Trail notes
- A blockchain stays secure when many independent participants agree on one history and rewriting it is too costly.
- Proof of work ties security to computing power and energy; proof of stake ties it to staked funds that can be penalized.
- Finality is the point after which a transaction is practically, or formally, irreversible.
- A majority attack needs control of most of the network’s mining power or stake, which is far harder on large networks than small ones.
- When you hear “crypto was hacked”, it is usually an app, bridge, platform or someone’s keys, not the base blockchain.
What “secure” means for a blockchain
A blockchain is a shared ledger copied across thousands of computers (nodes). There is no central administrator deciding which transactions are valid. Instead, the network follows a consensus mechanism: a set of rules for agreeing on the next block and the order of transactions.
Security in this sense means three things:
- Validity: only properly signed transactions that follow the rules get in. Every node checks this independently, so nobody can spend coins they do not control without the private key.
- Agreement: honest nodes converge on the same history.
- Immutability: once enough work or stake has built on top of a block, changing it would be impractical or penalized.
Notice what is not on that list. The blockchain does not protect you from signing a bad transaction, from a buggy app or from someone stealing your keys. It faithfully records whatever validly signed instructions it receives.
Proof of work
Bitcoin uses proof of work. Miners compete to find a value that makes a block’s data meet a difficult target, which can only be found by trial and error with a lot of computing power. The winner adds the block and earns a reward. Other nodes can check the answer instantly.
Each new block references the one before it. To rewrite an old transaction, an attacker would have to redo the work for that block and every block after it, and do it faster than the rest of the network keeps adding new ones. On a large network, that means outspending a vast amount of hardware and electricity.
The trade-off is energy use and the slow, probabilistic nature of confirmation: the more blocks built on top of your transaction, the more confident you can be that it will stay.
Proof of stake
Ethereum uses proof of stake. Instead of burning energy, participants called validators lock up Ether as collateral. According to ethereum.org, running your own validator requires 32 ETH; others join pooled or centralized staking services. The protocol randomly selects validators to propose blocks and others to vote (attest) on them.
Honest validators earn rewards. Validators that go offline lose a little, and validators that break the rules, such as signing two conflicting blocks, can be slashed, meaning part of their stake is destroyed and they are removed. Security comes from the fact that attacking the chain puts the attacker’s own large stake at risk.
| Proof of work | Proof of stake | |
|---|---|---|
| Who adds blocks | Miners with computing hardware | Validators with staked funds |
| Cost of attacking | Hardware and energy to outpace the network | Acquiring a large share of stake, which can be slashed |
| Confirmation style | Probabilistic: confidence grows with each block | Checkpoints can be formally finalized |
| Main criticism | Energy use | Stake can concentrate in large staking services |
The staking guide covers staking options and their risks in more depth.
Finality: when is a transaction really done?
Finality is the point after which a transaction will not be reversed. Different chains reach it differently.
On proof-of-work chains, finality is probabilistic. A transaction in the newest block could in theory be replaced if a competing chain overtakes it. Each additional block makes that much less likely, which is why exchanges wait for several confirmations before crediting deposits.
On Ethereum’s proof-of-stake design, the protocol periodically finalizes checkpoints once validators holding a large majority of stake vote for them. Reversing a finalized block would require a huge amount of stake to be slashed, so it is treated as settled.
When a platform or bridge says your deposit is “pending confirmations”, it is waiting for finality. Moving funds between networks adds the finality rules of both chains, plus the bridge’s own security. See bridges explained.
Majority attacks (51% attacks)
A majority attack happens when one party controls more than half of a network’s mining power or, on some proof-of-stake designs, a large enough share of stake to control block production. They could then reorder or exclude recent transactions, or spend the same coins twice by reversing a payment after receiving goods.
What a majority attacker generally cannot do is sign transactions from your address without your private key. The attack is about rewriting recent history and censoring, not forging signatures.
These attacks are far easier on small networks with little mining power or stake, which is one reason to be cautious about lesser-known chains. On large networks they would be extremely expensive, and on proof of stake the attacker risks losing the very stake they used.
“The blockchain wasn’t hacked, the app was”
Headlines often say a blockchain or “crypto” was hacked. Look closer and the failure is almost always in a layer built on top:
- Smart contracts with bugs that let attackers withdraw funds. See smart contract risk.
- Bridges that hold large pools of assets to move them between chains. See bridge risk.
- Oracles fed manipulated price data. See oracle manipulation.
- Website front ends hijacked to show malicious transactions.
- Centralized platforms that lose client funds through hacks, mismanagement or fraud. See platform failure.
- Individual keys stolen through phishing, malware or exposed recovery phrases.
This distinction is not a technicality. It tells you where to put your attention. Before you use something, ask which layer you are trusting: the base chain’s consensus, a specific contract’s code, a bridge’s operators, a price feed, a company’s custody practices or your own key handling. Each has different warning signs and different ways to check.
Each layer adds its own risk to the base chain’s security. A transfer on a large, well-established blockchain can be very secure while the app you use to make it is the weakest link. The risk map infographic shows how the layers stack up.
Your checklist
Questions people ask
Can a blockchain like Bitcoin be hacked?
The Bitcoin network itself has proven very hard to attack because rewriting its history would require outpacing the rest of the network’s mining power. Most losses happen through stolen keys, scams or failures of platforms and apps built around it.
What is the difference between proof of work and proof of stake?
Proof of work secures a chain with computing power and energy spent by miners. Proof of stake secures it with funds that validators lock up and can lose through slashing if they break the rules.
What is a 51% attack?
A 51% attack is when one party controls most of a network’s mining power or stake, letting them reorder or block recent transactions and attempt double spends. It does not let them sign transactions from your address without your keys.
What does finality mean in crypto?
Finality is the point after which a transaction will not be reversed. On proof-of-work chains it grows more certain with each new block; on Ethereum’s proof of stake, checkpoints are formally finalized by validator votes.
Sources and dates
- How does Bitcoin work? — bitcoin.orgreference
No date shown on page · checked 2026-10-31. Plain-language explanation of Bitcoin. - Ethereum staking — ethereum.orgreference
No date shown on page · checked 2026-10-31. Solo, pooled and centralized staking options and their trade-offs. - Introduction to smart contracts — ethereum.orgreference
No date shown on page · checked 2026-10-31. What a smart contract is and how it executes. - Blockchain bridges — ethereum.orgreference
No date shown on page · checked 2026-10-31. How bridges move assets between networks, and bridge risks. - Oracles — ethereum.orgreference
No date shown on page · checked 2026-10-31. How off-chain data reaches smart contracts, and oracle risks. - Ethereum security and scam prevention — ethereum.orgreference
No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.