Selfish Mining

Selfish mining is an attack on proof-of-work blockchains in which a miner, or a mining pool, finds a block but does not broadcast it straight away. Instead it keeps mining on its private chain and releases blocks at chosen moments to overtake the public chain. Honest miners who were working on the old public tip see their blocks discarded, so the selfish miner's share of accepted blocks, and therefore of rewards, can exceed its share of total computing power.

The idea was set out in a 2013 paper by Ittay Eyal and Emin Gün Sirer of Cornell University, titled "Majority Is Not Enough". It challenged a common belief that Bitcoin was safe as long as no one controlled a majority of the hashrate, the condition behind a 51% attack. Selfish mining does not let an attacker spend coins twice, but it rewards concentration and weakens the incentive argument that underpins Bitcoin's security.

Imagine a group of people racing to solve puzzles in a shared book, with a prize for each page completed. One team solves a page but hides the answer and starts quietly on the next page. Everyone else keeps working on the page the team has already solved. When others finally catch up, the team reveals its answers all at once, and the rest of the room's work on those pages is thrown out.

The hidden team does not solve puzzles faster. It simply makes everyone else waste effort, so its share of the prizes grows. The larger the team, the better the trick tends to work.

In simplified form, a selfish miner follows these rules:

1. Withhold. On finding a block, keep it private and mine on top of it.
2. Race. If honest miners find a block and the selfish miner has exactly one hidden block, publish it at once, creating a tie between two chains.
3. Override. If the selfish miner is two or more blocks ahead when honest miners find one, publish enough of the private chain to replace the public one.
4. Give up. If honest miners pull ahead, abandon the private chain and resume on the public tip.

Each time the selfish miner's chain wins, honest blocks become orphaned blocks, their work wasted. Success in ties depends on how fast the selfish miner's blocks spread across the network compared with rivals' blocks.

Eyal and Sirer showed that the strategy pays when the attacker's share of hashrate exceeds a threshold that depends on how often it wins ties:

• $\alpha$ is the selfish miner's share of the network's total hashrate.
• $\gamma$ is the share of honest miners who build on the selfish miner's block during a tie, a measure of its network advantage.

If the attacker never wins ties, $\gamma = 0$, and the threshold is 1 ÷ 3, so a pool needs more than a third of the hashrate. If it wins half of ties, $\gamma = 0.5$, the threshold is (1 − 0.5) ÷ (3 − 1) = 0.5 ÷ 2 = 0.25, or a quarter. With a perfect network advantage the threshold falls towards zero. The model is simplified, and later studies refined it with factors such as difficulty adjustments, which mean gains may appear only after the next retarget.

There is no confirmed case of sustained selfish mining by a major Bitcoin pool, and analysts have looked for telltale patterns such as unusual runs of blocks from one pool or spikes in stale blocks. Some smaller proof-of-work coins have shown behaviour consistent with block withholding, but proving intent is difficult. A pool large enough to profit would also risk damaging confidence in the coin it is paid in, which may deter attempts. The idea remains important in the study of blockchain game theory and in debates about mining centralisation.

Researchers have proposed several countermeasures:

• Random tie-breaking. Nodes choose randomly between competing chains of equal length instead of favouring the first one seen, which lowers $\gamma$ and raises the threshold.
• Faster propagation. Better relay networks reduce the advantage of well-connected attackers.
• Timestamps and fork-choice changes. Rules that penalise late-published blocks have been suggested, though each brings its own trade-offs and would need broad agreement.
• Decentralisation. Keeping hashrate spread across many independent pools makes the threshold harder to reach.

Proof-of-stake chains face related but different risks, such as withholding attestations or proposals, which designers address through their fork choice rules.