Picture yourself watching a block explorer at 2 a.m., refreshing as a chain you thought was settled quietly grows a competing tip. Someone is rewriting history in real time. The question that actually matters in that moment is not whether a 51% attack is theoretically possible. It is what the attacker had to sacrifice to get there, and what happens to them if they lose.
Both proof-of-work and proof-of-stake systems have a threshold past which a single actor can rewrite history. But the economics of reaching and surviving that threshold are so different that treating them as equivalent is like comparing a bank robbery to a hostile corporate takeover. Same crime family, entirely different toolkit.
The bill you pay in PoW, and why it keeps arriving
In a proof-of-work system, attacking the network means acquiring hash rate (the raw computational power miners direct at solving blocks). That means either buying ASICs or renting them, and then paying the electricity bill every hour the attack runs. The cost is flow-based: it drains continuously, whether the attack succeeds or not.
Take Bitcoin as the clearest case. An attacker who assembles enough mining hardware to exceed 50% of the network's hash rate has to source that hardware against a market that largely serves existing miners, pay spot prices for electricity at industrial scale, and keep paying as long as the double-spend window requires. If the attack fails or gets detected, the equipment still has a secondary market value. The hardware does not vanish. But the electricity spent is simply gone.
That ongoing cost creates a specific economic structure: the longer the attack, the more expensive it becomes. The attacker's profit window has to outrun the accumulating cost. This is why 51% attacks on smaller PoW chains tend to be surgical, targeting specific exchanges with specific deposit confirmation windows, rather than prolonged chain rewrites. Ethereum Classic suffered three such attacks in a single month, each one timed to exploit a particular exchange's confirmation threshold before the cost of sustaining the attack outran the double-spend profit.
There is also a subtler point worth naming. The capital tied up in ASICs is external to the system being attacked. A successful double-spend on Bitcoin does not directly devalue the mining hardware. You can attack Bitcoin with ASICs and then, theoretically, point those ASICs elsewhere. The weapon survives the crime.
Staking changes the target into the weapon
Proof-of-stake flips this structure almost completely. To attack Ethereum, you need ETH. To get enough ETH to threaten the network's finality (its ability to make blocks irreversible), you have to buy it in the open market, which drives up its price against you as you accumulate. Your attack capital is denominated in the very asset you are threatening.
Consider a worked scenario. Suppose an attacker needs roughly one-third of all staked ETH to execute a liveness attack, meaning they prevent the chain from finalizing new blocks. As they accumulate that stake, they push the price up, making each subsequent unit more expensive. If they succeed and shake confidence in the network, the ETH they hold loses value. The attack is, to a meaningful degree, self-defeating in a way that buying hash rate simply is not. It is a little like a short-seller who has to keep buying shares to execute the trade that tanks the stock.
The more distinctive feature, though, is slashing. Most mature PoS implementations, including Ethereum's post-Merge design, include a protocol-level punishment for provably malicious behavior. Validators caught double-signing or attempting to finalize conflicting blocks have a portion of their staked capital destroyed outright. Not seized, not frozen. Burned. The attack capital is destroyed by the system being attacked.
Here is how that plays out concretely. Marco and Sarah each stake 32 ETH on the same day. Marco runs an honest validator for two years and earns rewards. Sarah's operation gets compromised and her client submits conflicting attestations. Sarah's stake gets slashed, and depending on how many validators are slashed in the same period, she could lose substantially more than a single infraction would cost in isolation. The correlation penalty scales with simultaneous failures, which means the protocol is specifically designed to make coordinated attacks, ones that require many validators misbehaving together, disproportionately expensive. The more dangerous the attack, the more it costs.
The honest caveat you do not hear often enough
None of this means PoS is categorically safer. The attack surface just sits in different places.
PoW's external capital requirement is a genuine security property: someone outside the ecosystem has to commit real-world resources. PoS internalizes everything, which makes large-scale attacks expensive but also means a sufficiently wealthy actor who already holds a large stake faces a lower marginal cost to attack than an outsider would. Long-range attacks, where an attacker with old private keys tries to rewrite history from a deep checkpoint, are a PoS-specific concern that simply does not exist in PoW. Ethereum addresses this with weak subjectivity checkpoints (periodic agreed-upon snapshots that nodes use to reject implausible reorgs). Other chains handle it differently, or not at all.
So which consensus model is actually more secure? Neither, in the abstract. That framing is the wrong question, and I think most people who argue it confidently have not thought carefully about their own threat model.
What you are really comparing is a system where attack costs are paid in external resources that persist after failure versus one where attack costs are paid in internal capital that the protocol can confiscate. The second structure makes casual, speculative attacks less rational. It does not make determined, well-capitalized attacks impossible. The social recovery layer matters in both cases too: both systems ultimately rely on honest nodes rejecting clearly invalid chains, and the community can, in extremis, coordinate a fork to nullify an attack. Messy and trust-dependent, yes. But present in both models.
The question worth sitting with is not which mechanism is better. It is which attacker you are actually trying to price out, and what you are willing to let the protocol destroy to do it.