Confirmations Depth

Confirmations depth is the count of blocks built on top of the block that contains a given transaction, including that block itself. A transaction in the most recent block has one confirmation; once five more blocks are stacked above it, it has six. Depth is the practical measure of how settled a transaction is, because reversing it would require re-mining its block and every block above it — and then outpacing the honest network besides. Each confirmation arrives, on average, every ten minutes, so depth is also a clock: six confirmations is roughly an hour of the entire world's hashrate vouching for your payment.

Why depth equals security

Every additional block represents real, unfakeable proof-of-work that an attacker would have to redo. To rewrite a transaction at depth n, an attacker must secretly build an alternative chain from before that block and extend it until it is longer than the honest chain — while the honest majority keeps extending the real one. Unless the attacker controls close to half the network's hashpower, they fall further behind on average with every block, and the probability of ever catching up falls off exponentially as depth increases. This is the calculation in the Bitcoin whitepaper itself, and it is why a deeply buried transaction is treated as irreversible even though, strictly speaking, no Bitcoin transaction is ever absolutely final — finality here is probabilistic, converging on certainty rather than declaring it. See probabilistic finality for the theory.

Choosing a required depth

The famous "six confirmations" is a convention, not a protocol constant. Exchanges and merchants pick thresholds proportional to value and counterparty risk: small, low-risk payments may be accepted at one confirmation, large transfers commonly wait for six, and institutions sometimes demand more during periods of unusual hashrate concentration or after network turbulence. The economically sensible framing: an attacker rewriting n blocks forfeits n blocks' worth of honest block rewards plus the enormous cost of the hashpower itself, so the depth you require should scale with what the attacker would gain by reversing your transaction. For everyday sums, one or two confirmations is overwhelmingly safe; for a house, wait.

Reorgs in practice

Shallow reorganizations are a normal consequence of physics, not an attack: two miners occasionally find blocks seconds apart, the network briefly splits between them, and the next block decides which branch survives — orphaning one block and knocking every transaction in it back to zero confirmations (most are simply re-mined shortly after). This is why one confirmation is qualitatively weaker than two. Deep reorganizations on Bitcoin mainnet, by contrast, are extraordinarily rare precisely because the honest-hashrate arithmetic above is unforgiving. Smaller proof-of-work chains with rentable hashrate have suffered deep reorgs and double-spends repeatedly — a standing demonstration that depth is only as strong as the hashrate behind it.

The miner's special case

Miners live with the strictest depth rule in the protocol: newly minted coins from the coinbase transaction cannot be spent until they are 100 blocks deep — the coinbase maturity rule. The reason is instructive: if a small reorganization orphans a block, its transactions can usually be re-mined from the mempool, but its coinbase reward simply ceases to exist, and anything bought with it would unravel. The 100-block quarantine makes that scenario practically impossible. It is the protocol acknowledging its own probabilistic nature: even Bitcoin does not fully trust a block until it is buried. For related edge cases and defensive tooling, see reorg protection — and remember that depth, not the green checkmark in a wallet, is the only settlement guarantee Bitcoin actually makes.