Blockchain security: attacks and weaknesses

Strong maths, weak edges

It is tempting to think a blockchain is "unhackable". The hashing and signature algorithms used by major chains are well studied and, with today's computers, not practical to break directly. Yet large losses still happen. The reason is that a blockchain system is much more than its cryptography: it includes networking, consensus incentives, application code, third-party services and people. This note walks through each layer and how it is defended.

Network and consensus attacks

• Sybil attack: one attacker runs many fake nodes to gain influence. PoW and PoS resist this because influence depends on work or stake, not node count.
• Eclipse attack: the attacker surrounds a victim node with their own peers, so the victim only sees what the attacker shows. Defences include many diverse outbound connections and careful peer selection.
• 51% (majority) attack: an attacker with most of the mining power or stake can reorder or replace recent blocks. They cannot steal other people's coins or forge signatures, but they can reverse their own payments (a double spend) and censor transactions.
• Selfish mining: a miner withholds found blocks to gain an unfair share of rewards.

Majority attacks are most realistic on smaller chains where renting enough computing power or buying enough stake is affordable. That is why exchanges usually require more confirmations for smaller networks. See consensus for how finality works.

Application-layer attacks

Bridges deserve special attention. They lock assets on one chain and issue matching tokens on another, so they hold large pools of value behind a handful of keys or a complex verification contract. Several of the largest publicly reported blockchain thefts involved bridges.

The human layer

Most individual losses come from the oldest tricks: phishing sites that copy a wallet or exchange, fake support staff who ask for a recovery phrase, malicious browser extensions, malware that swaps a copied wallet address, and investment scams. Once a transaction is confirmed it usually cannot be reversed, so prevention matters far more than recovery. See wallets and keys for protecting private keys and phishing basics for spotting lures.

Tip: no legitimate support team, exchange or wallet provider will ever ask for your recovery phrase. Anyone who asks is attempting theft.

Detecting and responding

1. Monitor contracts and wallets you are responsible for, with alerts on unusual transfers or admin calls.
2. Use pause functions and withdrawal limits so an attack can be slowed while you investigate.
3. Keep an incident response plan that covers key rotation, public communication and contact with law enforcement.
4. Because blockchains are public, analysts can often trace where stolen funds move, which supports investigations.

In exams, separate attacks on the protocol (51%, eclipse, Sybil) from attacks on applications and users (contract bugs, bridges, phishing), and remember that a majority attacker can reverse their own transactions but cannot forge other users' signatures. Any hands-on study should use local test chains or public test networks, never live systems you do not own.