On 5 January 2019, Coinbase noticed something that is not supposed to happen on a blockchain: a deep reorganisation of Ethereum Classic, a chain whose history had been rewritten by someone with more mining power than the honest miners. The exchange paused ETC payments and later counted double spends worth about 219,500 ETC, roughly $1.1 million at the time, as The Hacker News reported. Blocks that users and exchanges had treated as settled were replaced by other blocks.
So why is blockchain immutable, if a chain can be rewritten like that? The short answer: it is not immutable in the sense of “impossible to change”. It is tamper-evident and expensive to change. Any edit to the past shows immediately, and undoing it requires redoing work (proof of work) or destroying money (proof of stake) on a scale that, on large networks, nobody has found worth paying. Small chains are a different story, and the community can always decide to change the rules, as Ethereum did in 2016.
This lesson follows our lesson on what a block contains, which showed that each block header carries the hash of the previous block. How a blockchain works covers transactions, nodes and mining at overview level, and our lesson on the three pillars of blockchain places immutability next to decentralisation and transparency, explains where the six-confirmation habit comes from and sums up the best-known 51% attacks. This page goes into the mechanics and the numbers: what a rewrite of Bitcoin would cost as of October 2026, how Ethereum makes blocks final, and how deep the real rewrites went.
Why is blockchain immutable? Because every change is visible and costly
Bitcoin’s whitepaper does not promise an unchangeable ledger. Its abstract describes something more modest and more precise: “a record that cannot be changed without redoing the proof-of-work”, in Satoshi Nakamoto’s words. Read the condition at the end of that sentence. A change is possible; it has a price, and the price grows with every block added on top.
“Immutable” packs together three different protections, and they fail in different ways. The first is mathematical: a hash link makes any edit visible. The second is economic: work or stake attached to every block makes an edit expensive. The third is social: thousands of independent operators run the same rules and refuse a history that breaks them. Nearly every headline about a “rewritten” chain is a failure of the second or the third, almost never of the first.
Hash links: change one block and every later block breaks
A hash function turns any amount of data into a short fingerprint of fixed length; Bitcoin uses SHA-256 (our lesson on cryptography explains how). The property that matters here is the avalanche effect: change a single character of the input and the fingerprint changes completely, with no visible relation to the old one.
Each block header stores the hash of the block before it. Imagine four blocks, numbered 100 to 103, with made-up short fingerprints for the sake of the example (real ones are 64 hexadecimal characters). Block 101 records “the previous block is a3f9”. Block 102 records “the previous block is 7c21”, the fingerprint of 101. Block 103 points to 102 in the same way.
Now someone edits one transaction inside block 101, changing a payment of 1 BTC to 10 BTC. The transactions are summarised in the header (through a Merkle root), so the header changes, and its fingerprint is no longer 7c21: it becomes, say, e04b. Block 102 still says “my parent is 7c21”. The link is broken, and every node that checks the chain sees it at once. To repair it, the editor must rewrite block 102 so it points to e04b, which changes 102’s own fingerprint, which breaks 103, and so on up to the most recent block. You cannot alter one page of the ledger quietly; you have to reprint every page after it, and anyone holding an old copy can compare.
Hash links prove tampering; they do not prevent it. Recomputing a few thousand SHA-256 hashes takes a laptop less than a second, so anyone could produce a complete, internally consistent alternative history in a minute if hashes were the only protection. What stops that is the cost attached to each block, which is where proof of work and proof of stake come in.
Proof of work: the price of rewriting the past
Redo the block, every block after it, then outrun the honest miners
Under proof of work, a block is valid only if its header hash falls below a target set by the network’s difficulty. At the difficulty in force in late October 2026, about 140.58 trillion, finding one valid header takes around 6 x 1023 guesses on average (the difficulty times 232, our arithmetic), which the whole network gets through in roughly ten minutes. Section 4 of the whitepaper draws the consequence: once the work is spent, the block cannot be changed without spending it again, and the work to change it includes redoing all the blocks chained after it.
Redoing the work is still not enough. While the attacker recomputes old blocks, the honest network keeps adding new ones on the public chain. Nodes follow the valid chain with the most accumulated work, so the attacker’s version is only adopted if it catches up with the honest chain and then gets ahead of it. Section 5 of the whitepaper describes exactly this race. An attacker who holds less hash power than everyone else combined falls further behind with each block, which is why an old block is safer than a new one.
The practical attack is not “rewrite last year”. It is the double spend: pay a merchant or an exchange, wait until they deliver, then publish a secret chain in which that payment never happened and the same coins went to an address you control. The attacker cannot move coins from someone else’s address, because that needs the owner’s private key, nor create coins outside the protocol’s rules, because every node would reject such blocks.
The odds fall exponentially: the whitepaper’s own table
Section 11 of the whitepaper models the race as a random walk. Call q the attacker’s share of total hash power and z the number of blocks the attacker is behind (in practice, the number of confirmations the merchant waited for). As long as q stays below one half, the chance of the attacker ever catching up falls exponentially as z grows. The first nine rows below are printed in the whitepaper. The last four are not: Coindaro computed them with the formula the paper gives, after checking that it reproduces the paper’s own values.
| Attacker share (q) | Blocks behind (z) | Chance of catching up | Source |
|---|---|---|---|
| 10% | 1 | 20.5% | Printed in the whitepaper (section 11) |
| 10% | 2 | 5.1% | Printed in the whitepaper (section 11) |
| 10% | 5 | 0.09% | Printed in the whitepaper (section 11) |
| 10% | 6 | 0.024% | Printed in the whitepaper (section 11) |
| 10% | 10 | 0.00012% | Printed in the whitepaper (section 11) |
| 30% | 5 | 17.7% | Printed in the whitepaper (section 11) |
| 30% | 10 | 4.2% | Printed in the whitepaper (section 11) |
| 30% | 30 | 0.015% | Printed in the whitepaper (section 11) |
| 30% | 50 | 0.00006% | Printed in the whitepaper (section 11) |
| 30% | 6 | 13.2% | Computed by Coindaro with the whitepaper’s formula |
| 40% | 6 | 50.4% | Computed by Coindaro with the whitepaper’s formula |
| 45% | 6 | 76.6% | Computed by Coindaro with the whitepaper’s formula |
| 45% | 144 (about a day) | 4.3% | Computed by Coindaro with the whitepaper’s formula |
The whitepaper also lists how many blocks push the risk below 0.1%: 5 against a 10% attacker, 11 against 20%, 24 against 30%, 89 against 40% and 340 against 45%. The lesson of the table is uncomfortable for the slogan. Six confirmations are excellent protection against a small attacker and weak protection against a near-majority one: at 45%, even a full day of blocks leaves the attacker about one chance in 23. At 50% or more, the model says the attacker catches up eventually, whatever the number of confirmations. Our guide to the Bitcoin whitepaper covers the rest of section 11.
That is the gap behind the six-block habit. The Bitcoin Wiki page on confirmations says the default assumed an attacker with no more than 10% of the hash rate, and that there is “nothing special about the default” of six. Against a 30% attacker, our computed row shows six blocks still leave a 13% chance. Exchanges set their own thresholds per asset on their support pages, and they change over time.
What a rewrite of Bitcoin would cost, as of October 2026
The cost of a rewrite is public arithmetic, because hash rate and mining revenue are published. On 25 October 2026, mempool.space estimated the Bitcoin network at about 1.07 zettahashes per second (1,068 exahashes per second), with a difficulty of about 140.58 trillion set on 16 October 2026. To outpace that, an attacker needs more than half of it: more than about 534 EH/s of machines, on top of the honest network.
Electricity first. Miners are grouped by efficiency in joules per terahash. Using the 14 to 19 J/TH band listed by Hashrate Index on 28 September 2026, 534 EH/s draws roughly 7.5 to 10 gigawatts (534 million TH/s times 14 to 19 joules per second). That is the output of several large power stations, running for as long as the attack lasts.
Then the money the machines would otherwise earn. Hashrate Index put the hashprice, the daily revenue per unit of hash power, at $39.87 per petahash per second per day on 28 September 2026. At that rate 534,000 PH/s earns about $21 million a day by mining honestly. An attacker gives up that income for every day spent building a secret chain, and if the attack becomes known, the coins being stolen and the machines themselves could lose much of their value.
| Input | Value | Date and source |
|---|---|---|
| Bitcoin network hash rate | About 1.07 ZH/s | 25 Oct 2026, mempool.space estimate |
| Difficulty | About 140.58 trillion | Set 16 Oct 2026, mempool.space |
| Hash power needed for a majority | More than about 534 EH/s | Computed by Coindaro: half of the network |
| Power draw at 14 to 19 J/TH | About 7.5 to 10 GW | Computed by Coindaro with the Hashrate Index efficiency band of 28 Sep 2026 |
| Hashprice | $39.87 per PH/s per day | 28 Sep 2026, Hashrate Index |
| Mining revenue forgone by 534 EH/s | About $21 million per day | Computed by Coindaro: 534,000 PH/s x $39.87 (hashprice of 28 Sep 2026) |
| New coins per day | 450 BTC (144 blocks x 3.125 BTC) | Protocol subsidy since April 2024 |
Treat these as orders of magnitude, not as a quote for an attack: they mix a hash rate of 25 October with a hashprice of 28 September. The real barrier is not the electricity bill. Hash power on that scale is not for rent anywhere, and buying or building that many machines could hardly go unnoticed by chipmakers, miners and the market. That is the deep reason a large proof-of-work chain resists rewriting, and also why the same reasoning fails for small chains. The deepest known rewrites of Bitcoin’s history were caused by software bugs, not by attackers.
Finality under proof of stake: blocks protected by money that can be burned
Ethereum stopped using mining in September 2022. Under proof of stake, validators lock ether as collateral and take turns proposing and voting on blocks (our Ethereum lesson explains the network). There is no work to redo, so the protection comes from a rule that makes certain blocks final, and a penalty that destroys the stake of anyone who signs two conflicting histories.
Two-thirds votes, two epochs, about 15 minutes
The three pillars lesson gives the outline; here is the rule itself. Time on Ethereum is cut into slots of 12 seconds and epochs of 32 slots (6.4 minutes), and the first block of each epoch is a checkpoint. According to the ethereum.org page on Gasper, a checkpoint becomes “justified” when validators holding two-thirds of all staked ether have voted for it, and “finalized” when another checkpoint is justified on top of it. That takes at least two epochs, 12.8 minutes, plus the wait for the next epoch boundary; ethereum.org rounds it to about 15 minutes. Blocks newer than the last finalised checkpoint are protected only by the fork-choice rule, and they can still be reorganised in rare cases.
Undoing a final block means destroying a third of the stake
The Gasper page states the price directly: a finalised block cannot be reverted unless there has been a critical consensus failure and an attacker has destroyed at least one third of the total staked ether. The reason is that two conflicting final checkpoints require two-thirds of the stake on each side, so at least a third of validators must have signed both, and signing both is a slashable offence that the protocol detects with the signatures themselves.
The same page puts that at “around $10 billion” of ether as of May 2022. The figure moves with the stake and the price, so here is the dated version. On 25 October 2026, validatorqueue.com counted 44.1 million ETH staked by 817,345 active validators, about 36% of supply. At $2,327 per ether (Coindaro market data, 25 October 2026, 09:37 UTC), the whole stake was worth about $102.6 billion, and one third, about 14.7 million ETH, about $34 billion (our arithmetic).
The attack and defence page of ethereum.org lists the other thresholds. More than a third of the stake is enough to stop finality, without reverting anything. More than half lets an attacker dominate the fork choice for non-final blocks: short reorganisations and censorship. Two-thirds or more would let an attacker finalise the chain of its choice. At October 2026 prices, each level means buying, then putting at risk, tens of billions of dollars of ether.
Slashing and the inactivity leak
Slashing is the stick. According to the ethereum.org page on rewards and penalties, a slashed 32 ETH validator has 0.0078125 ETH (1/4096 of its balance) burned immediately and is then forced out over 36 days. At the midpoint, day 18, a correlation penalty applies, and it grows with the stake of all validators slashed in the 36 days before: one careless operator loses little, while a coordinated attack by a third of the network can lose its entire balance.
The inactivity leak covers the other case, when too many validators go offline or refuse to vote. If the chain fails to finalise for more than four epochs, the protocol drains the stake of validators who are not voting until the active ones hold two-thirds again. An attacker who blocks finality by staying silent pays for every epoch of silence.
Has this machinery been tested? Partly. On 11 and 12 May 2023, Ethereum mainnet failed to finalise twice. The Prysm post-mortem describes the second incident as nine epochs without finality from epoch 200,750, with about 149 missed blocks, caused by clients exhausting their resources on valid but old attestations. The inactivity leak cost validators an estimated 28 ETH, and the fix shipped in Prysm v4.0.4. No slashing was attributed to the incidents and nothing was reverted. In the sources we checked, no finalised Ethereum block has ever been reverted; that is a record, not a guarantee.
Finality is not instant. Single-slot finality, which would make blocks final within one slot, is still in the research phase according to the ethereum.org roadmap page (updated 23 July 2026). Until it ships, a payment on Ethereum is “probably settled” after one block and economically final after about 15 minutes.
When history does change: reorganisations, 51% attacks and bugs
Our lesson on whether a blockchain can be hacked shows that attacks on exchanges, bridges and wallets are far more common than attacks on the chain itself. This section stays with the chain: what a reorganisation is, how deep the real ones went and what they cost the attackers.
Reorganisations are routine at the tip and rare when deep
A reorganisation, or reorg, happens when nodes switch from the chain they were following to a competing one. At the tip this is ordinary. Two miners sometimes find a block at nearly the same moment; for a few seconds the network is split, then the next block lands on one side, and the other block is orphaned. Its transactions return to the waiting smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool and are usually included again in a later block. This is why a transaction with one confirmation is not yet settled.
Deep reorgs are another matter. On 25 May 2022, Ethereum’s beacon chain went through a reorganisation of seven blocks. Barnabé Monnot’s analysis traced it to a late block proposal combined with a fork-choice change, “proposer boost”, that only part of the validators had installed, and a known client bug. The finalised chain was not touched, and the analysis notes that finality was not even delayed. Proof-of-work chains with little hash power have seen reorganisations of thousands of blocks, and those were attacks.
51% attacks on small chains: Ethereum Classic and Bitcoin Gold
A small proof-of-work chain is exposed for a simple reason: its hash power is cheap to rent. Marketplaces such as NiceHash let anyone hire mining power by the hour, and when a chain uses the same algorithm as a bigger one, the hired power can be pointed at it. The table adds two columns to the summary in the three pillars lesson: how deep each rewrite went and, where it was published, what it cost. Dollar figures are those reported at the time.
| Chain | Date | Reorganisation | Double-spent (reported) | Attack cost (reported) |
|---|---|---|---|---|
| Bitcoin Gold | May 2018 | Not published | At least $18 million (Fortune) | Not published |
| Ethereum Classic | 5 to 7 Jan 2019 | Several, more than 100 blocks deep per Bitfly | About 219,500 ETC, about $1.1 million (Coinbase) | Not published |
| Bitcoin Gold | 23 and 24 Jan 2020 | Two, up to 16 blocks | About $72,000 | About $1,200 per attack (James Lovejoy’s estimate) |
| Ethereum Classic | 31 Jul to 1 Aug 2020 | About 3,600 blocks (3,615 to 3,693 by source) | 807,260 ETC, about $5.6 million | About 17.5 BTC, about $192,000 (Bitquery) |
| Ethereum Classic | 5 and 6 Aug 2020 | 4,236 blocks | About 238,000 ETC, about $1.68 million | Not published |
| Ethereum Classic | 29 Aug 2020 | More than 7,000 blocks | Unclear | Not published |
The depth column is the striking one. Bitquery’s analysis of the first August 2020 attack shows a private chain mined from 16:36 UTC on 31 July and published at 04:53 UTC on 1 August, replacing blocks 10,904,147 to 10,907,761: about twelve hours of Ethereum Classic history swapped out at once, for roughly $192,000 of rented hash power and about $5.6 million double-spent. The second attack replaced 4,236 blocks after just over 15 hours of private mining. On 29 August, Bitfly counted more than 7,000 blocks, about two days of mining, The Block reported.
Bitcoin Gold shows the same ratio on a smaller scale. For the January 2020 attacks, The Next Web relayed developer James Lovejoy’s estimate of about $1,200 of rented power per attack, for about $72,000 double-spent. Binance, which had allowed BTG withdrawals after 12 confirmations, raised the requirement to 20. The May 2018 losses of at least $18 million come from Fortune’s report, which says the attackers targeted exchanges.
The defences follow from the whitepaper table. Exchanges raise the number of confirmations on small chains, sometimes to dozens. Ethereum Classic developers specified a rule called MESS (ECBP-1100) that makes nodes demand much more work from a competing chain the older its fork point is; the ECIP page now marks it as replaced by ECBP-1110 in January 2024. None of this changes the basic arithmetic: a chain is as hard to rewrite as its honest hash power is expensive to outbid.
Bitcoin’s two rewrites were both bugs
Bitcoin’s own history has been rewritten twice on a meaningful scale, both times by its users to fix software. In August 2010, a block that created more than 184 billion bitcoins through an integer overflow was abandoned when the corrected chain overtook it 53 blocks later, at block 74691, according to the Bitcoin Wiki; the lesson on blockchain hacks tells that story in detail. In March 2013, version 0.8 accepted a block that older versions rejected and the network split. BIP 50, the post-mortem, says the new-rules chain had around 60% of the hash power, and that Marek Palatinus (Slush) and Michael Marsee (BTCGuild) downgraded their nodes so the old chain would win, sacrificing significant amounts of money. At least one large double spend took place during the split.
Social forks: when people decide which chain is real
The clearest case of that third protection is The DAO. Launched in 2016 as an investment fund run by a smart contract on Ethereum, it had raised more than $150 million from over 11,000 members, according to CoinDesk. In mid-June 2016, an attacker used a flaw in its code to move more than 3.6 million ether into a “child DAO” it controlled. Ethereum itself worked as designed; the contract had a bug.
On 17 June 2016, Vitalik Buterin proposed a soft fork that would block withdrawals from The DAO and its children. The final answer, five weeks later, was a hard fork. At block 1,920,000, on 20 July 2016, an “irregular state change” moved about 12 million ETH from two DAO-related contracts into a recovery contract from which original investors could withdraw, the Ethereum Foundation wrote. The 12 million and the 3.6 million measure different things: the first is what the fork moved out of a set of contracts, the second what the attacker drained. About 85% of miners followed the fork.
The rest kept running the unmodified chain, which became Ethereum Classic, whose community still sums up its position as “Code is Law”. Both chains share the same history up to block 1,920,000 and separate after it; each is the valid chain under its own rules. On 25 July 2017, the US Securities and Exchange Commission published a report of investigation concluding that DAO tokens were securities, while deciding not to bring charges in that case.
The code did not decide what happened to The DAO’s ether; the people running nodes and mining did. On a large network, rewriting history by agreement is extremely rare, takes weeks of open debate and splits the community. No single actor can do it quietly.
What immutability means for your money and your data
For a user, immutability has a blunt consequence: payments do not come back. There is no chargeback, no bank to call and no customer service on a public chain. In its “Pause Before You Pay” advisory of August 2026, the CFTC warned that a transfer made through a crypto ATM “is often immediate and irreversible”, and cited FBI IC3 data showing more than $388 million in reported losses to crypto ATM scams in 2025, 58% more than the year before. In the UK, the FCA reminds consumers that “there is no safety net if things go wrong” and that FSCS protection is highly unlikely to apply.
Large thefts are not undone either. After about $1.5 billion in virtual assets was stolen from Bybit in February 2025, the FBI’s public notice described funds converted and dispersed across thousands of addresses on several blockchains: a laundering trail, not a rollback. What victims can actually do afterwards, from tracing to freezes and complaints, is the subject of our lesson on recovering stolen crypto. Before sending, check the address, the network and the amount, and wait for enough confirmations on what you receive, more for larger sums and smaller chains. How crypto transactions work shows each step of a transfer.
For data, immutability collides with European privacy law. The GDPR gives people a right to have personal data corrected or erased, and a public chain is built to keep everything. In its Guidelines 02/2025 on blockchain, version 2.0 adopted on 7 July 2026, the European Data Protection Board notes that personal data written on a chain will in most cases stay there with no practical possibility of deletion, and that “technical impossibility cannot be invoked to justify non-compliance with GDPR requirements”. It finds it not advisable to record personal data on a blockchain in clear text, encrypted or hashed form, and says such data should be stored off-chain.
Note the word “hashed”: by the Board’s reading, putting the fingerprint of someone’s personal data on chain is not enough to escape the problem. The design it points to keeps the personal data off-chain and, where possible, makes sure nothing left on chain still identifies anyone once that off-chain data is erased; when strong integrity is not needed, it recommends other tools altogether. The same property that frustrates erasure is what makes a chain useful as an audit trail for records that are not personal: anyone can check that they existed at a given block and have not been altered since.
On Bitcoin, the difficulty is due to adjust again around 29 October 2026, with mempool.space estimating on 25 October a rise of about 5%. Each rise makes the arithmetic of a rewrite a little harder, and it is published for anyone to check.
