Has Monero ever been 51% attacked?
Monero has faced publicly reported and claimed 51% attacks, most notably during Qubic’s 2025 mining campaign. But you should distinguish a claim of majority mining power from a verified attack—and neither automatically means someone stole funds or broke Monero’s privacy.
What happened in Monero’s case?
Two episodes matter when you look at this question:
- MineXMR in 2022: This mining pool—a group of miners combining their computing power—approached or, according to some estimates, briefly exceeded half the network’s mining power. That raised serious concerns about concentration. It was not, by itself, evidence that the pool attacked Monero. MineXMR later closed.
- Qubic in 2025: Qubic publicly pursued and claimed majority control of Monero’s mining power. Reports around that campaign also described chain reorganizations, where one version of recent transaction history replaces another. Unlike the MineXMR episode, this involved an openly discussed attempt to demonstrate control.
The important qualification is that claims, estimated mining shares, and independently verified attack outcomes are different kinds of evidence. I cannot independently verify the full outcome of the Qubic campaign or establish a complete incident record through 2026 here. So a blanket “Monero has never been 51% attacked” is too confident, but so is claiming a proven theft without supporting evidence.
What would count as a successful attack?
A 51% attack happens when an attacker uses a majority of the computing power securing a proof-of-work network to manipulate which blocks get accepted. Blocks are batches of transactions.
An attacker could try to:
- Replace recent blocks with an alternative history.
- Delay or exclude other people’s transactions.
- Reverse their own recent payment and spend those coins again, called a double spend.
However, owning most mining power is a capability, not proof that every one of these actions occurred.
Likewise, a chain reorganization is not automatically proof of an attack. Small reorganizations can happen naturally when miners find competing blocks. Evidence of deliberate manipulation requires more context, such as the reorganization’s depth, timing, and connection to the suspected attacker.
What does this mean for your XMR?
Even a successful majority attack would not let someone spend coins directly from your wallet without your keys. It would not automatically reveal Monero’s hidden transaction details or allow the attacker to create coins outside the rules.
The main danger is unreliable payment settlement: a payment you thought was complete might disappear from the accepted history.
Monero normally requires 10 confirmations before received funds become spendable. A confirmation means another block has been added to the transaction’s history. During a suspected sustained majority attack, that normal waiting period is not a guarantee of safety. Exchanges may require more confirmations or suspend deposits.
The bottom line
Monero has had serious majority-mining incidents, including Qubic’s claimed 2025 attack. The accurate answer is not a simple “never”: you need to separate demonstrated mining dominance, verified manipulation of blocks, and confirmed double-spend losses. Those are three different claims, and evidence for one does not establish the others.
