Double Spending

Double spending is the act of spending the same unit of digital money more than once. In a cryptocurrency, it usually means getting a merchant or exchange to accept one payment and then making sure that a second, conflicting transaction sending the same coins elsewhere is the one the network keeps. If the attack succeeds, the first recipient is left with nothing. Preventing it is the central purpose of a blockchain's consensus rules.

This entry covers the attack in practice: how double spends are attempted, how likely they are to succeed and how recipients protect themselves. The underlying design question, why digital money needs a mechanism to stop copying at all and how Bitcoin (BTC) answered it, is covered in the entry on the double-spend problem. In bank and card systems, the nearest equivalent is a payer reversing a payment after receiving goods, handled through chargebacks and fraud rules rather than consensus.

Imagine writing two cheques against the same £100 balance to two shops on the same afternoon. Whichever cheque reaches the bank first is paid, and the other bounces. A double spend in crypto is a race of the same kind: two payments claim the same coins, and only one can end up in the shared record.

The cheat's aim is to make the shop believe it has been paid, collect the goods, and then make sure the other payment, usually one back to the cheat's own wallet, is the one that wins. Waiting before handing over the goods is the shop's main defence.

• Race attack. The attacker broadcasts two conflicting transactions at almost the same time, one to the merchant and one to itself, hoping the merchant sees the first while miners include the second. It works mainly against a zero confirmation transaction.
• Replace-by-fee attack. The attacker sends a payment, then broadcasts a replacement paying a higher fee to an address it controls. Because miners prefer higher fees, the replacement often wins while the original is still in the mempool.
• Finney attack. Named after Hal Finney, it needs a miner who secretly mines a block containing a payment to itself, spends the same coins with a merchant who accepts unconfirmed payments, and then releases the block.
• Majority or 51% attack. An attacker with more than half the network's hashrate pays a merchant, waits for confirmations, then publishes a longer private chain that excludes the payment, reversing even confirmed transactions.

Section 11 of the Bitcoin white paper treats an attacker building a rival chain as a gambler trying to recover a deficit. If the honest network has share $p$ of the hashrate and the attacker has share $q$, with $q \lt p$, the probability that the attacker ever catches up from $z$ blocks behind is:

• $P_z$ is the probability that the attacker eventually overtakes the honest chain.
• $q$ is the attacker's share of total hashrate, and $p = 1 - q$ is the honest share.
• $z$ is the number of blocks by which the attacker trails, roughly the merchant's transaction confirmations.

Worked example: an attacker with 10% of hashrate ($q = 0.1$, $p = 0.9$) facing six confirmations has $P_6 = (0.1 / 0.9)^{6} = (1/9)^{6}$, about 0.0000019, or roughly 1 in 530,000. With 30% of hashrate the figure rises to $(0.3/0.7)^{6}$, about 0.0062, or 1 in 160. If $q \ge p$, the attacker eventually succeeds with certainty, which is why majority hashrate breaks the model. The white paper's full calculation refines this with a Poisson estimate of the attacker's progress while the merchant waits, but the conclusion is the same: each extra confirmation cuts the risk sharply, which is the basis of probabilistic finality.

Successful double spends against large networks are rare, because buying or renting majority hashrate on Bitcoin would cost far more than most attacks could gain. Smaller proof-of-work coins have been hit repeatedly. In May 2018 attackers reorganised the Bitcoin Gold (BTG) chain and double spent deposits at exchanges, and in January 2019 Coinbase reported double spends worth about $1.1 million on Ethereum Classic (ETC), which suffered further reorganisations in August 2020. In each case the victims were cryptocurrency exchanges that credited deposits after too few confirmations, letting attackers sell or withdraw before the reversal.

Exchanges and merchants set confirmation thresholds in proportion to the amount and the network's security: a few blocks for Bitcoin, many more for chains with low hashrate. They monitor for conflicting transactions, watch for deep chain reorganisations and may pause deposits for a coin whose hashrate suddenly drops. Chains secured by proof of stake (PoS) add checkpoints with economic finality, after which reversing a block would require destroying a large amount of staked value. Off-chain systems such as the Lightning Network handle fast payments through penalty mechanisms instead. In all cases, once a payment is final on chain it is an immutable transaction, and the irrevocability that protects merchants also means honest mistakes cannot be reversed.

• Bitcoin: A Peer-to-Peer Electronic Cash System (white paper)