<p>The simplest form of it called Finney attack, named for Hal Finney who first <a href="https://bitcointalk.org/index.php?topic=3441.msg48384#msg48384" rel="noreferrer">described</a> it. The attack is variation of a double-spend attack involving accepting 0-confirmation transactions.</p>

<p>An attacker would generate a valid block but will not broadcast it, and then broadcast transaction A as a payment for a good or service. A merchant will see transaction A with nothing conflicting with it and accept the 0-confirmation transaction. Right after that the attacker would broadcast the generated block with transaction B which will conflict with transaction A, the Bitcoin network will accept his block and invalidate transaction A.</p>

<p>The attack is quite costly because there is a time gap between generation of the block by the attacker and completing transaction A, during which someone else on the network could generate a valid block and broadcast it, thus invalidating the valid block generated by attacker. Therefore it is practical only if the merchant sells the product online and it could be release immediately, e.g. a key for a software product.</p>

<p>A general form of this attack was described by Satoshi Nakamoto: <a href="http://bitcoin.org/bitcoin.pdf" rel="noreferrer">White Paper, section 11</a>. In theory, an attacker could pre-generate any number of blocks, e.g. if a merchant requires 1 confirmation before releasing a product an attacker would pre-generate 2 blocks ahead of the network and only then broadcast transaction A to double spend. But with each block the cost increases exponentially, and the practice of accepting 6 confirmations before releasing the purchase makes this attack possible only in case where the attacker has close to 50% of network hash rate or more.</p>

CC BY-SA 3.0
2012-10-03T15:56:34.543Z
“who first described it”… And what is section 11 of the white paper all about?
Stéphane Gimenez
CC BY-SA 3.0
2012-10-03T16:06:35.797Z
@Stéphane Gimenez, white paper described the general form of this attack, and Hal Finney described the specific case for 0-confirmation transaction, but I should probably include the link to the white paper
Serith
CC BY-SA 4.0
2012-10-03T15:31:35.370Z
2018-05-24T17:01:25.490Z
2018-05-24T17:01:25.490Z
Serith
<p>There are two types of block withholding attacks.  One, known as the Finney Attack, aims for financial gain when a double spend occurs.  The second is to cause financial harm to a pool operator.  A miner that solves a block can withhold a valid hash after finding one.  The cost to the miner is trivial (from not being awarded the share) but the cost to the pool is large as the pool loses a chance to earn the 50 BTC block award subsidy.</p>

CC BY-SA 3.0
2013-06-12T01:03:02.633Z
If you're doing that attack why would you even have to do the hashing to begin with. Can't you just tell the pool you're doing work and hope you're assigned the correct value
David
CC BY-SA 3.0
2017-08-14T19:35:08.240Z
Remember when 50btc was the reward...DAYUMMM
bkunzi01
CC BY-SA 3.0
2012-10-03T20:21:09.117Z
Unless the pool is PPS, the cost to the attacker is not trivial as he is one of the participants who would be given some of the block reward. Also there is a for-profit block withholding attack against mining pools, lie-in-wait.
Meni Rosenfeld
CC BY-SA 3.0
2012-10-03T18:18:45.070Z
2012-10-03T18:18:45.070Z
Stephen Gornick
<p>How can a block withholding attack be performed, what would be its purpose and who is it a danger to?</p>

<p>Edit: when I posted this I was thinking about withholding a block you mined in a pool. But withholding blocks can form the basis for many different attacks. I think this is still useful as a broad question. It is a central concept in bitcoin security.</p>

CC BY-SA 3.0
2012-10-03T20:04:56.567Z
Related: http://bitcoin.stackexchange.com/q/1338/516 (duplicate?)
Highly Irregular
<security><mining-pools><attack><block-withholding>
What is a block withholding attack?
Dr.Haribo
# What is a block withholding attack?

(Asked by: username_0 on 2012-10-03)

How can a block withholding attack be performed, what would be its purpose and who is it a danger to?

Edit: when I posted this I was thinking about withholding a block you mined in a pool. But withholding blocks can form the basis for many different attacks. I think this is still useful as a broad question. It is a central concept in bitcoin security.

**Tags:** security, mining-pools, attack, block-withholding

> **Comments:**
> **username_1**: Related: http://bitcoin.stackexchange.com/q/1338/516 (duplicate?)  

---

## 2 answers

### Answer by username_4 on 2012-10-03. Score: 6 | Accepted answer

There are two types of block withholding attacks. One, known as the Finney Attack, aims for financial gain when a double spend occurs. The second is to cause financial harm to a pool operator. A miner that solves a block can withhold a valid hash after finding one. The cost to the miner is trivial (from not being awarded the share) but the cost to the pool is large as the pool loses a chance to earn the 50 BTC block award subsidy.

> **Comments:**
> **username_7**: Unless the pool is PPS, the cost to the attacker is not trivial as he is one of the participants who would be given some of the block reward. Also there is a for-profit block withholding attack against mining pools, lie-in-wait.  
> **username_5**: If you're doing that attack why would you even have to do the hashing to begin with. Can't you just tell the pool you're doing work and hope you're assigned the correct value  
> **username_6**: Remember when 50btc was the reward...DAYUMMM  

---

### Answer by username_2 on 2012-10-03. Score: 17

The simplest form of it called Finney attack, named for Hal Finney who first [described](https://bitcointalk.org/index.php?topic=3441.msg48384#msg48384) it. The attack is variation of a double-spend attack involving accepting 0-confirmation transactions.

An attacker would generate a valid block but will not broadcast it, and then broadcast transaction A as a payment for a good or service. A merchant will see transaction A with nothing conflicting with it and accept the 0-confirmation transaction. Right after that the attacker would broadcast the generated block with transaction B which will conflict with transaction A, the Bitcoin network will accept his block and invalidate transaction A.

The attack is quite costly because there is a time gap between generation of the block by the attacker and completing transaction A, during which someone else on the network could generate a valid block and broadcast it, thus invalidating the valid block generated by attacker. Therefore it is practical only if the merchant sells the product online and it could be release immediately, e.g. a key for a software product.

A general form of this attack was described by Satoshi Nakamoto: [White Paper, section 11](http://bitcoin.org/bitcoin.pdf). In theory, an attacker could pre-generate any number of blocks, e.g. if a merchant requires 1 confirmation before releasing a product an attacker would pre-generate 2 blocks ahead of the network and only then broadcast transaction A to double spend. But with each block the cost increases exponentially, and the practice of accepting 6 confirmations before releasing the purchase makes this attack possible only in case where the attacker has close to 50% of network hash rate or more.

> **Comments:**
> **username_3**: “who first described it”… And what is section 11 of the white paper all about?  
> **username_2**: @username_3, white paper described the general form of this attack, and Hal Finney described the specific case for 0-confirmation transaction, but I should probably include the link to the white paper  

---

