user131971: Let's say that the computational power from the genesis block to the current block becomes a trivial computation in the future by some supercomputer using a new technology exclusive to it. Perhaps this is a government funded secret project using a niche quantum computing algorithm or some other esoteric technology at the time that the rest of the world is oblivious to.
At this point, couldn't this supercomputer simply create a longer "fake" chain from the genesis block than the current Bitcoin blockchain, and broadcast this to all nodes as the valid chain to accept since it's the longest, thus invaliding all transaction since the genesis block?

user5406: Yes, it is a fundamental security assumption that the majority of the hashrate on the network is honest, where honest means "not collaborating to attack".
Assuming an antagonist with overwhelming hashrate appeared out of nowhere, this antagonist would be able to perform majority attacks at will against the Bitcoin network. The attacker could for example be able to censor transactions, prevent other miners from earning revenue, doublespend own funds by replacing already confirmed transactions, or drive up the difficulty and stop mining to slow down the network for everyone else. Replacing the whole blockchain from the genesis block would not be possible, because there are a few checkpoints protecting the first few years of the blockchain against changes. However, it would be possible to replace all blocks after last checkpoint at height 295 000. Either way, that would be more of a sledgehammer approach, which may be less attractive depending on the goals of the attacker.
Under the existing consensus rules, there is no effective defense against this, because the attacker could simply restart their attack at a different height if people rallied to reject the attacker blocks. The Bitcoin project would probably be considered failed, or devolve into some construct where the best chain is selected per social consensus, which could be argued to also be a failed state, but sounds plausible.
However, this sort of scenario is unlikely to come to pass. Bitcoin's proof-of-work is based on the SHA-256 hashing algorithm. Today, mining uses dedicated hardware, so called Application Specific Integrated Circuits or ASICs which have the hashing operations implemented directly on the silicon and can only perform SHA-256d hashes. Regular computing power is many magnitudes less performant and energy-efficient, so all supercomputers and general computers taken together wouldn't hold a candle against the existing hashrate on the Bitcoin network. Hashing is also quantum resistant, so this frequent boogieman also doesn't perturb us. This seems to leave the attacker only with the option to design their own designated hardware, get one or more silicon foundries to secretly produce it, and then to end up with enough chips to overwhelm the whole network. Such a massive majority attack would more likely than not fundamentally undermine trust in Bitcoin, tanking its value, at which point the attacker is sitting on hundreds of million dollars worth of very expensive paperweights.—It seems non-trivial to come up with these sort of funds just to essentially burn them or to make enough money off shorting Bitcoin to make such an attack worth it, beside the challenging logistics of pulling it off in the first place.

131971: <p>Let's say that the computational power from the genesis block to the current block becomes a trivial computation in the future by some supercomputer using a new technology exclusive to it. Perhaps this is a government funded secret project using a niche quantum computing algorithm or some other esoteric technology at the time that the rest of the world is oblivious to.</p>
<p>At this point, couldn't this supercomputer simply create a longer &quot;fake&quot; chain from the genesis block than the current Bitcoin blockchain, and broadcast this to all nodes as the valid chain to accept since it's the longest, thus invaliding all transaction since the genesis block?</p>
 5406: <p>Yes, it is a fundamental security assumption that the majority of the hashrate on the network is honest, where honest means &quot;not collaborating to attack&quot;.</p>
<p>Assuming an antagonist with overwhelming hashrate appeared out of nowhere, this antagonist would be able to perform majority attacks at will against the Bitcoin network. The attacker could for example be able to censor transactions, prevent other miners from earning revenue, doublespend own funds by replacing already confirmed transactions, or drive up the difficulty and stop mining to slow down the network for everyone else. Replacing the whole blockchain from the genesis block would not be possible, because there are a few <a href="https://bitcoin.stackexchange.com/q/3114/5406">checkpoints</a> protecting the first few years of the blockchain against changes. However, it would be possible to replace all blocks after last checkpoint at height 295 000. Either way, that would be more of a sledgehammer approach, which may be less attractive depending on the goals of the attacker.</p>
<p>Under the existing consensus rules, there is no effective defense against this, because the attacker could simply restart their attack at a different height if people rallied to reject the attacker blocks. The Bitcoin project would probably be considered failed, or devolve into some construct where the best chain is selected per social consensus, which could be argued to also be a failed state, but <a href="https://gist.github.com/fernandonm/ef9721bacf7284e039caf39ba2a07258" rel="nofollow noreferrer">sounds plausible</a>.</p>
<p>However, this sort of scenario is unlikely to come to pass. Bitcoin's proof-of-work is based on the SHA-256 hashing algorithm. Today, mining uses dedicated hardware, so called Application Specific Integrated Circuits or ASICs which have the hashing operations implemented directly on the silicon and can only perform SHA-256d hashes. Regular computing power is many magnitudes less performant and energy-efficient, so all supercomputers and general computers taken together wouldn't hold a candle against the existing hashrate on the Bitcoin network. Hashing is also quantum resistant, so this frequent boogieman also doesn't perturb us. This seems to leave the attacker only with the option to design their own designated hardware, get one or more silicon foundries to secretly produce it, and then to end up with enough chips to overwhelm the whole network. Such a massive majority attack would more likely than not fundamentally undermine trust in Bitcoin, tanking its value, at which point the attacker is sitting on hundreds of million dollars worth of very expensive paperweights.—It seems non-trivial to come up with these sort of funds just to essentially burn them or to make enough money off shorting Bitcoin to make such an attack worth it, beside the challenging logistics of pulling it off in the first place.</p>
