[Paper Review] Bitcoin and Blockchain: Security and Privacy

Ehab Zaghloul, Tongtong Li+2 more|arXiv (Cornell University)|Apr 25, 2019

Blockchain Technology Applications and Security52 references4 citations

TL;DR

This paper analyzes Bitcoin's security and privacy challenges, focusing on double-spending attacks, peer-to-peer network vulnerabilities, and wallet storage risks. It evaluates attack profitability using probabilistic models and demonstrates that attackers with less than 50% of network power will eventually fail, highlighting a trade-off between transaction speed and security confidence.

ABSTRACT

A cryptocurrency is a decentralized digital currency that is designed for secure and private asset transfer and storage. As a currency, it should be difficult to counterfeit and double-spend. In this paper, we review and analyze the major security and privacy issues of Bitcoin. In particular, we focus on its underlying foundation, blockchain technology. First, we present a comprehensive background of Bitcoin and the preliminary on security. Second, the major security threats and countermeasures of Bitcoin are investigated. We analyze the risk of double-spending attacks, evaluate the probability of success in performing the attacks and derive the profitability for the attacker to perform such attacks. Third, we analyze the underlying Bitcoin peer-to-peer network security risks and Bitcoin storage security. We compare three types of Bitcoin wallets in terms of security, type of services and their trade-offs. Finally, we discuss the security and privacy features of alternative cryptocurrencies and present an overview of emerging technologies today. Our results can help Bitcoin users to determine a trade-off between the risk of double-spending attempts and the transaction time delay or confidence before accepting transactions. These results can also assist miners to develop suitable strategies to get involved in the mining process and maximize their profits.

Motivation & Objective

• To analyze the security and privacy risks inherent in Bitcoin's blockchain architecture and transaction mechanisms.
• To evaluate the feasibility and profitability of double-spending attacks under different network conditions.
• To assess the security trade-offs across different Bitcoin wallet types (hot, cold, paper).
• To examine network-level threats in Bitcoin's peer-to-peer infrastructure and their implications.
• To explore privacy-enhancing alternatives in altcoins and emerging blockchain technologies.

Proposed method

• Uses two probabilistic models to calculate the likelihood of successful double-spending attacks based on chain race dynamics.
• Applies a profitability model to determine economic incentives for attackers, factoring in mining costs and rewards.
• Compares three Bitcoin wallet types—hot, cold, and paper—based on security, usability, and threat surface.
• Analyzes network-level risks such as eclipse attacks and Sybil attacks in the P2P Bitcoin network.
• Reviews privacy-preserving protocols like traceable ring signatures and one-time ring signatures in CryptoNote-based blockchains.
• Evaluates emerging technologies in altcoins that aim to improve security and privacy, including novel consensus mechanisms.

Experimental results

Research questions

• RQ1 What is the probability of success for a double-spending attack in Bitcoin, and how does it vary with network conditions?
• RQ2 What is the economic profitability of launching a double-spending attack, and how does it depend on an attacker’s computational power?
• RQ3 How do different Bitcoin wallet types compare in terms of security, usability, and risk exposure?
• RQ4 What are the primary peer-to-peer network vulnerabilities in Bitcoin, and how do they affect system integrity?
• RQ5 To what extent do emerging privacy-preserving protocols in altcoins like CryptoNote improve upon Bitcoin’s privacy limitations?

Key findings

• An attacker with less than 50% of the total network hash rate will eventually lose the race to extend the blockchain, making double-spending attacks unprofitable in the long run.
• The probability of a successful double-spending attack decreases exponentially with the number of confirmations, establishing a clear trade-off between transaction delay and reversal risk.
• Hot wallets offer high usability but are vulnerable to remote compromise, while cold and paper wallets provide stronger security at the cost of reduced convenience.
• The Bitcoin P2P network is inherently susceptible to eclipse and Sybil attacks, as malicious nodes can join and manipulate transaction propagation.
• Bitcoin’s public ledger design inherently compromises user privacy, and the system is not anonymous despite common misconceptions.
• Emerging protocols like one-time ring signatures in CryptoNote-based systems can detect and prevent double-spending, but they introduce new challenges in transaction verification and scalability.