incentive-compatible. We presented Selfish-Mine, a mining
strategy that enables pools of colluding miners that adopt
it to earn revenues in excess of their mining power. Higher
revenues can lead new miners to join a selfish miner pool, a
dangerous dynamic that enables the selfish mining pool to grow
towards a majority. The Bitcoin system would be much more
robust if it were to adopt an automated mechanism that
can thwart selfish miners. We offer a backwards-compatible
modification to Bitcoin that ensures that pools smaller than
1/4 of the total mining power cannot profitably engage selfish mining. We also show that at least 2/3 of the network
needs to be honest to thwart selfish mining; a simple majority is not enough.
We are grateful to Raphael Rom, Fred B. Schneider, Eva Tardos,
and Dror Kronstein for their valuable advice on drafts of this
paper, as well as our shepherd Rainer Böhme.
a subset of the selfish miner’s behavior (the transition from
state 2 to state 0 in the state machine), the signature behavior
occurs relatively rarely, and such a statistical detector may take
a long time to accrue statistically significant data.
8. 3. Measures and countermeasures
Although miners may choose to collude in a selfish mining
effort, they may prefer to hide it in order to avoid public criticism and countermeasures. It is easy to hide Selfish-Mine
behavior, and difficult to ban it. A selfish pool may never
reveal its size by using different Bitcoin addresses and IP
addresses, and by faking block creation times. The rest of
the network would not even suspect that a pool is near a dangerous threshold.
Moreover, the honest protocol is public, so if a detection
mechanism is set up, a selfish pool would know its parameters and use them to avoid detection. For instance, if the protocol was defined to reject blocks with creation time below
a certain threshold, the pool could publish its secret blocks
just before this threshold.
A possible line of defense against selfish mining pools is
for counter-attackers to infiltrate selfish pools and expose
their secret blocks for the honest miners. However, selfish
pool managers can, in turn, selectively reveal blocks to subsets of the members in the pool, identify spy nodes through
intersection, and expel nodes that leak information.
8. 4. Thieves and snowballs
Selfish mining poses two kinds of danger to the Bitcoin
ecosystem: selfish miners reap disproportionate rewards,
and the dynamics favor the growth of selfish mining pools
towards a majority, in a snowball effect. The system would
be immune to selfish mining if there were no pools above
the threshold size. Yet, since the current protocol has no
guaranteed lower bound on this threshold, it cannot automatically protect against selfish miners.
Even with our proposed fix that raises the threshold to
25%, the system remains vulnerable: there already exist
pools whose mining power exceeds the 25% threshold, 18 and
at times, even the 33% theoretical hard limit. Responsible
miners should therefore break off from large pools until no
pool exceeds the threshold size.
8. 5. Responsible disclosure
Because of Bitcoin’s decentralized nature, selfish mining
can only be thwarted by collective, concerted action. There
is no central repository, no push mechanism and no set of
privileged developers; all protocol modifications require
public discussion prior to adoption. In order to promote
a swift solution and to avoid a scenario where some set of
people had the benefit of selective access, we published a
preliminary report9 and explained both the problem and our
suggested solution in public forums. 8
Bitcoin is the first widely popular cryptocurrency with a
broad user base and a rich ecosystem, all hinging on the
incentives in place to maintain the critical Bitcoin blockchain. Our results show that Bitcoin’s mining protocol is not ©ACM 0001-0782/18/7 $15.00.
1. Andresen, G. March 2013 chain fork
post-mortem. BIP 50, en.bitcoin.it/
wiki/BIP_ 50, retrieved Sep. 2013.
2. Babaioff, M., Dobzinski, S., Oren, S.,
Zohar, A. On Bitcoin and red balloons.
In EC (ACM, 2012).
3. Barber, S., Boyen, X., Shi, E., Uzun, E.
Bitter to better, how to make Bitcoin
a better currency. In FC (2012).
4. bitcoincharts.com. Bitcoin network.
bitcoincharts.com/bitcoin/ (Nov. 2013).
5. blockchain.info. Bitcoin market
market-cap (Jan. 2014).
6. Chaum, D. Blind signatures for
untraceable payments. In Crypto 82
7. Decker, C., Wattenhofer, R.
Information propagation in the
Bitcoin network. In P2P (IEEE, 2013).
8. Eyal, I., Sirer, E.G. Bitcoin is broken.
9. Eyal, I., Sirer, E.G. Majority is not
enough: Bitcoin mining is vulnerable.
arXiv preprint arXiv:1311.0243 (2013).
10. Felten, E. W. Bitcoin research in
Princeton CS. freedom-to-tinker.
com/blog/felten/ bitcoin-research-in-princeton-cs/ (2013).
11. Kelkar, A., Bernard, J., Joshi, S.,
Premkumar, S., Sirer, E.G. Virtual
notary. virtual-notary.org/ (Retrieved
12. Kroll, J.A., Davey, I.C., Felten, E. W.
The economics of Bitcoin mining or,
Bitcoin in the presence of adversaries.
In Workshop on the Economics of
Information Security (2013).
13. Lee, T.B. Four reasons Bitcoin is
worth studying. forbes.com/sites/
14. Miers, I., Garman, C., Green, M.,
Rubin, A.D. Zerocoin: Anonymous
distributed e-cash from Bitcoin. In
IEEE Symposium on Security and
15. Nakamoto, S. Bitcoin: A peer-to-peer
electronic cash system (2008).
16. Namecoin Project. Namecoin DNS –
DotBIT project. dot-bit.org (Retrieved
17. Narayanan, A., Miller, A. Why the
Cornell paper on Bitcoin mining is
important. freedom-to-tinker. com/
18. Neighborhood Pool Watch. October
27th 2013 weekly pool and network
weekly-pool-and. html (Retrieved
19. Pacia, C. Bitcoin mining explained
like you’re five: Part 1 – incentives.
20. RHorning, mtgox, btchris, and
ByteCoin. Mining cartel attack.
21. Rosenfeld, M. Analysis of Bitcoin
pooled mining reward systems. arXiv
preprint arXiv:1112.4980 (2011).
22. Swanson, E. Bitcoin mining calculator.
(Retrieved Sep. 2013).
23. Vishnumurthy, V., Chandrakumar, S.,
Sirer, E.G. Karma: A secure economic
framework for peer-to-peer resource
sharing. In Workshop on Economics
of Peer-to-Peer Systems (2003).
24. Wikipedia. List of cryptocurrencies.
cryptocurrencies (Oct. 2013).
25. Yang, B., Garcia-Molina, H. PPay:
Micropayments for peer-to-peer
systems. In CCS (ACM, 2003).
Ittay Eyal ( firstname.lastname@example.org),
Electrical Engineering, Technion, Initiative
for Cryptocurrencies and Contracts, Haifa,
Emin Gün Sirer ( email@example.com.
edu), Computer Science, Cornell University,
Initiative for Cryptocurrencies and
Contracts, Ithaca, NY, USA.