What is the 51% attack risk from large mining pools?

A large mining pool becomes a 51% attack risk when one operator can control most of Monero’s mining power. That could let the operator interfere with payments or reverse their own recent payments, but it would not let them steal coins from your wallet or create unlimited XMR. Your pool choice matters because many independent miners can accidentally hand too much control to one operator.

Why pool size matters

A mining pool combines your mining work with work from other miners and shares the rewards. Its size is usually measured by hashrate, meaning how much mining computation it contributes each second.

In a traditional pool, the operator generally chooses the transactions and block-building work sent to miners. A block is a batch of transactions added to Monero’s shared payment record, called the blockchain.

That means thousands of people can own the computers while one operator directs their combined work. An attacker who compromises that operator’s systems could potentially abuse the same control.

The relevant share is the pool’s percentage of the whole Monero network—not its number of users or how much XMR it pays you.

What an attacker could and could not do

With a sustained majority of mining power, an attacker could build a competing transaction history faster than the rest of the network over time.

They could try to:

• Double-spend their own coins: pay someone, then replace recent blocks with a history that removes that payment.
• Censor transactions: keep selected payments out of the history they build.
• Disrupt other miners: replace honest blocks, causing those miners to lose expected rewards.

They could not simply spend your coins without your wallet’s secret keys. They also could not force ordinary Monero software to accept invalid transactions or rewards above the allowed amount.

For you, the main payment risk is accepting coins that later disappear from the accepted history. Monero normally requires 10 confirmations before received funds become spendable, but that waiting period is not a guarantee against a sustained majority attack.

Why 51% is not a magic switch

A pool approaching half the network deserves attention before it actually crosses that line. Smaller attackers can sometimes replace a short stretch of recent blocks through luck, although their chances fall as a payment gains more confirmations.

Likewise, briefly showing 51% on a chart does not prove an attack happened or guarantee that one would succeed immediately. Duration, coordination, and the payment’s age matter.

Pool shares are also estimates. Short observation periods can make a lucky pool look larger than it really is. Check a live Monero explorer or pool-statistics source, preferably more than one, rather than relying on an old screenshot.

How your pool choice helps

You can reduce concentration without abandoning pooled mining:

• Choose a reliable smaller pool instead of automatically joining the largest.
• Watch its network share over time, especially if it grows quickly.
• Consider P2Pool, a decentralized pooling system that avoids one central operator directing everyone’s mining work.
• If you mine through a browser service, check which pool receives your work and whether you can change it. The website’s brand may hide a much larger underlying pool.

A big pool is not automatically malicious. Still, good intentions are weaker protection than avoiding concentrated control.

The bottom line

The danger is not pooled mining itself—it is too much mining power under one decision-maker. By choosing a smaller independent pool or P2Pool, you help protect the payments and mining rewards you depend on.