What makes a bitcoin transaction trustworthy?

The problem Bitcoin had to solve

Money on a computer has a weakness that cash in your pocket doesn’t: a file can be copied. Satoshi Nakamoto, Bitcoin’s anonymous creator, set out the problem in a post in February 2009, a month after releasing the first version of the software. Digital signatures could already prove who owned a coin, he wrote, but they left “one big problem unsolved: double-spending. Any owner could try to re-spend an already spent coin by signing it again to another owner.”

The usual answer was a company in the middle. “The usual solution is for a trusted company with a central database to check for double-spending,” Satoshi went on, “but that just gets back to the trust model.” Earlier digital cash, such as David Chaum’s, depended on a bank in just that way. Bitcoin’s white paper, published in October 2008, named the cost: with a central mint checking every coin, “the fate of the entire money system depends on the company running the mint”.

A signature proves the owner said yes

Every bitcoin payment carries a digital signatureDigital signature (ECDSA, Schnorr)Proof, made with a private key, that the owner approved a payment. Anyone can check it; practical forgery is infeasible under current assumptions.: a code that only the holder of a secret number, the private keyPrivate keyThe secret number that lets you spend your bitcoin. Whoever knows it controls the coins, so it must never be shared., can make, but that anyone can check. It fits only this exact payment. Change the amount or the address and the signature no longer matches.

It proves the key was used, not who used it. A thief who copies someone’s private key, or the recovery words it comes from, can sign just as well, which is why those words must never be shared. Nor can a signature stop the rightful owner signing two payments that spend the same coins, one to you and one back to themselves. That is a double spendDouble spendAn attempt to spend the same bitcoin twice. Only one of the conflicting payments can ever confirm., and something has to decide which payment came first.

Nodes check every rule for themselves

The checking is done by nodesNodeA computer running Bitcoin software that checks every payment and block against the rules, and passes them on to others.: computers running Bitcoin software that keep their own copy of every payment ever made. Anyone can run one. A node checks each payment it hears about: that the signatures match, that the coins being spent exist and haven’t been spent already (each is a UTXO, an unspent piece of an earlier payment), and that no more new bitcoin appears than the rules allow. The white paper put the rule in one line: “Nodes accept the block only if all transactions in it are valid and not already spent.”

On 15 August 2010 the software let a broken payment through. A bug allowed a payment in block 74,638 to create 184,467,440,737 bitcoins, two amounts of about 92.2 billion each, in a system Satoshi had said would hold 21,000,000. Within hours he released version 0.3.10, which made such payments invalid. Overnight two chains grew side by side, until the corrected one overtook the other at block 74,691 the next morning and every node followed it. The 184 billion bitcoins no longer exist: block 74,638 is now a different block, mined that night in place of the bad one. A node enforces the rules its software contains, so the fix counted only as people installed it.

Most phone wallets don’t do all this checking themselves. A light clientLight client (SPV)A wallet that checks payments using block headers and proofs instead of the whole chain. It trusts miners more than a full node does. asks other people’s nodes about a payment and checks that it sits in a block with work piled on top. The white paper called that shortcut reliable “as long as honest nodes control the network”, and warned that it “can be fooled by an attacker’s fabricated transactions for as long as the attacker can continue to overpower the network”.

Proof of work makes the past expensive to change

A node can tell whether a payment is valid, but not which of two valid payments spending the same coins came first. Bitcoin settles that with proof of workProof of workA puzzle that takes a computer real effort to solve, so the answer proves the effort was spent. Bitcoin’s miners use it to add each block.: a puzzle that takes a computer real effort to solve but is quick to check. MinersMinerA computer, or a pool of them, that bundles waiting transactions into blocks and secures the network, paid in new bitcoin and fees., the computers that gather payments into blocksBlockA batch of transactions added to Bitcoin's shared record, about every 10 minutes on average., race to solve it, and each new block points back to the one before. The chain with the most work behind it is the agreed history. The white paper called this “essentially one-CPU-one-vote”.

To change a payment already in a block, an attacker would have to redo the work for that block and every block after it, then overtake everyone else. Each block on top of a payment is one more confirmationConfirmationA payment has one confirmation once it's in a block, and one more for each block after. The more it has, the harder it is to reverse.. The white paper worked out the odds: an attacker with a tenth of the network’s computing power, five blocks behind, has less than a 0.1% chance of ever catching up. With 30% of the power, the same odds take 24 blocks.

With most of the computing power, an attacker could rewrite recent blocks: a 51% attack51% attackOne miner or pool controlling most of the hashrate. They could reverse their own recent payments, but not steal coins or change the rules.. Even then, the white paper points out, it could not create “value out of thin air” or take “money that never belonged to the attacker”, because nodes would reject those blocks; it could only try to take back its own recent payments. Satoshi also argued that it wouldn’t pay. Such a miner “ought to find it more profitable to play by the rules”, earning new coins, than “to undermine the system and the validity of his own wealth”.

Which part matters most?

People in Bitcoin disagree about which of these deserves the credit. The case for proof of work starts with the white paper, which says signatures “provide part of the solution” and offers “a solution to the double-spending problem using a peer-to-peer network”: one agreed history, with nobody in charge. When a member of the Cryptography mailing list warned in November 2008 that “Bad guys routinely control zombie farms of 100,000 machines or more”, Satoshi answered: “The requirement is that the good guys collectively have more CPU power than any single attacker.”

The case for nodes is that miners only propose blocks; the people running nodes decide what to accept. Gregory Maxwell, a Bitcoin developer and a co-founder of the company Blockstream, made it in 2015, arguing against blocks so large that few people could check them: “If the system is too costly people will be forced to trust third parties rather than independently enforcing the system’s rules.”

The two views collided in 2017. An upgrade called SegWitSegWitSegregated Witness: a 2017 upgrade that moved signatures into a separate part of each payment, making room for more payments. needed 95% of new blocks to signal support before it took effect, but support among miners stalled at about 30%. Some users, who felt miners were “illegitimately delaying a useful new feature”, as the newsletter Bitcoin Optech later put it, backed a proposal called BIP148, written by a pseudonymous developer called Shaolinfry: from 1 August their nodes would reject any block that didn’t signal for SegWit. A group of companies and miners offered a different deal, the New York Agreement: SegWit, then “a 2 MB hard fork within six months”. Its announcement said the signatories represented “83.28% of hashing power”.

SegWit took effect at block 481,824 on 24 August 2017; the larger blocks never came. In November the agreement’s organisers, among them Jihan Wu of the mining-machine maker Bitmain, called off the 2 MB step: “it is clear that we have not built sufficient consensus for a clean blocksize upgrade at this time.” Each side tells the year its own way. The organisers wrote that their plan “broke the deadlock and quickly led to Segwit’s successful activation”. Braiins, a mining company, marked the anniversary in 2020 by saying BIP148 “put Bitcoin’s future in the hands of users, not miners”.

Wu described the rules as something people agree to. Bitcoin, he told the news site Quartz that August, “is not software, it is a kind of social agreement that is implemented by software. And if people do not agree with each other, a fork will be inevitable.”

None of the three works alone. A signature can’t stop a double spend, nodes can’t agree on an order by themselves, and proof of work can’t make an invalid payment valid.

When can you trust a payment?

For one payment, the question is how much work sits on top of it. Before its first confirmation a payment waits in the mempoolMempoolThe waiting room for Bitcoin transactions that have been sent but aren't in a block yet., the queue of payments not yet in a block, and isn’t final. Bitcoin Core, the software that grew from Satoshi’s first version, has accepted a replacement that pays a higher fee by default since version 28.0 in October 2024. That is replace-by-feeReplace-by-fee (RBF)A way to replace an unconfirmed payment with a conflicting version that pays a higher fee. Only one can remain in the same valid chain., and it lets a sender swap the payment for one that sends the same coins elsewhere.

Once a payment is in a block, undoing it means outpacing the whole network, and every new block makes that harder. There is no fixed number to wait for. Many wallets count to six before they call a payment complete; BitBox, for example, shows “Pending (2/6)” for a payment with two confirmations. Exchanges and shops each set their own number.

To see where a payment stands, paste its payment ID into UTXOHub. The page says whether it has confirmed and how many blocks are on top of it, and keeps counting as new blocks arrive.