Three times in one month, Ethereum Classic's history was rewritten.
The attackers owned no mining hardware. They rented hashpower from a commodity marketplace, by the hour, the way you would rent a car.
The first attack rewrote 3,693 blocks and double-spent an estimated $5.6M of ETC. Estimated cost of the rented hashpower: about $192,000. The second rewrote roughly 4,000 blocks for around $1.7M. The third rewrote more than 7,000 blocks, about two days of mining.
Nothing was hacked. No software was exploited. No key was stolen.
The attackers produced a longer chain than the honest one, and every node did what it had always been programmed to do, which is follow the longest chain. The rule worked perfectly.
The decision point belongs to everyone who was accepting ETC. They were treating confirmations as facts. A confirmation is a probability, and its strength is the cost of undoing it. Once hashpower became rentable by the hour, that cost dropped below the value it was protecting.
And the confirmations looked exactly the same the entire time.
F101-01 said that everyone recomputes the state independently rather than trusting anyone's copy. That leaves one problem, and consensus is the answer to it.
The problem is ordering, not validity
Checking validity is easy and needs no agreement. Is the signature correct? Does the sender have the balance? Any node answers that alone, and two honest nodes always agree.
Here is the part that does not work alone. I have 10 units. I sign one transaction sending all 10 to you, and another sending all 10 to someone else. I broadcast both at the same moment, to different parts of the network.
Both are valid. Each satisfies every rule, individually. What makes them incompatible is that only one can be first.
There is no clock everybody shares, no referee, and no authoritative view of what arrived when. So the network needs a procedure for agreeing on an order, and that agreement has to be reached among strangers, some of whom are lying.
That is all consensus is: a way for a group with no leader to agree on a sequence. Everything else, all the machinery about mining and staking and blocks, is implementation.
Two answers to the same question
The question is always: who gets to propose the next block, and why should we believe them?
You cannot use identity, because anyone can create unlimited identities and a simple vote is won by whoever makes the most accounts. So both real answers attach a cost to participating.
Proof of work makes the cost external. Proposers race to find a solution to a puzzle that can only be solved by trying enormous numbers of guesses, which consumes electricity and hardware. The winner proposes the block. You believe them because producing that block demonstrably burned real resources, and producing a competing history means burning them all again.
Proof of stake makes the cost internal. Proposers lock up the chain's own asset as collateral and are selected in proportion to it. You believe them because misbehaving is detectable and the collateral is destroyed, so an attack costs the attacker their own capital.
Same structure. Attack must cost more than it yields. The two systems differ in whether the attacker's capital is reusable, which is the interesting distinction: electricity spent on a failed attack can be spent again tomorrow, while slashed stake is gone.
Neither has solved anything permanently. Both are economic arguments, and an economic argument can be wrong when the numbers move.
The arithmetic that ETC failed
An attacker wants to reverse a payment. They deposit coins somewhere, receive something in exchange, then rewrite history so the deposit never happened while keeping what they received.
The condition is simple:
cost of producing a longer chain < value that reversing recovers
Take the first ETC attack.
Estimated rental cost of the hashpower: $192,000 Estimated double-spent value: $5,600,000
Return on the attack:
($5,600,000 - $192,000) / $192,000 = 5,408,000 / 192,000 = 28.2, or about 2,800 percent
Now the structural question, which is the one that generalises. What made this possible was not weak cryptography. It was that ETC's hashrate was a small fraction of the total available for its algorithm, and that spare capacity was rentable.
Put it as a rule:
If (cost to rent 51 percent for one hour) x (hours needed) < (value reversible in that window), the chain is not economically secure, regardless of how strong its cryptography is.
Now apply it to the confirmations question. Suppose an exchange requires 12 confirmations before crediting a deposit, a convention borrowed from a different chain entirely. On ETC with roughly 13-second blocks:
12 x 13 seconds = 156 seconds, about two and a half minutes
But the attack rewrote 3,693 blocks, which is:
3,693 x 13 = 48,009 seconds = about 13.3 hours
Their 12 confirmations were behind by a factor of over three hundred. And there is no observable difference, on screen, between a confirmation that costs $10M to undo and one that costs $200,000 to undo. It is the same green tick.
Finality is a probability with a price
The word "confirmed" is misleading and it is worth replacing in your head.
A transaction is not confirmed. It is buried, under some amount of subsequent work or attestation. The deeper it is buried, the more expensive it becomes to dig it out. That is the entire guarantee.
So the right question is never "is it confirmed?" It is "how much would it cost to undo this, and is that more than what I am accepting?"
Which produces an actual procedure:
- Small amounts on a large chain. A few confirmations. The attack costs enormously more than your transaction is worth, so nobody will run it for you.
- Large amounts. Wait longer, in proportion. The exchange convention exists because at some point the cost of reversal exceeds any plausible gain.
- Any amount on a small chain. Look up the security budget before deciding anything. If hashpower for that algorithm can be rented, the cost of reversal is a published market price and you can read it.
Some proof-of-stake chains offer economic finality instead, meaning that after a certain point reversal requires destroying a specific, very large, quantifiable amount of the attacker's own collateral. That is a stronger and more legible promise than "probably deep enough", and it is still a price rather than a law.
Your wallet shows a count of confirmations. It does not show the cost of reversing them, which is the thing the count is standing in for.
Two chains showing "6 confirmations" can differ by four orders of magnitude in how much it would cost to take that back. Nothing in the interface tells you which one you are looking at, and the interface will never tell you, because the interface has no idea what you are accepting in return.
A 51 percent attack means the attacker can steal everyone's coins.
It does not, and the limit is worth knowing precisely, because it tells you what consensus is actually protecting.
Controlling a majority of hashpower or stake lets an attacker reorder and exclude: reverse their own recent transactions, censor others, and choose what gets included. That is enough to double-spend, which is what happened to ETC.
It does not let them spend your coins, change balances arbitrarily, or create units from nothing. Those require a valid signature from your private key, and majority hashpower produces no signatures. Every honest node validates every block against the rules regardless of who produced it, and an invalid block is rejected no matter how much work is behind it.
So consensus protects ordering. Cryptography protects ownership. They are different guarantees with different failure modes, and this is why the ETC holders who were not transacting during the attacks lost nothing at all.
What to carry forward
Consensus is not a technical detail you can skip because it happens far away from you. It is the reason the notebook cannot be quietly edited, and its strength is a number that changes.
Three things to keep:
Ordering is the hard problem, and everything else in the machinery exists to solve it without a leader.
Both mechanisms are economic arguments. They hold while attacking costs more than it returns, which is a condition, not a law.
A confirmation is a price, not a fact. Ask what undoing it would cost, and compare that to what you are handing over.
Consensus exists to agree an order among strangers with no leader, because validity can be checked alone and sequence cannot. Proof of work and proof of stake are two ways of making that agreement expensive to subvert, and both are economic arguments rather than guarantees. Ethereum Classic proved it: about $192,000 of rented hashpower rewrote 3,693 blocks and double-spent an estimated $5.6M, with nothing broken and every confirmation looking normal throughout. So treat finality as a price. Ask what reversing this would cost, and wait in proportion to what you are accepting.