[samkon]

Except that blocks are not “finalized”, like you’re imagining. With 51% of mining power, I can mine faster than the rest of the network, for an arbitrary number of blocks. The 51% attacker will have the longest chain for as long as they keep mining their chain because they’re chain will always (eventually) be the longest one.

[tboyd47]

51% < 100%

The other 49% are still incorporating the 51%'s blocks in their work. There is no way 51% of miners can stay ahead of the combined hashpower of the entire Bitcoin mining population.

[cesarb]

> The other 49% are still incorporating the 51%'s blocks in their work.

It's not that simple. That block from the 49% will be ignored by the 51% (since it contains "banned" transactions), which will continue the chain on the previous block (the "51% chain". Now the 49% has two options. If they continue to build the chain on top of that 49% block (the "49% chain"), after a while the 51% chain will be longer (because that side has the most hash power). The other option is to build again on top of the 51% chain, as you suggested (and AFAIK that's what unmodified Bitcoin software will do after a while); but to do that, they have to discard that block they had included earlier (since it's not in the 51% chain).

That is: yes, the 49% can include "banned" transactions, but that inclusion will be undone later. They can include these transactions again, but that inclusion will be undone again. They can never get far enough for these blocks with the "banned" transactions to be permanent.

> Again, a 51% attack has never even been attempted on the Bitcoin network despite huge potential monetary upside if it succeeds.

First, this is not the "traditional" 51% attack, which involves mining an alternative longer chain in secret. Second, the most a 51% attack can do is double spend coins (or prevent them from being spent); converting that into real money requires spending the coin twice (for instance, sending coins to an exchange, withdrawing the resulting money, and then undoing the sending to the exchange so the attacker keeps the coins), and the monetary upside isn't that big in most scenarios. Third, the cost for doing that is not as small as you're thinking (start with the cost to obtain enough miners to have 51% of the hash power), which is why it hasn't AFAIK been attempted on Bitcoin (but AFAIK, it has been attempted on less popular networks which have small total hash power). And if you fail the attack, you have wasted all that cost.

[stale2002]

You have this wrong.

As soon as the chain diverges, they are seperate chains.

Yes, if you have a minority of the hashpower, you can hardfork yourself off the main chain, and continue to follow your smaller chain, regardless.

But you don't get a longer chain than the main one. So you'd continuously be behind, and would not get the work of the main chain, and likely most exchanges would not accept your smaller fork coin, and you would end up like bitcoin cash.