Definition
The Vector76 attack, also called the one-confirmation attack, is a double-spend strategy that combines elements of the Finney Attack and the Race Attack. It targets merchants who release goods after just a single block confirmation, exploiting the brief moment when the network has not yet agreed on which competing block wins. It is named after the BitcoinTalk user ("vector76") who first described it.
How it works
The attacker pre-mines a block in secret that includes a transaction paying a merchant for irreversible goods or services. When the attacker hears that a new block has been found elsewhere, they immediately push their own mined block directly to the merchant's node. The merchant sees the transaction confirmed in a block and releases the goods. But because a competing block also exists, the rest of the network may converge on the other chain, discarding the attacker's block — and with it the merchant's payment — while a second conflicting transaction returns the coins to the attacker.
Feasibility and defense
The attack is most effective in networks with moderate propagation latency, where simulations have shown meaningful success rates against one-confirmation acceptance. Like its cousins, it requires the attacker to mine and to exploit timing, raising the bar considerably. The clean defense is to wait for multiple confirmations — typically the merchant-standard six for high-value transactions — which renders the discarded-block trick useless.
The Vector76 attack rounds out the short-confirmation double-spend family and underscores why confirmation depth, not just visibility in a block, is what makes a Bitcoin payment final.
In Simple Terms
The Vector76 attack, also called the one-confirmation attack, is a double-spend strategy that combines elements of the Finney Attack and the Race Attack. It targets…