tl;dr:
  • 1 confirmation: sufficient for small payments less than $1,000.
  • 3 confirmations: for payments $1,000 - $10,000. Most exchanges require 3 confirmations for deposits.
  • 6 confirmations: good for large payments between $10,000 - $1,000,000. Six is standard for most transactions to be considered secure.
  • 10 confirmations: suggested for large payments greater than $1,000,000.
reply
Did you only read the first half?
reply
Nice writeup, as always with Lopp. And comes with a nice tool, for those who didn't read the article.
Also reminded be about this 2019 paper by Grunspan et Pérez-Marco where they consider the profitability of an attack instead of the sole probability. Their results are a bit more encouraging, although it greatly depends on how long the attacker is willing to keep trying to do their reorg. Also, there are a variety of attackers who might me motivated by something else than money.
Another thing that often flies under the radar is that, depending on how the attacker does their reorg, your low value transaction could theoretically get caught in a reorg targeting someone else's high value transaction that just happens to be in the same block as yours.
reply
“New article from [Lopp] that introduces a new tool, the Bitcoin Confirmation Risk Calculator. By providing it a percentage of hashrate a pool has, it tells you the likelihood the pool can successfully execute a reorg.
For example, with 35% of the hashrate, Foundry has a 73% chance of successfully executing a reorg for a block with 1 confirmation.
For a block with 6 confirmations, it has a 28% chance!! That is so wild to me, I thought the percentage would be much lower.”
Source:
reply