On 15 August 2010, block 74,638 of the Bitcoin ledger carried a transaction that created more than 184 billion bitcoin out of nothing. A bug in the way the software checked output values had let it through. According to the Bitcoin Wiki record of the incident, a corrected version of the software was out within five hours, and at block 74,691 the chain without the bad transaction overtook the one that contained it. In its second year, the Bitcoin record was rewritten, on purpose, by the people running it.
So is blockchain immutable? Not in the sense of “impossible to change”. A blockchain is expensive to change, and how expensive depends on who runs the network, who can read it and who can agree to override it. Those three questions map onto the three properties usually sold as the pillars of blockchain: decentralisation, transparency and immutability.
Each pillar works like a dial rather than a switch, and each has bent at least once, on a known date. The cases below include a 1964 network drawing, two stolen hoards of bitcoin followed for years, a court ruling on code nobody can update, attacks that rewrote small chains, and forks decided by people rather than by software.
This is lesson 14 of our getting-started path. The previous lesson, Bitcoin vs Ethereum vs blockchain, separated the technology from its two best-known networks. Here the question is what makes the technology different from an ordinary database run by one company. Blocks, hashes and nodes are explained step by step in our guide what is a blockchain; this lesson assumes those basics.
A 1964 drawing explains why one central switch is a weak point
Paul Baran joined the RAND Corporation in Santa Monica, California, in 1959. His problem was military. If a nuclear first strike destroyed a few key switching centres, the American telephone network of the early 1960s could stop carrying orders at the moment they mattered most. In 1964 he published “On Distributed Communications Networks”, and the research filled an eleven-volume study released the same year, as the Engineering and Technology History Wiki records. The work described a network that keeps working when some of its nodes are gone, and it is where packet switching was first proposed.
His best-known drawing puts three network shapes side by side. It already appeared as Figure 1 of his 1962 RAND paper, which the 1964 series expanded, according to a 2019 study of Baran’s network theory by Christopher Yoo of the University of Pennsylvania. The three shapes are:
- A centralised network, a star in which every outer node connects to one central node. Destroy that centre and every node is cut off.
- A decentralised network, made of several smaller stars whose hubs are linked into a larger star. Yoo notes it matched the structure of the US telephone network of the time. It survives more damage than a single star, but an attack on a small number of hubs can still disable it.
- A distributed network, a lattice in which no node is special: each has a similar number of links to its neighbours. Baran’s model found that three or four links per node were enough to come close to the best survivability possible.
Years later Baran put the point of the third shape in one line, which ETHW quotes as his recollection: “Many parts must fail before no path could be found through the network.” Our own drawing below is inspired by his. It does not reproduce it.
Centralised, decentralised, distributed: three words that are not synonyms
Here is the trap. In Baran’s vocabulary, “decentralised” is the middle shape: clusters of hubs and spokes, better than one star but still fragile at the hubs. Crypto writing uses “decentralised” for something closer to what Baran called “distributed”, and adds a second meaning on top: nobody is in charge. One word now carries a wiring meaning and a power meaning, and the two do not always go together.
On the wiring side, Bitcoin sits close to Baran’s third shape. The Bitcoin white paper says it plainly: “The network itself requires minimal structure.” Messages are passed between peers on a best-effort basis, and nodes can leave and rejoin when they like, picking up the longest valid chain when they come back. No node is the centre, and no list of hubs has to be protected.
Wiring is not the whole story, and the history of the internet shows why. Yoo’s study points out that the internet was not built as Baran’s flat lattice. It was deployed as a three-tier hierarchy that looks like Baran’s decentralised shape, and in recent years large content providers building their own cables and networks have made it more centralised rather than more distributed. A drawing of how a network could work is not a description of how it ends up being run.
Four layers where decentralisation can thin out
When a project calls itself decentralised, it helps to ask the question layer by layer:
- The network layer: how many independent nodes keep a full copy of the ledger and relay transactions, and whether they sit with many operators or a few hosting companies.
- The block-writing layer: who actually adds blocks. In Bitcoin that is miners under proof of work, who usually group into pools; in Ethereum it is validators under proof of stake.
- The software layer: who writes and releases the client software that every node runs, and how a change gets accepted.
- The access layer: where users actually hold their coins and keys. A network can be distributed while most of its users reach it through a handful of exchanges and custodians.
A blockchain is a distributed ledger by design. That does not make its power structure distributed. The useful question is “decentralised at which layer, and who could still switch it off?” The sections on forks and mining pools below show each layer bending at least once.
Anyone can read the ledger, nobody signs it with a name
The second pillar is transparency, and it was a design choice made to replace a bank. A bank keeps your payments private by keeping its books closed. Bitcoin cannot do that, because every node must check every transaction, so every transaction is announced to everyone.
Section 10 of the white paper, titled “Privacy”, explains the trade. Privacy moves somewhere else: to the keys. In Satoshi Nakamoto’s words, “The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone.” The paper compares this with a stock exchange tape, which publishes the time and size of each trade without naming the parties.
In practice, any block explorer will show, for any address, every amount received and sent, the time of each transaction and the addresses on the other side. What it does not show is a name. Our guide to what a crypto address is explains how addresses are derived from keys, and the guide to how crypto transactions work follows a payment from wallet to block.
The same white paper section already listed the weak points. It advised using a new key pair for each transaction, and admitted that a transaction spending several inputs at once reveals that those inputs had the same owner. It also warned that once one key is tied to a person, other transactions of that person can be linked to it. Those three sentences describe, in 2008, the method later used by investigators.
Transparency has a plain benefit too. Anyone who runs a node checks every rule on their own copy: no coin can be spent twice and no block can pay more than the protocol allows without the rest of the network rejecting it. That is how the August 2010 bug was fixed in public, on a ledger everyone could inspect.
Pseudonymous is not anonymous: stolen bitcoin followed for years
Two US cases show what a permanent public record means for someone who steals coins. The first started with Silk Road, the dark-web market. In September 2012, according to an IRS Criminal Investigation release of 7 November 2022, a man named James Zhong opened about nine accounts on the market and fired off more than 140 transactions in rapid succession that tricked its withdrawal system into releasing about 50,000 bitcoin. He moved them to addresses he controlled.
The coins sat on the ledger, visible to anyone, for nine years. On 9 November 2021, agents searched Zhong’s home in Gainesville, Georgia, and found bitcoin in an underground floor safe and on a single-board computer hidden in a popcorn tin in a bathroom closet. The seizure was worth over $3.36 billion at the time. Zhong pleaded guilty to wire fraud on 4 November 2022. The US Attorney for the Southern District of New York, Damian Williams, said the case showed that “we won’t stop following the money, no matter how expertly hidden”. The last of the coins had been found on a circuit board in that popcorn tin.
The second case is the 2016 hack of the Bitfinex exchange, in which 119,754 bitcoin were taken, worth about $71 million at the time. On 8 February 2022 the US Justice Department announced the arrest in New York of Ilya Lichtenstein and Heather Morgan on money laundering conspiracy charges and the seizure of about 94,000 bitcoin, valued at about $3.6 billion that day, as the Boston Globe reported. Lichtenstein pleaded guilty and was sentenced on 14 November 2024 to five years in prison, The Block reported. The Justice Department said the funds had been moved through mixers, layered transactions and darknet markets: six years of effort to break the trail, and investigators still followed it to two people in New York.
The weak point in both stories is the same: the moment coins have to touch the regular economy. Regulated exchanges collect identity documents when an account is opened, a process known as know your customer (KYC). When coins from a watched address land on such an account, a pseudonym gets a name. That is why the honest description of Bitcoin is pseudonymous, not anonymous.
One limit matters for ordinary users. Being able to follow stolen coins does not mean getting them back: the Silk Road and Bitfinex recoveries took years and federal investigators. If you are the victim of a scam, the public ledger will show where your money went, rarely who has it. Our guide on how to avoid crypto scams covers the warning signs that come first.
When the law targeted code: Tornado Cash, 2022 to 2025
Tornado Cash is the case where transparency and immutability met the law at the same time. It is a set of smart contracts on Ethereum that pools deposits and lets users withdraw to a fresh address, breaking the visible link between sender and receiver. On 8 August 2022 the US Treasury’s Office of Foreign Assets Control (OFAC) added Tornado Cash to its sanctions list. It said the service had been used to launder more than $7 billion worth of virtual currency since its creation in 2019, including over $455 million stolen by the North Korean Lazarus Group, more than $96 million from the Harmony bridge heist and at least $7.8 million from the Nomad heist.
Note where those figures came from. They could be counted because the deposits and withdrawals sat on a public ledger. Transparency made the case.
Immutability then complicated it. Some of the contracts could no longer be changed by anyone: more than a thousand volunteers had taken part in a “trusted setup ceremony” designed to remove for good the option of updating them. On 26 November 2024, in Van Loon v. Department of the Treasury, the US Court of Appeals for the Fifth Circuit held that “The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.” Sanctions law applies to property, so the listing of those contracts went beyond what the statute allowed.
On 21 March 2025 the Treasury removed the sanctions on Tornado Cash, after a review of what it called “novel legal and policy issues”, while saying it remained concerned about North Korean hacking and laundering. Treasury tied the decision to its filing in the Van Loon case. Through the whole episode the immutable contracts stayed on Ethereum: by design, nobody held a key that could remove them. For the wider family of applications built on such contracts, see our guide to decentralised finance.
Is blockchain immutable? Only while a rewrite costs more than it pays
The white paper’s own wording is careful. Its abstract describes “a record that cannot be changed without redoing the proof-of-work”. In other words, it can be changed, at a price: rewrite the block, then redo all the work stacked on top of it faster than the honest network adds new blocks. Nodes always treat the longest valid chain as the correct one, so whoever controls most of the computing power decides which history wins.
Section 11 of the paper puts numbers on it. If an attacker holds 10% of the computing power and the merchant waits until a payment is six blocks deep, the chance that the attacker ever catches up is 0.0002428, about 0.024%. Each extra block makes that chance smaller, but it never reaches zero.
Six confirmations is a convention, not a rule
That table is where the familiar “wait for six confirmations” comes from. The Bitcoin Wiki page on confirmations explains that the six-block default assumed an attacker was unlikely to hold more than 10% of the hashrate and that a risk below 0.1% was acceptable, and it calls both choices arbitrary. Against an attacker with 40% of the hashrate, it says 60 confirmations bring the odds of a successful double spend below 1%. For irreversible sales of high-value goods it suggests 144 blocks, about one day.
So the number of confirmations is a risk level that the receiver chooses, depending on the amount and on who might attack. A coffee and a house do not need the same wait.
Ethereum finalises blocks after about two epochs
Ethereum runs on proof of stake and adds a stronger notion called finality. According to ethereum.org, time is divided into slots of 12 seconds, grouped into epochs of 32 slots. Validators vote on checkpoints at epoch boundaries. When a pair of checkpoints gathers votes from at least two-thirds of all staked ether, the newer one becomes “justified” and the older one “finalized”.
In the usual case, then, a block becomes final after about two epochs: 2 epochs of 32 slots of 12 seconds is 768 seconds, or about 12.8 minutes (our arithmetic, not a guarantee). To reverse a finalised block, ethereum.org says, an attacker would commit to losing at least one-third of all staked ether. If the chain fails to finalise for more than four epochs, a mechanism called the inactivity leak starts draining the stake of validators that are not voting with the majority, until the majority holds two-thirds again and blocks can be finalised.
Finality is a much stronger promise than six Bitcoin confirmations. It still rests on an economic penalty and on most validators following the rules.
51% attacks have rewritten small chains: Ethereum Classic and Bitcoin Gold
Rewriting history on Bitcoin would require more computing power than every other miner combined. On smaller proof-of-work chains, the same move has been done several times, and the cases show what immutability is worth when the hash power securing a chain is small enough to rent.
Bitcoin Gold, a separate coin that split off from Bitcoin, was hit from 18 May 2018. The attacker controlled more than half of its hashrate and double-spent coins sent to exchanges: more than 388,000 BTG passed through the attacker’s address, worth over $18 million by BleepingComputer’s estimate. Exchanges raised the number of confirmations they required; the attacker added more hash power and carried on.
On 5 January 2019 Coinbase detected a deep chain reorganisation on Ethereum Classic and paused its interactions with the ETC blockchain. In later updates the exchange counted 12 more reorganisations that included double spends, totalling 219,500 ETC, about $1.1 million at the time, as Security Affairs reported on 8 January 2019; its first count had been 88,500 ETC. In January 2020 Bitcoin Gold was hit again: two deep reorganisations double-spent 7,167 BTG, about $72,000, according to an analysis by James Lovejoy, president of the MIT Bitcoin Club, reported by Finance Magnates. Lovejoy put the cost of each reorganisation at about 0.2 BTC, around $1,700 at the time, and said the attacker would have earned back about as much in block rewards. Binance, which had allowed BTG withdrawals after twelve confirmations, raised the requirement to 20.
Ethereum Classic was hit again at the start of August 2020. The data firm Bitquery found that more than 800,000 ETC, worth more than $5 million, had been double-spent, and estimated the rented hash power at less than $200,000, Decrypt reported.
| Date | Chain | What happened | Reported figure | Source |
|---|---|---|---|---|
| From 18 May 2018 | Bitcoin Gold | Majority-hashrate attack on exchanges | Over $18M; 388,000+ BTG through attacker’s address | BleepingComputer, 24 May 2018 |
| From 5 January 2019 | Ethereum Classic | Deep chain reorganisation; Coinbase paused ETC | 219,500 ETC (about $1.1M) double-spent, Coinbase’s later count | Coinbase, via Security Affairs, 8 Jan 2019 |
| January 2020 | Bitcoin Gold | Two deep reorganisations | 7,167 BTG (about $72,000); about 0.2 BTC per reorg | Finance Magnates, 27 Jan 2020 |
| Early August 2020 | Ethereum Classic | Double spend with rented hash power | Over 800,000 ETC (over $5M); hash power under $200,000 | Decrypt, 5 Aug 2020, citing Bitquery |
The pattern is consistent: small chains, rentable hash power, exchanges as the victims because they credit deposits and pay out before the attacker rewrites the deposit away. In the 2020 Bitcoin Gold case, about $1,700 of mining power per reorganisation, largely paid back in block rewards, bought double spends worth about $72,000. On a chain that small, immutability had a price, and the price was low.
Social forks: when people decide which history counts
Attacks are one way to change a ledger. Agreement is the other, and it has been used on the largest chains.
The 2010 overflow fix in the opening of this lesson was the first. The second came in March 2013. According to the post-mortem published as BIP 50, a new Bitcoin version, 0.8, accepted a large block that older versions rejected because of a database lock limit. The chain split in two. The 0.8 side had around 60% of the mining hash power, but the operators of two pools, BTCGuild and Slush, downgraded their nodes to 0.7 so that their pools would also reject the large block. It did, and the 0.8 nodes switched to it. At least one large double spend happened during the split, by someone experimenting rather than attacking, the post-mortem says. The split was detected very quickly, and a handful of people at the software and block-writing layers settled which history was real.
The best-known case is The DAO. On 20 July 2016 the Ethereum Foundation announced that block 1,920,000 had executed an “irregular state change”: about 12 million ether were moved out of two contracts tied to The DAO, a set of smart contracts on Ethereum, known as the “Dark DAO” and the “Whitehat DAO”, into a recovery contract called WithdrawDAO. Roughly 85% of miners followed the fork. The minority that refused kept the original chain going, which is the chain known today as Ethereum Classic; the same announcement is still kept on its website. Our crypto history timeline, the next lesson, puts this episode in its place among the others.
In March 2020 the Steem community went the same way. Justin Sun’s Tron Foundation acquired Steemit in February 2020. According to The Block, Tron and Steemit then enforced a hard fork of Steem with help from exchanges including Binance and Huobi. Binance’s chief executive, Changpeng Zhao, acknowledged approving that fork while saying Binance had no interest in chain governance. Part of the community answered with a fork of its own, planned for 20 March 2020 at 10 am EST, starting a new chain called Hive. Each side described the other as the attacker. The access layer, where exchanges sit, ended up weighing on a question of who writes the chain.
The lesson is not that blockchains are fake. A rewrite of a large chain needs either an enormous amount of computing power or stake, or the agreement of most of the people who run it. That is a much higher bar than one administrator changing a row in a database. But immutability is a social agreement backed by cost, not a law of physics.
Where the pillars bend: mining pools, staking and personal data
Back to decentralisation, at the block-writing layer. Bitcoin miners combine their machines in pools so that they get paid more regularly, and a few pools write most blocks. Hashrate Index published these estimated shares of Bitcoin’s hashrate on 31 December 2025, without stating the period measured:
| Pool | Estimated share of hashrate | Estimated hashrate |
|---|---|---|
| Foundry USA | 30.1% | 299 EH/s |
| AntPool | 18.3% | 211 EH/s |
| ViaBTC | 13.0% | 145 EH/s |
| F2Pool | 10.0% | 113 EH/s |
| SpiderPool | 8.8% | 98 EH/s |
As of end-2025, by that estimate, the two largest pools together held 48.4% and the top four 71.4%. Two caveats. A smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool coordinates machines it mostly does not own, and the miners behind it can point their hardware at another pool. And pool shares move from week to week, so figures without a date mean little. Analysts sometimes sum this up with a “Nakamoto coefficient”: the smallest number of entities that together control more than half of a resource. Here it would be three pools by that end-2025 estimate.
Ethereum has its own version of the question. Since finality needs two-thirds of staked ether, any single staking provider or group acting together with more than one-third of the stake could stop blocks from becoming final. That threshold comes straight from the rules above, and it is why the share of large staking services is watched closely.
Personal data and an append-only ledger
Transparency and immutability collide with privacy law in Europe. On 7 July 2026 the European Data Protection Board adopted version 2.0 of its Guidelines 02/2025 on processing personal data through blockchain technologies, after a draft (version 1.1) adopted on 8 April 2025 and a public consultation. The GDPR it interprets covers organisations that process personal data of people in the EU, including some based outside the Union.
Its main points are blunt. On-chain metadata, including wallet addresses and transaction identifiers, may be personal data when it allows a person to be identified. Public blockchains should only be used if public access is necessary for at least one purpose of the processing, and organisations should favour permissioned blockchains. Personal data stored in identifiable form will in most cases stay on the chain with no practical way to delete it, and the Board says technical impossibility cannot be used to justify breaking the GDPR. Encrypting data before it goes on chain, or keeping it off chain and recording only a commitment, are among the measures it describes.
Read that next to the white paper: the property that makes Bitcoin auditable is the one that makes a public ledger the wrong place for names, health records or anything a person may later ask to erase. Our guide to public vs private blockchains explains the permissioned alternative.
When each pillar matters, and when it does not
The three pillars are not a package that every project needs in full. Each one has a cost, and the cases above show where the cost buys something and where it buys nothing.
Decentralisation pays off when no single party can be trusted or switched off
It matters when the people using a system do not trust one another and do not want any single operator to be able to stop it. The Tornado Cash contracts are the extreme case: two and a half years on the US sanctions list did not remove them from Ethereum, because no one held a key that could. Baran’s goal in 1964 was the same kind of resilience against the loss of a few central points.
It matters much less when one organisation already runs the system and its users accept that. A bank’s internal ledger, a company’s stock records or a city’s parking permits have an operator who is legally responsible and who can be sued. Spreading those records over many nodes adds cost and coordination without removing that operator, who still decides the rules. The EDPB makes a related point for personal data: organisations should consider whether blockchain is appropriate at all, and whether other technologies would suit their purpose.
Transparency pays off for audits, and costs you privacy
A public ledger is useful when strangers must be able to check the record without asking anyone’s permission. That is how anyone running a node checks that no coin was created out of thin air, how OFAC could count the funds that went through Tornado Cash, and how the Silk Road and Bitfinex coins were followed for nine and six years.
The same property is a liability for anything private. Salaries, medical data, customer files and a person’s spending habits do not belong on a ledger that the whole world can read for ever. For an ordinary user the practical point is simple: once your name is tied to one address, for example through an exchange account opened with your ID, your payment history from that address is open to anyone who makes the link. Using a new address for each payment, as the white paper already advised in 2008, limits that.
Immutability pays off for settlement, and hurts when mistakes need fixing
A record that is expensive to rewrite is what lets a seller hand over goods to a stranger once a payment is deep enough in the chain. That is the job Bitcoin was built for. The depth needed depends on the amount: the Bitcoin Wiki’s 144-block suggestion for high-value sales is about a day, while a small payment may need far fewer blocks, and on Ethereum a finalised block carries the cost of a third of all staked ether.
It hurts when errors must be corrected. A payment sent to the wrong address on Bitcoin has no help desk that can reverse it. When the stakes were high enough, the fix took a fork: the 2010 overflow and The DAO in 2016 were both repaired by changing the chain that people agreed to follow. Data that someone may legally ask to have erased, under the GDPR, should not go on a public chain in identifiable form in the first place, the EDPB says.
| Pillar | Worth its cost when | Gets in the way when | Case from this lesson |
|---|---|---|---|
| Decentralisation | Users do not trust a single operator, and nobody should be able to stop the system | One accountable operator already runs it | Tornado Cash contracts stayed online through sanctions |
| Transparency | Anyone must be able to audit the record | The data is personal or confidential | Silk Road coins traced and seized after nine years |
| Immutability | Strangers settle payments without a referee | Mistakes need refunds or data needs erasing | 2010 overflow and The DAO fixed by forks |
A quick test for any project that calls itself a blockchain: ask who could change the rules, who can read the data, and who could undo a payment. If the honest answer to all three is “the company behind it”, the pillars are not doing much work, whatever the marketing says. If the answer is “nobody alone, everyone, and nobody without a costly fork”, you are looking at something close to Bitcoin.
Those answers change over time and from chain to chain, so they carry a date. As of the end of 2025, three mining pools wrote more than half of Bitcoin’s blocks by Hashrate Index’s estimate, and the EDPB’s final guidelines on blockchain and personal data are dated 7 July 2026. The next lesson, our crypto history timeline from 2009 to 2026, places the 2010, 2013 and 2016 episodes among the other milestones.
