What is the 51 percent attack on Monero?
A 51 percent attack on Monero happens when one person or coordinated group controls most of the computing power used to mine its blocks. That can let them rewrite recent payment history, spend their own coins twice, or delay other people’s payments. It does not let them steal coins from your wallet, create unlimited XMR, or automatically reveal private transactions.
What “51 percent” actually means
Monero uses proof of work: miners use computers to compete to add blocks, which are batches of transactions. Their combined computing speed is called the hashrate.
The important share is mining power—not the number of miners, wallets, or coins someone owns. A group with relatively few machines could still dominate if those machines supply most of the network’s hashrate.
“51 percent” is shorthand for a majority. It is not a magic switch: an attacker with less power can sometimes replace a few recent blocks by chance. But a sustained majority lets them reliably outpace honest miners over time.
Monero’s rules favor the valid chain with the most accumulated proof of work. That gives a majority attacker their opening.
How an attacker could spend twice
Imagine an attacker sends XMR to an exchange and receives another asset in return.
Meanwhile, they secretly mine a competing version of Monero’s recent history. In that version, their payment to the exchange is missing, and they instead spend those same coins back to themselves.
If their hidden chain accumulates more work and they publish it, the network can switch to it. This replacement of recent blocks is called a chain reorganization, or “reorg.” The exchange’s original payment disappears from the accepted history, even though it may already have released the other asset.
That is a double spend. The attacker has not copied coins inside one valid history. They have replaced one payment history with another.
They could also use majority power to exclude selected transactions and replace blocks from honest miners who include them.
What the attack cannot do
Even majority mining power does not override every Monero rule. Independent computers called nodes check that blocks and transactions follow those rules.
A majority attacker cannot simply:
- Spend your XMR without your wallet’s secret spending key.
- Make a valid block award them arbitrary extra coins.
- Change Monero’s supply rules on their own.
- Automatically uncover the sender, receiver, or amount of every transaction.
The main threat is to payment reliability and ordering, not direct access to your wallet. Your balance does not become freely available to an attacker.
What this means for you
Monero targets roughly one block every two minutes. Each additional block after a payment adds a confirmation, making an ordinary short reorganization less likely to undo it.
Normal received funds need 10 confirmations before they become spendable. But that is not a guarantee against a sustained majority attack. For a large payment, check the recipient service’s confirmation policy and any credible reports of network trouble.
If you mine, avoid concentrating power in an already dominant pool—a service that combines miners’ work and shares rewards. More independent mining helps reduce dependence on any single operator. A large pool is not automatically malicious, but concentrated control creates risk.
The bottom line
A 51 percent attack threatens whether a recent Monero payment stays settled. It does not give an attacker your wallet keys or unlimited XMR. Confirmations help, but keeping mining power spread across independent participants is an important defense.
