Blockchain is completely unhackable
Blockchain technology's core cryptographic ledger structure is highly resistant to certain kinds of tampering, but 'unhackable' overstates its real-world security. Numerous documented hacks and thefts totaling billions of dollars have occurred through smart contract bugs, exchange vulnerabilities, and consensus-level attacks on smaller networks, none of which the base blockchain design prevents.
What we know
Blockchain technology's core security property is that altering historical transaction records stored on a sufficiently large, decentralized blockchain like bitcoin's or Ethereum's is extremely difficult, because doing so would require controlling a majority of the network's computing power (in proof-of-work systems) or staked assets (in proof-of-stake systems) simultaneously, an achievement that becomes progressively more costly and difficult as a network grows larger and more decentralized. This specific property, resistance to retroactively rewriting confirmed transaction history on a large, established blockchain, is real and has held up well for major networks like bitcoin and Ethereum since their inception.
However, "blockchain is unhackable" as a general claim badly overstates what this specific property actually guarantees, and a substantial, well documented history of cryptocurrency-related hacks and thefts demonstrates the distinction clearly. Chainalysis, a blockchain analysis firm that tracks cryptocurrency crime, has documented billions of dollars in losses annually across the cryptocurrency industry from hacks, with 2022 alone seeing over 3.8 billion dollars stolen according to Chainalysis's crime report, figures that directly contradict any claim of blockchain-based systems being immune to theft or compromise.
These documented losses occur through several distinct attack vectors, none of which involve breaking blockchain's core cryptographic transaction-recording property, but which are frequently conflated with it in casual "blockchain is unhackable" claims. Smart contract vulnerabilities, bugs in the code that governs how decentralized applications and tokens behave, have caused some of the largest losses, including the 2016 DAO hack on Ethereum, which exploited a coding flaw to drain roughly 60 million dollars worth of ether, and the 2022 Ronin Network bridge hack, which resulted in the theft of over 600 million dollars through compromised private keys controlling the bridge's validator nodes, an attack on the specific application built on top of the blockchain, not on the blockchain's fundamental ledger integrity itself. Cryptocurrency exchange hacks, targeting centralized companies that hold user funds rather than the blockchain itself, have also resulted in massive losses, including the 2014 Mt. Gox hack (roughly 450 million dollars at the time) and numerous subsequent exchange breaches, again representing a compromise of centralized infrastructure surrounding blockchain assets, not the underlying distributed ledger technology.
Smaller blockchain networks with less distributed computing power have also experienced direct "51 percent attacks," in which a single entity or coalition gains control of a majority of the network's mining power and can then manipulate transaction confirmation, a documented and successfully executed attack vector against several smaller proof-of-work cryptocurrencies, though it remains prohibitively expensive and has not been successfully executed against bitcoin or Ethereum specifically due to their scale. Security researchers, including those publishing through academic venues like IEEE Security and Privacy conferences, generally characterize blockchain's core transaction-ledger design as achieving a specific, narrow security property very well, resistance to retroactive tampering on sufficiently large, decentralized networks, while emphasizing that the broader ecosystem of wallets, exchanges, smart contracts, and bridges built around blockchains introduces numerous additional attack surfaces that have been repeatedly and successfully exploited, making the blanket claim that "blockchain is unhackable" a significant overstatement of a real but narrower and more conditional security property.
Common claims
- Blockchain technology cannot be hacked.Overstated. Core ledgers of large chains are very secure; smaller chains and smart contracts have been exploited.
- A 51 percent attack is theoretically impossible.False. Multiple smaller blockchains have suffered successful 51 percent attacks.
- Bitcoin's blockchain has never been compromised.True for the core ledger. Exchange and wallet hacks are different attack surfaces.