: Once the exchange credits the account based on that one confirmation, the attacker withdraws the funds. Meanwhile, the rest of the network follows a different chain (where the original block was orphaned), and the transaction to the exchange is ultimately rejected as a double spend. Technical Context & Mitigation

: Most modern exchanges and Bitcoin services mitigate this by requiring three to six confirmations before funds are cleared, making the cost of maintaining the fake chain prohibitively expensive for an attacker. Key Characteristics

: The attacker connects to a well-connected node (like an exchange's node) and a mining pool. They mine a block containing a transaction that sends coins from Address A to Address B (both controlled by the attacker) but do not broadcast it immediately.

: The merchant/exchange loses the goods or currency, while the attacker retains their original Bitcoin on the main chain.

: Once the attacker finds a block, they quickly send a second transaction—sending the same coins from Address A to the exchange's Address C—directly to the exchange's node.