The Double Spend Vector: Shadow Mining and Reorgs

The most well-known threat of a 51% attack is the Double Spend. This is the process where an attacker spends the same coins twice: once to a victim (usually an exchange or merchant) and once back to themselves on a hidden branch of the blockchain.

---

️ 1. Phase 1: The Setup

The attacker prepares by splitting their hashrate. 1. Public Action: They broadcast a transaction spending 1,000 BTC to an exchange. 2. Private Action: Simultaneously, they start mining a Secret Shadow Chain. In this secret chain, the 1,000 BTC is sent to a different address owned by the attacker.

---

⏳ 2. Phase 2: The Bait

The attacker allows the honest network to mine blocks on top of the public transaction. * Block 1-3: The exchange sees 3 confirmations. * The Swap: Believing the payment is finalized, the exchange credits the attacker's account with $60,000,000. * The Exit: The attacker immediately converts the credit to an untraceable asset (like Monero or physical gold) and withdraws it.

---

️ 3. Phase 3: The Reorg Strike

Because the attacker has $>50\%$ hashrate, their Secret Shadow Chain has been growing faster than the public chain.

Time	Public Chain (Honest)	Shadow Chain (Attacker)
T=0	Block 840,000	Block 840,000
T=60m	Block 840,006	Block 840,007 (Heavier)

Once the attacker has withdrawn their funds from the exchange, they broadcast their Shadow Chain to the global network.

---

4. The Result: Transaction Reversal

When honest nodes receive the Shadow Chain: 1. Work Check: They see it has more cumulative work than the current active chain. 2. Reorg: They instantly switch to the Shadow Chain. 3. Conflict: The transaction to the exchange (from the public chain) is now Disconnected. 4. The Double Spend: The coins are now "spent" in the Shadow Chain back to the attacker. The exchange's UTXO has vanished from the ledger.

---

️ 5. Mitigation: Depth and Confirmation

The only defense against a 51% double-spend is Time. * If the exchange had waited for 60 confirmations (~10 hours) instead of 3, the attacker would have had to maintain their shadow chain for 10 hours without any block rewards or fees. * The electricity cost of such an extended attack would be astronomically high, likely exceeding the value of the double-spend itself.