How Many Bitcoin Confirmations Is Safe? A Practical Guide

A Bitcoin confirmation is the network's way of saying a transaction has been buried under proof of work. Understanding how many you need keeps you from either releasing goods too early or making a customer wait far longer than the risk justifies.

What is a Bitcoin confirmation?

A confirmation is a block that includes your transaction, or is built on top of the block that did. When a transaction is first broadcast it sits in the mempool, unconfirmed. Once a miner includes it in a block, it has one confirmation. Every subsequent block mined on top adds another, because to undo your transaction an attacker would now have to redo that block and every block after it, out-pacing the entire honest network. That accumulating proof of work is exactly what makes a settled Bitcoin payment hard to reverse.

How long does one confirmation take?

One confirmation takes about ten minutes on average, because that is the interval the network targets between blocks, but it varies. Block times are random: the next block might arrive in two minutes or in forty, and mining difficulty only adjusts every two weeks to pull the long-run average back toward ten minutes. Your transaction also has to be picked up in the first place, which depends on the fee you attached relative to the mempool. Attach too low a fee when the mempool is busy and you may wait through several blocks before you get even the first confirmation, so it pays to know how to read the Bitcoin mempool before you set one. Six confirmations therefore average about an hour, but treat that as a rough figure, not a clock.

How many confirmations is safe?

The safe number scales with the value at stake, because more confirmations mean exponentially lower odds of a reversal. This is the practical rule of thumb most of the industry converged on:

Six became the default because after six blocks the probability that an attacker with a minority of hash power reverses the transaction drops to a fraction of a percent, low enough that the industry treated it as settled. For very large institutional transfers, some desks wait longer still.

Why do exchanges require different numbers?

Exchanges set their own thresholds based on the amount and their own risk appetite, which is why one platform credits a deposit after one confirmation and another makes you wait for six. A service moving large volumes has more to lose from a reversed deposit, so it waits for more proof of work. Some also raise their requirement temporarily after a network event or during unusual conditions. If you are waiting on a deposit, the exchange's own support page is the authority on how many confirmations it needs, and that number is a policy choice, not a property of the transaction itself.

Can a confirmed Bitcoin transaction be reversed?

In practice, no: once a transaction has a few confirmations it is treated as final, and reversing it would require an attacker to out-mine the entire honest network to rebuild the chain, which is prohibitively expensive. The theoretical exception is a very deep chain reorganization or a 51% attack, but on the main Bitcoin network with one confirmation that is already extremely unlikely, and by six it is negligible for any realistic adversary. This is different from an unconfirmed transaction, which can still be replaced (for example via replace-by-fee) until it lands in a block. That is why "wait for confirmations" is the universal advice before treating a payment as done.

How do you track confirmations programmatically?

You track confirmations by watching the transaction and comparing the block it landed in against the current chain tip: confirmations equal the tip height minus the transaction's block height, plus one. Rather than poll for that, most services subscribe to a webhook and set a confirmation threshold, so they get a callback the moment a payment reaches, say, three confirmations, the pattern we walk through in Bitcoin transaction notifications without a node. A Bitcoin webhook API handles exactly this, and a Bitcoin transaction API returns the current confirmation count for any txid on demand. For a merchant, that is the trigger to release goods and record the sale, and once the payment is settled you can turn those records into clean financial statements at the end of the period. Watching the mempool first also tells you a payment is on its way before the first block lands.

Match the wait to the money. One confirmation clears the bar for ordinary payments; six is the trusted standard for anything large; and for the smallest, lowest-risk amounts a well-propagated unconfirmed transaction is often fine. When in doubt, wait for one more block.