The Bitcoin network experienced a rare two-block reorg on Mar. 23, at block height 941,880. Foundry mined six consecutive blocks, AntPool and ViaBTC briefly extended a competing branch.
The chain resolved the fork as designed, following the path with the most hash rate. Bitcoin performed exactly as designed and validated its assumptions.
The heuristic nobody labeled
The six-confirmation rule is one of the pieces of received wisdom that have traveled so far from their origins that most people who repeat it can’t reconstruct why six is the number.
The answer traces back to Satoshi Nakamoto’s 2008 whitepaper, which modeled finality as a catch-up probability. As enough blocks pile up on top of a transaction, the computational cost of rewriting history becomes prohibitive for an attacker with limited hashpower.
Six blocks became the community shorthand for “safe enough,” even though the whitepaper treated it as a calculation that assumes the attacker controls about 10% of the network’s hashpower.
That assumption has been quietly doing a lot of work for sixteen years.
Jameson Lopp made the implication explicit in an analysis of confirmation risk. The comfort level baked into six confirmations is a function of who else is on the network and how much of it they run.
Under the Nakamoto catch-up model, six confirmations against an attacker holding 10% of hashpower yields a reversal risk of roughly 0.02%. Against 20%, that figure climbs to about 1.43%. Against 30%, it reaches approximately 13.2%.
At the 32.2% share Foundry held in recent pool-share snapshots, the same model puts six-confirmation reversal risk near 18.9%.
Mining pools are not coordinated attackers by default, which is why they don’t fit in these model outputs. Foundry USA describes itself as an institutional-grade pool built for miners that coordinates many independent operators.
Miners can and do switch pools, making an overt attack would be economically self-destructive for any rational pool operator. Concentration in block production changes the risk model people use to decide when a payment feels final, regardless of how dispersed the underlying machines are.
A 2022 latency security analysis noted that with a 10% adversary and a 10-second propagation delay, six confirmations still produce a safety-violation probability between 0.11% and 0.35%.
Six was never a hard ceiling, even under conditions far more favorable than those of today.
Three conditions at once
The context surrounding the reorg carries the weight.
Bitcoin’s network is currently running three conditions simultaneously that put the six-confirmation heuristic under pressure, which it has rarely faced in practice.
In the past three days, Foundry has held roughly 31% of the global hashrate, while AntPool sits at about 18.4%, and ViaBTC at 10.5%, according to Hashrate Index data. Those three pools combined account for approximately 60% of block production.
That degree of concentration in coordinator power is elevated by any reasonable measure over the last several years.
At the same time, mining economics have deteriorated sharply. Difficulty dropped 7.76% on Mar. 21 in one of 2026’s largest negative adjustments. Hashprice averaged $32.31 per petahash per day in February, down nearly 18% month over month, briefly touching a record low of $27.89.
Transaction fees contributed just 0.57% of total block rewards in the last 24 hours of available data.
When margins compress and fee revenue dries up, smaller and mid-sized miners face a growing incentive to pool into whichever coordinator offers the best variance reduction. This usually means the already-large pools get larger.
The January winter storm offered a counterpoint worth noting. Foundry’s hashrate reportedly dropped by around 60%, or nearly 200 exahashes per second, during that period, demonstrating that pool shares can redistribute quickly when external conditions change.
Amid this backdrop, the six-confirmation rule lacks an automatic adjustment mechanism when pool shares move.
ConditionLatest readingWhy it matters for the 6-confirmation rulePool concentrationFoundry ~31%; AntPool ~18.4%; ViaBTC ~10.5%A larger share of block production is concentrated in a few coordinators, making fixed-confirmation assumptions less comfortable for large-value settlement.Top-three concentration~60% of block production combinedFinality depends not just on block count, but on how distributed hashpower is across competing pools.Difficulty adjustment-7.76% on Mar. 21A large negative adjustment signals stress in mining conditions and weaker economics across the network.February hashprice$32.31 per PH/dayLower miner revenue increases the incentive for smaller miners to seek stability in larger pools.Intramonth hashprice low$27.89The deeper margins compress, the more pooling for variance reduction becomes attractive.Fee contribution to rewards0.57% in the last 24 hoursWeak fee support leaves miners more dependent on shrinking block-subsidy economics.Counterpoint: redistribution riskFoundry reportedly fell ~60% during the January winter stormConcentration is elevated, but not fixed; external shocks can still reshuffle pool shares quickly.
In practice, the industry’s largest venues have abandoned the six-confirmation standard in a quiet operational judgment made years ago.
Coinbase requires two confirmations for BTC deposits to be marked as pending, while Kraken and Gemini each require three.
None of those thresholds is wrong for their use cases: for ordinary retail deposits, two or three confirmations represent an entirely defensible risk tolerance.
The gap between those real-world numbers and the folk standard of six illustrates that “six confirmations” was always more a cultural artifact than a universal policy.
Lopp’s framework argues that this gap should grow more deliberate. Required confirmations should scale with transaction value and the economics of the attacker.
A $500 retail deposit and a $50 million OTC settlement do not share the same risk profile, and the honest version of finality guidance would explicitly state so.
The number that stayed the same
There are different outcomes in the current hashrate concentration scenario, which raised an alarm for users.
Positively, hashrate redistributes across a broader pool of coordinators as mining margins eventually recover and new entrants compete for share.
The January storm already demonstrated that Foundry’s dominance can erode quickly under the right conditions. If concentration eases and the hash price recovers, six confirmations remain a reasonable default for large BTC settlements.
On the flip side, Foundry could remain above 30%, and the top-three concentration stays sticky. No malicious event is required for the norm to degrade, as exchanges, OTC desks, and merchants handling high-value transfers can quietly raise internal thresholds or formalize dynamic tiers tied to observable pool-share data.
Under the Nakamoto model, six confirmations against a fully coordinated 32.2% attacker leaves roughly 18.9% catch-up risk, a figure genuinely difficult to reconcile with language like “effectively irreversible” for transfers in the tens of millions of dollars.
The situation requires only that the pool concentration remain where it is, while the gap between the folk standard and the actual risk widens enough that someone with money on the line stops ignoring it.
Bitcoin’s settlement assurances were always “six blocks, under a certain distribution of hashpower and a certain tolerance for risk.”
The two-block reorg produced a rare moment when the gap between Bitcoin’s finality folklore and its underlying math became hard to ignore.
Considering this moment, the six-confirmation rule’s days as a universal, unqualified standard are running out.
