[hellbanner]

Well, it depends on how much more computing power a hypothetical nation-state has at its reserve compared to the rest of the world. I wish I could find the paper analyzing the possibilities of attacking with less than 51% power, 33% IIRC but in lieu of that, check this out:

http://bitcoin.stackexchange.com/questions/1037/what-can-xxx...

And Quantitative Analysis of the Full Bitcoin Transaction Graph https://eprint.iacr.org/2012/584.pdf which analyzes how lots of Bitcoin accounts are seemingly controlled by the same group (so they are closer to a 51% attack than would otherwise appear).

And there is always the possibility of 0days eg the Replay Attack in Ethereum https://medium.com/@timonrapp/how-to-deal-with-the-ethereum-...

[voxic11]

Wouldn't bitcoin respond to such an attack by just finally implementating a proof of stake protocol on top of their proof of work one?

[hellbanner]

I'm not sure, but any implementation needs to be accepted by the vast majority of miners for it to work.