Re-org

A re-org happens when nodes on the Bitcoin network become aware of a competing chain that has more accumulated proof-of-work than the one they are currently following. Bitcoin's consensus rule is simple: always follow the chain with the most work. When a longer chain appears, nodes drop their current tip and reorganize to the new chain, reversing any blocks that were on the old branch. Transactions that were confirmed on the old branch but not included in the new chain return to the mempool as unconfirmed.

Small re-orgs of one or two blocks are a routine occurrence and essentially the same mechanism as orphan blocks: two competing blocks found at the same height, with the network briefly split before converging. Deeper re-orgs involving many blocks are far rarer and typically signal either a network partition (where nodes were unable to communicate for a period) or a deliberate attack. A sufficiently large re-org could theoretically reverse transactions that appeared finalized, which is why the common recommendation is to wait for six confirmations before treating a transaction as settled.

The six-confirmation convention comes from the probabilistic difficulty of executing a re-org. Each additional confirmation on top of a transaction means an attacker would need to redo that block's worth of proof-of-work plus produce future blocks faster than the honest network. With six confirmations, reversing a transaction would require an attacker to control a majority of the network's hashrate for an extended period, making the cost economically prohibitive under normal conditions.