Adaptive Confirmation Rules under Diverted Hash Power: Bitcoin Double-Spend Protection

A merchant accepting a Bitcoin payment must decide how long to wait before treating it as settled. Beyond fixed confirmation counts, acceptance policies that also read the elapsed time have been proposed and evaluated numerically; this paper asks what such a policy can guarantee. When an attacker diverts hash power to a private branch, the public chain's block times lengthen. Diversion is an identification condition: an attacker who adds external capacity leaves no signal. The paper separates two notions often merged. A rule is coherent if, under its own model, the posterior probability of a double-spend stays below a tolerance; it is secure if the guarantee survives an opponent who chooses when to strike. A posterior rule is coherent, yet in simulation a fork opened at release defeats it. The elapsed-time rule, which accepts when the exact catch-up probability given depth and elapsed time falls below a budget, bounds by that budget the double-spend probability conditional on the public history at release, for every admissible strategy: intensity never above a bound, diversion before release reading only the public record, any onset, a post-release fork included. A fixed count instead bounds an average under an immediate attack. At a common numerical budget the elapsed-time rule waits less under normal operation, by an exact asymptotic factor that diverges as the attacker approaches half the hash power. Against a rational attacker its bound yields a certified deterrence floor which, at three of the four intensities studied, exceeds the cost of an explicit attack on the posterior rule. Under-estimating the attacker's intensity defeats every rule. All statements are internal to an idealised Poisson-race model.