How many confirmations does a Bitcoin payment need?

What is a confirmation?#

When your transaction is included in a block, it has one confirmation. Every block mined on top of that block adds another. The Bitcoin developer glossary defines the confirmation score as the number of blocks on the best chain that would have to be modified to remove or change a transaction; a confirmed transaction has a score of one or higher ^[3]. A transaction still waiting in the mempool has zero.

Each block records the hash of the block before it, so changing a block means rebuilding every block after it ^[4]. That is why confirmations measure safety: the deeper your transaction is buried, the more proof of work an attacker would have to redo. Our blockchain basics guide explains the hash chain in more detail.

Counting confirmations

How many confirmations do you need?#

There is no single protocol rule. bitcoin.org publishes a practical guide that depends on the amount at risk and on the kind of wallet you use — a full node such as Bitcoin Core checks more for itself than a lightweight wallet does ^[1]:

Wording from bitcoin.org’s “Some things you need to know” page. Services that accept bitcoin set their own policies, which may differ.

The “six confirmations” habit also shows up in software: the original Bitcoin client displayed a transaction as “n/unconfirmed” until six blocks had confirmed it ^[5]. Six is a convention that balances waiting time against risk, not a magic threshold where risk drops to zero.

Why does each extra block make a payment safer?#

The whitepaper models the danger directly. Suppose a dishonest sender pays you, then secretly mines an alternative chain in which the coins go back to themselves. To succeed, their chain must overtake the honest one. The paper treats this as a race and shows that the attacker’s chance of ever catching up falls exponentially with the number of blocks they are behind ^[2].

Computed by TokenTrail with the formula and C code published in section 11 of the Bitcoin whitepaper; the 10% values match the paper’s own table. Rounded.

Two lessons jump out. First, against a small attacker, risk shrinks very fast: each extra block cuts it by a large factor. Second, the attacker’s share of mining power matters enormously. The whitepaper lists how many blocks you would need to wait to push the attacker’s chance below 0.1%: 5 blocks against a 10% attacker, 24 against 30%, and 340 against 45% ^[2].

Blocks to wait for less than 0.1% attacker success

How long do confirmations take?#

Bitcoin targets one block every ten minutes, a value written into Bitcoin Core’s chain parameters ^[6]. But that is an average. bitcoin.org stresses that block discovery is probabilistic: an individual confirmation can arrive much sooner or much later, with no guaranteed minimum or maximum delay, and a transaction paying a below-market fee may wait considerably longer for its first one ^[1].

The clock starts when your transaction enters a block, not when you press send. If the fee is too low, the wait for the first confirmation can dwarf everything after it — see transaction fees explained.

What is block height, and how does it relate to confirmations?#

Blocks are numbered by block height: the number of blocks between a block and the first block, the genesis block, which has height 0 ^[4]. If your transaction is in block 900,000 and the newest block is 900,005, it has six confirmations. Note one subtlety: during a temporary fork, two different blocks can share the same height, so explorers identify blocks by their hash rather than by height ^[4]. See our block height entry.

Can a confirmed transaction lose its confirmations?#

Yes, occasionally. When two miners find a block at almost the same time, the chain briefly forks. Nodes follow whichever branch ends up with more proof of work, and blocks on the losing side become stale ^[4]. The Bitcoin Wiki explains that after such a reorganisation, the number of confirmations can change, and transactions not in the new chain become “0/unconfirmed” again ^[5]. Usually they are simply mined again in a later block.

Short forks like this are a normal part of how the network works, and each extra confirmation makes it less likely that your block ends up on the losing side. Forks are also why newly mined coins have their own waiting rule — coinbase outputs cannot be spent until 100 more blocks have been added ^[7].

Do other blockchains count confirmations the same way?#

Not exactly. Proof-of-stake Ethereum divides time into 12-second slots grouped into epochs of 32 slots, which works out to 6.4 minutes per epoch ^[8]. Instead of only counting blocks, it upgrades checkpoint blocks to “justified” and then “finalized” once validators holding two-thirds of the staked ether vote for them ^[9]. ethereum.org explains that reverting a finalized block would require an attacker to lose at least one-third of all staked ETH ^[8]. ethereum.org currently puts the wait at about 15 minutes for a block to finalize, with finality decided across two epochs ^[10]. A faster design called single slot finality is still in the research phase ^[10]. Exchanges and wallets on each network decide how long to wait based on these rules.

What mistakes do beginners make here?#

• Treating zero-confirmation payments as received

  Until it is in a block, the payment can be replaced or dropped. Accept it only from someone you trust, or wait.

• Waiting for six confirmations on a coffee

  The right number scales with what is at stake. bitcoin.org rates one confirmation as somewhat or mostly reliable and reserves six as the minimum for high-value transfers.

• Expecting exactly ten minutes per block

  Ten minutes is a target average. Gaps of a few seconds or over an hour both happen.

• Assuming confirmations can never go backwards

  A short chain reorganisation can briefly undo the newest confirmations. That is normal and is why deeper confirmation is safer.

Frequently asked questions#

The bottom line#

A confirmation is a block on top of your transaction, and each one makes rewriting your payment much harder. bitcoin.org’s guide — trust-only at zero, reasonably reliable at one to three, six for high-value transfers — is a sensible default, grounded in the whitepaper’s probability maths.

Decide by the amount at risk, remember that the ten-minute pace is only an average, and treat any unconfirmed payment as a promise rather than money. To see what happens before the first confirmation, read what is the mempool.

Sources#