Block Confirmation

What Is a Block Confirmation?

A block confirmation is a measure of how deeply a transaction is embedded in the Bitcoin blockchain. When a miner includes your transaction in a newly mined block, it receives its first confirmation. Each subsequent block added on top of that block adds another confirmation. A transaction with 6 confirmations means 5 additional blocks have been mined after the block containing the transaction.

Confirmations matter because Bitcoin uses proof of work to achieve consensus, and this consensus is probabilistic rather than absolute. There is always a theoretical chance that a competing chain could overtake the current one through a chain reorganization, invalidating recent transactions. Each confirmation makes this increasingly impractical because an attacker would need to redo the cumulative proof of work for every block they want to replace.

For a deeper look at how transactions move from broadcast to final settlement, see the Bitcoin transaction lifecycle explained.

How It Works

The confirmation process begins when a transaction is broadcast to the Bitcoin network and enters the mempool, where it sits with zero confirmations:

1. A miner selects the transaction from the mempool and includes it in a candidate block
2. The miner finds a valid proof of work for the block header
3. The block is broadcast to the network and validated by other nodes: the transaction now has 1 confirmation
4. Another miner builds the next block on top of this one: the transaction now has 2 confirmations
5. Each subsequent block extends the chain further, adding another confirmation

With Bitcoin's target block time of approximately 10 minutes, 6 confirmations take roughly 1 hour. Actual timing varies because block discovery is a random process governed by the difficulty adjustment algorithm.

The Probabilistic Security Model

Section 11 of the Bitcoin whitepaper provides the mathematical proof for why confirmations work. Satoshi modeled the problem as a variant of the Gambler's Ruin: an attacker racing against the honest chain, trying to catch up from behind.

The core formula for the probability an attacker catches up after z confirmations:

q_z = (q/p)^z    when p > q

Where:
  p = probability that the honest network finds the next block
  q = probability that the attacker finds the next block
  z = number of confirmations (blocks the attacker must overcome)

The key insight: as z increases, the attack probability drops exponentially. With an attacker controlling 10% of hashrate (q = 0.1, p = 0.9):

At 6 confirmations, the probability of a successful double spend drops below 0.1%, which the Bitcoin community has adopted as the practical threshold for settlement finality.

Why 6 Confirmations Became the Standard

The 6-confirmation convention emerged directly from these calculations. Satoshi's analysis assumed an attacker with no more than 10% of total hashrate and targeted a risk threshold below 0.1%. At 5 confirmations, the probability (0.09%) still hovers near that boundary; at 6 confirmations (0.03%), it falls well below it. This became the default recommendation referenced in the original Bitcoin client and subsequently adopted by exchanges, wallets, and payment processors.

It is worth noting that academic researchers Cyril Grunspan and Ricardo Pérez-Marco later identified that Satoshi's analysis used a Poisson distribution where a negative binomial distribution would have been more precise. The core principle of exponential decay remains valid, but the exact probabilities for borderline confirmation counts differ slightly from the original paper.

Confirmation Requirements in Practice

Different platforms set different confirmation thresholds based on their risk tolerance, transaction monitoring capabilities, and the value at stake:

These policies are operational decisions, not protocol requirements. Exchanges balance user experience (faster crediting) against double-spend risk. Many exchanges credit deposits quickly for display purposes but place temporary withdrawal holds until additional confirmations accumulate.

Mining Concentration and Confirmation Security

The original 6-confirmation standard assumed relatively decentralized mining. Modern mining pool concentration changes the security calculus. As of 2026, major mining pools like Foundry USA control over 30% of network hashrate. At that concentration level, the same 99.9% security threshold that 6 confirmations provided under Satoshi's assumptions would theoretically require significantly more confirmations.

In practice, pool operators do not control individual miners' hardware. A pool attempting a reorganization attack would likely see miners leave immediately, dissolving its hashrate advantage. The adoption of the Stratum V2 protocol (announced May 2026 by pools representing ~75% of hashrate) further decentralizes transaction selection by allowing individual miners to choose which transactions go into blocks.

Use Cases

Exchange Deposits and Withdrawals

Cryptocurrency exchanges are the most common context where users encounter confirmation requirements. When you send Bitcoin to an exchange, the platform displays your deposit as "pending" until the required number of confirmations is reached. Only then are funds credited to your trading account. This protects the exchange from accepting deposits that could later be reversed through a double-spend attack.

Merchant Payments

Merchants accepting Bitcoin on-chain must decide how many confirmations to require. A coffee shop selling a $5 drink may accept zero confirmations (the transaction is visible in the mempool, and the risk of a double-spend for such a small amount is negligible). A car dealership processing a $50,000 sale should wait for 6 or more confirmations. For more on the tradeoffs of accepting unconfirmed transactions, see zero-conf Bitcoin explained.

Cross-Chain Atomic Swaps

When performing atomic swaps between Bitcoin and other blockchains, each side of the swap requires sufficient confirmations before the counterparty releases their funds. The confirmation requirements on each chain must be set high enough that neither party can reverse their side of the trade after the other has already committed.

Mining Reward Maturity

Coinbase transactions (the reward miners receive for finding a block) require 100 confirmations before they can be spent. This stricter requirement exists because if a block is orphaned during a chain reorganization, its coinbase transaction becomes invalid. Requiring 100 confirmations (roughly 16.7 hours) makes it extremely unlikely that a mined block will be reorganized out of the chain before the miner spends their reward.

Layer 2: Payments Without Waiting

The confirmation wait time is one of the primary motivations for Layer 2 scaling solutions. While on-chain Bitcoin transactions need 10-60 minutes to reach practical finality, Layer 2 protocols achieve instant settlement through different security models.

Lightning Network

The Lightning Network routes payments through pre-funded payment channels using HTLCs. Payments settle in milliseconds because they do not require on-chain block inclusion. Security comes from the fact that either party can broadcast the latest channel state to the blockchain if the other party misbehaves. The channel funding transaction still requires on-chain confirmations when the channel is first opened, but subsequent payments within the channel are instant.

Spark Protocol

Spark takes a different approach by eliminating channels entirely. Users hold virtual UTXOs off-chain, and transfers between Spark users settle instantly without touching the blockchain. Like Lightning, Spark inherits Bitcoin's base layer security through the ability to exit to the main chain, but everyday payments do not require any block confirmations.

For a comparison of how different blockchain protocols handle finality, see payment finality comparison across blockchains.

Risks and Considerations

Accepting Too Few Confirmations

Zero-confirmation transactions carry real risk. A sender can broadcast a conflicting transaction using replace-by-fee (RBF) to redirect funds before any block is mined. Even 1 confirmation provides limited protection: an attacker with significant hashrate could mine a competing block. For transactions worth more than trivial amounts, waiting for multiple confirmations is essential.

51% Attacks

If an entity controls more than 50% of the network's hashrate, they can theoretically reverse any number of confirmations by mining a longer chain in secret and then broadcasting it. This 51% attack makes confirmations meaningless against a majority attacker. Bitcoin's security model fundamentally assumes that no single entity controls a majority of mining power.

Confirmation Time Variability

While the target block time is 10 minutes, actual intervals vary. Blocks can be found in seconds or take over an hour. During periods of high demand, transactions with low fees may sit in the mempool for extended periods before receiving even a first confirmation. The Bitcoin fee market determines which transactions are prioritized by miners.

False Sense of Security

Confirmations provide probabilistic, not absolute, security. The 6-confirmation standard is a reasonable default for most use cases, but it is not a guarantee. Organizations handling very large values should consider both the number of confirmations and the current state of mining centralization when setting their settlement policies.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.