

Not that cheap if you think about it. You either do a double spent or fork and hope othera will believe you are a billionaire )

[AdolfinWolf]

Nicehash offers 1PH/s on the bitcoin chain for ~ 0.0168[btc]

Bitcoin sees ~ 120 exahash. https://www.blockchain.com/charts/hash-rate
 = 120000 pentahash (?)

120000*0.168 = ~141.120.000 $ to get 51% hashing power (this doesn't seem that expensive.)

Although they obviously don't have that much mining power for rent (I see nicehash only has ~ 10 TH), but theorethically speaking, i think such an attack could perhaps be profitable, that is if my calculations are correct..
 

Seems you need to remove a 0 and you get $14M /day.

Not that cheap if you think about it. You either do a double spent or fork and hope othera will believe you are a billionaire )

I was more thinking about other scenario's, such as leveraged shorting using a platform such as Bitmex, as in the event of a 51% attack, you'd expect the price to go down.
I'm not sure if there's a possibility to short smaller coins such as ETC suffficiently enough though. (Although, looks like they have quite some liquidity on Bitforex etc.. -- 81 million in the last 24h? lol...)

[Tym]

Actually I wanted to ask a similar question but suddenly I saw this post so I wanted to add my question here.

I read an article from Vitalik Buterin where I found this:

If a light client was offline for some period of time, and then comes back online, then it will look for the longest chain of valid block headers, and assume that that chain is the legitimate blockchain. The cost of spoofing this mechanism, providing a chain of block headers that is probably-valid-but-not-actually-valid, is very high; in fact, it is almost exactly the same as the cost of launching a 51% attack on the network.

Source: https://blog.ethereum.org/2015/01/10/light-clients-proof-stake/

In fact, I belive what Buterin is saying/writing but I'm looking for a mathematical proof to add it to my thesis.

Maybe someone knows a good link or is able to explain (in a mathematical way) why creating such a chain is as expensive as a 51% attack.

I'd love to read your answers! Thank you!

[aliashraf]

OP,
Firstly you should understand that a 51% attack has two different class of costs:
1) Fixed cost: It includes infrastructure and the machines. Essentially, it doesn't matter whether the attacker could be able lease such facilities the fixed cost would be reasonably the same.

2) Variable cost: It is mainly the electricity cost.

Nicehash sells both sha256 and Ethash power online but both for Ethereum and bitcoin, the available volume is far less than anything potentially helping a 51% attacker.

From your post, I understand you are more curious about new cryptocurrency projects when the total network hash rate is very low and one can lease enough hash power to carry out such an attack. For this scenario, I've something to present:

Suppose we have Xcoin with a market price of P₀ at a given period of time. Let Xcoin inflation rate in an hour to be IR (Inflation Rate). Now suppose Xcoin is in a somewhat stable state (neglectable price and network hash rate volatility) and we have TNH as the total network hash rate in the same period we have P₀ as the price.

Before proceeding anymore we have to make it crystal clear about some points:
1- A 51% attack is always about defrauding a single user/group of users specifically a limited number of exchanges.

2- Users have always a chance to mitigate such attacks by waiting for more confirmation before accepting the payments and releasing their assets.

3- Established pools/mining farms have strong incentives not to collude and engage in such attacks because they have strategic interests at stake.

So, the attacker has to lease TNH+D hash power from the market (where D stands for a minimum threshold that I'll discuss later) and keep it up and running privately for a period of time long enough while she is waiting for the victim(s) to accept the fraudulent transaction which is going to be removed from the blockchain after the attack is exploited as a short-range chain rewrite, let's put it at WT for 'waiting time'.

Translating absolute time variables to blockchain terminology is trivial so let's suppose we have already used the Xcoin's block time as the unit of time and both IR and WT are expressed using this unit of time.

First observation: The cost of leasing TNH+D hash power, Lease Cost or LC, in a stable market could be estimated as being slightly more than the total price of the coins generated because a normal miner has some expectations for profits, PE, and there is also another income, transaction fees, TF. Hence: LC = P₀ * (IR + TF)* WT + PE

Second Observation: Although after exploiting the attack, one could expect a significant drop in XCoin price, P₀, and it'd be very hard to liquidate block rewards and fees (if any) collected in WT but it won't fall to zero, so we will have the price falling very sharp to something like P_a for the aftermath price. Hence other than the main fraud plan the attacker also collects:
Partial Compensation, PC = P_a * WT * IR

Third observation: Although a hypothetical 50%+1 attack on a blockchain will succeed eventually in making a longer/more difficult chain in a very long period of time with a probability of 100% it is not rational for an attacker to carry on such an attack in very large windows of time, much larger than what is needed for convincing the victim(s), hence there is always a trade-off involved and a D threshold should be considered safe for the attacker to minimize the attack cost and remain confident about its success.

Now we need to make some assumptions about D, TF, P_a:
Let's suppose XCoin drops 80% after the exploit and the attacker chooses to set D at 10% of the network hash power and TF, normally adds another 5% to miners' income. While miners' profit expectation could be reasonably estimated at 10%,  i.e. a customer with legitimate incentives expects 10% profit when he or she leases a specific amount of hash power.
With such parameters set, we can easily calculate the net 51% attack cost as being:


Lease Cost,                        LC = P₀ * IR *WT* 1.17
Partial Compensation,           PC = 0.2*P₀ *IR *WT

Net Attack Cost, NAC= LC-PC    =  P₀ * IR *WT * 0.93


Conclusion: The net cost of a typical 51% attack on an altcoin with small network hash power is expected to be the same as the total inflation of the coin in the window of time that the attack is carried on.

From this, I suggest a simple mitigation strategy for vulnerable users/exchanges:
Always wait for a very good factor (at least 2-3 times) the transaction value for the network to produce enough block rewards (neglecting the fees) before accepting the large payments.

Yet another good recommendation:
Don't waste your customers' time too much if it is about just a few pennies at stake, accept micropayments and generally, any payment less than 10% of the block reward with just one confirmation.

[d5000]

Interesting calculation, @aliashraf - but I would like to make a small addition.

An 51% attacker can increase PC (the partial compensation) by a pretty significant amount if he is able to carry out a short sale of the currency while he 51%s the network. He can do this even in an almost risk-less way if he buys a short-term put option on it.

So PC should be calculated in the following form, with SP = Short sale profit:

PC = P_a * WT * IR + SP

It would be interesting how high is the typical profit of this maneuvre. Obviously this is influenced by several factors. For example, if Xcoin is already in a bear market, the profit could be lower as put options will be more expensive (and also regular shorts are more expensive to be carried out due to higher interest rates). Additionally, you have to consider the difference between P₀ and P_a - the higher it is, the higher PC will be.

We can add the following to the formula if we consider (for simplicity) that the attacker buys a put option with a short expiration with a strike price of P₀: (O_P0 = put option price, q = quantity of options with the value of 1 Xcoin bought):

SP = q * (P₀ - P_a) - q * O_P0

So our formula becomes:

PC = P_a * WT * IR + q * (P₀ - P_a) - q * O_P0

I'm not an expert on option price theory so it's possible the attacker can increase his profit if he buys options with a strike price which is lower than P₀. For example, if he expects the devaluation to be 80%, then he can buy a put option with a strike price 20% under the current Xcoin price for a very cheap price, but his risk is also higher.

PS: Corrections are welcome!

[aliashraf]

@d5000,
Thank you for the contribution, it was impressive.
I afraid the derivative market for such assets may not be mature enough to help, tho. Hedging against price fluctuations is a good idea for the attacker but it works for coins like Bitcoin and Ethereum and attacking such coins is a bit more sophisticated I suppose:

Firstly it is impractical to lease/install enough power covertly and once it is exposed both the primary and the secondary market respond properly. It also extends the window of the attack which causes put options for short selling coins to become more expensive.

Also, the time window should be extended even more because putting hundreds of thousands of dollars at risk is irrational with high variance. For instance, even with 60% of power there is a very good chance for the honest network to produce a longer chain in a 10-20 blocks window. When the stakes are high, attackers need to be thoroughly convinced about what they've put in options.

Additionally, 51% attacking a network for defrauding the users is a crime. Derivative markets are not run anonymously, so the attacker should be concerned for the legal consequences and market manipulation charges besides double-spending and fraud.

[ranochigo]

What would be the cost analysis for the following,

Let's say Bitmain's next state of the art Antminer is not listed for public sale.
But instead quietly deliver to their cheapest energy sources, and activated to give them 51%.

They only have their own manufacturing & energy costs, which they could subsidize by selling bitcoins and earlier model asics.

So just to play devil's advocate, the real reason their won't be a 51% attack is that Bitcoin has already achieved greater than 51% and this blocks anyone else's attempts.

But Bitmain is mainly an ASIC manufacturing company. It would be way more worthwhile for them to continue to improve on their ASICs and continue selling them. If they were to attack Bitcoin, it would just be like shooting themselves in the foot; investors won't be happy and the whole ASIC business would probably go down the drain as any new cryptos would then make their coins ASIC resistant their priority.

They would probably face some lawsuit from the people that they stole the Bitcoins from.

[Wind_FURY]

FYI:
This would also imply a massive danger to bitcoin if Bitmain ever decided to make another ASIC mined coin their #1.  

But hey , this is just all speculation, right.    

Do you believe the community, and the economic majority would follow Jihan Wu to Rogercoin? Bitmain would be a more profitable ASIC company if they did their business with actual honestly.

[pooya87]

FYI:
This would also imply a massive danger to bitcoin if Bitmain ever decided to make another ASIC mined coin their #1. 
But hey , this is just all speculation, right.   

Do you believe the community, and the economic majority would follow Jihan Wu to Rogercoin? Bitmain would be a more profitable ASIC company if they did their business with actual honestly.

there is no honesty in a business, there is only money (profit) making. both ASIC producers and miners are basically businesses that are looking to make the most amount of profit. that is why they will always stick to what gives them profit.
you want example? look at 2017 when bcash was created and was manipulating the difficulty so much so that they were finding near one thousand blocks per day (instead of normal ~144) and the profit was high because of that and the pumps. many miners switched and Bitmain make a shit ton of money selling ASICs.
it should also be mentioned that bitcoin didn't care about any of that!

[Eplus_Team]

Hmmm. I think you can look at it a number of ways.. If you actually plan on buying all your machines, a simplified version would be something like

 number of miners = ( total network hashpower ) / hash power per miner
 number of miners * price per miner = $$$$$$


If you rent them, i guess it could be significantly cheaper.

Nicehash offers 1PH/s on the bitcoin chain for ~ 0.0168BTC

Bitcoin sees ~ 120 exahash. https://www.blockchain.com/charts/hash-rate
 = 120000 pentahash (?)

120000*0.168 = ~141.120.000 $ (For, lets say - a month?) to get 51% hashing power (this doesn't seem that expensive.)

Although they obviously don't have that much mining power for rent (I see nicehash only has ~ 180 PH).

Purely theorethically speaking (if we forget about the practicalities of renting 120 ph worth of hashing equipment/however many hashes/s a chain has, (let alone buying it, in which case i highly doubt it would be profitable.)) i could see a number of scenario's where it could definitely be profitable to do a 51% attack.

Well if you buy the miners you have many other costs too like, space where u put them, cooling, electricy wires check that all are running...

[d5000]

I afraid the derivative market for such assets may not be mature enough to help, tho. Hedging against price fluctuations is a good idea for the attacker but it works for coins like Bitcoin and Ethereum and attacking such coins is a bit more sophisticated I suppose:

I agree that at the moment the scenario may not be practical, or at least, the attacker would probably not be able to compensate for a big portion of his costs with the options/hedging strategy. However, with the rise of DeFi tools, options and other short sale opportunities are continuously getting more popular. So I think all serious altcoin communities should take into account that strategy (it is also possible when attacking PoS coins, obviously). Bitcoin and ETH, should also not totally ignore it; there may be situations (e.g. after an extreme downwards price move with plenty of miners quitting) where such an attack could eventually become profitable, although it will continue to be very difficult to carry out, also taking into account what you say about the whole move probably being a crime.

One of the consequences may be that when an 51% attack is under way it may be helpful for a coin if many people bought it just then, so the price rises and the attacker loses with any hedging strategy and closes his short, maybe losing interest in his attack as well (if he can still cancel the hashrate leasing contract). However, he then also could cash out his mining rewards for a higher price.

[Wind_FURY]

FYI:
This would also imply a massive danger to bitcoin if Bitmain ever decided to make another ASIC mined coin their #1. 
But hey , this is just all speculation, right.   

Do you believe the community, and the economic majority would follow Jihan Wu to Rogercoin? Bitmain would be a more profitable ASIC company if they did their business with actual honestly.

there is no honesty in a business, there is only money (profit) making. both ASIC producers and miners are basically businesses that are looking to make the most amount of profit. that is why they will always stick to what gives them profit.
you want example? look at 2017 when bcash was created and was manipulating the difficulty so much so that they were finding near one thousand blocks per day (instead of normal ~144) and the profit was high because of that and the pumps. many miners switched and Bitmain make a shit ton of money selling ASICs.
it should also be mentioned that bitcoin didn't care about any of that!

I was talking about Bitcoin's incentive-structure, and the game theory, which is what actually holds everything together, and why Bitmain is still in business. Considering that, the troll is just trolling.

[buwaytress]

So we're all talking about the cost to perform the attack, and some speculate it might even be worth it. But the real cost isn't in the financial resources you've got to put together to pull off such a thing, but what happens AFTER that when the attack is discovered and all the other actors reorganise.

Antonoupoulos explains it best as usual: https://www.youtube.com/watch?v=ncPyMUfNyVM

[aliashraf]

Antonoupoulos explains it best as usual: https://www.youtube.com/watch?v=ncPyMUfNyVM

I don't think it is a thorough analysis, it is not supposed to be anyway. Actually, there is a hole in his argument: The audience is questioning the feasibility of a hypothetical government attack against bitcoin seemingly with a political incentive yet Antonopoulos mistakenly is using the rational behavior assumption which is not adequate. To be clear: Bitcoin is not safe and secure against multibillion-dollar, (in its economic sense) irrational aggression of governments, it is not designed to be.

On the other hand, OP's main concern is not exactly bitcoin, it is more about a general case with new projects, though the analysis could be made general enough to cover the case with bitcoin as well. It is what I've done and @d5000 has made an excellent contribution to, up-thread. You are welcome to check both.

[Tym]

Thank you very much for your responses! Especially @aliashraf and @d5000. You're helping me a lot with these formulas!

[Wind_FURY]

Antonoupoulos explains it best as usual: https://www.youtube.com/watch?v=ncPyMUfNyVM

I don't think it is a thorough analysis, it is not supposed to be anyway. Actually, there is a hole in his argument: The audience is questioning the feasibility of a hypothetical government attack against bitcoin seemingly with a political incentive yet Antonopoulos mistakenly is using the rational behavior assumption which is not adequate. To be clear: Bitcoin is not safe and secure against multibillion-dollar, (in its economic sense) irrational aggression of governments, it is not designed to be.

Bitcoin was designed not to trust each other, plus under the assumption that THERE ARE bad-actors, and that's why, don't trust, and verify everything yourself by running a full node.

[Tym]

After going through everything I've some open questions in my mind:

Lease Cost,                        LC = P0 * IR *WT* 1.17
Partial Compensation,           PC = 0.2*P0 *IR *WT

Net Attack Cost, NAC= LC-PC    =  P0 * IR *WT * 0.93

Where are these numbers 1.17, 0.2 and 0.93 coming from?


And I'm curious how to insert the formula mentioned by @d5000 into the formula of NAC (net attack cost).

PC = Pa * WT * IR + SP
SP = q * (P0 - Pa) - q * OP0

PC = Pa * WT * IR + q * (P0 - Pa) - q * OP0

Thanks