"of a 51% attack", it's called a sybil attack

https://en.wikipedia.org/wiki/Sybil_attack

Btw, here's the alternative link https://xcancel.com/p3b7_/status/1955173413992984988

Going by the definition given in the wiki you’ve linked, a Sybil attack is about creating many fake identities to gain disproportionate influence in a network. A 51% attack in blockchain terms is specifically about controlling the majority of the network’s mining/staking power to override consensus.

So I'd say they're not exactly the same.

Someone amassing 51% of the network would probably want to do so under some fake identities so others don't realize what's about to happen. Not the same, but probably related.

Lol, there's no such thing as "fake identities" here. You just run more miners with different payout addresses for mining. But there is no "fake"

Post seems confused. A 51% attack doesn't allow the attacker to sign transactions with someone else's key.

You: "Post seems confused. A 51% attack doesn't allow the attacker to sign transactions with someone else's key."

Maybe you misread, the post says this: "With its current dominance, Qubic can rewrite the blockchain, enable double-spending, and censor any transaction."

All of which are possible if someone has that level of control, and none of which involve signing with other people's keys.

(As some people seem confused about the impact of 51% attacks: Of course you can't double-spend in a single blockchain, as that is prevented. But the nature of these attacks is that there's no longer one true blockchain. You can create one fork of the blockchain where you send the money to someone, receive goods in return, and then afterwards switch to a longer fork of the blockchain where the money was never sent.)

Doing this requires massive tangible infrastructure subject to seizure to pay your new bad debts as you become subject to arrest in a lot of the places one may want to spend time in.

This doesn't seem like as much of an actual risk. A better way to make money would be to create a perception that the value of the coin is at risk before buying it cheap.

Actually devaluing it doesn't seem worthwhile financially.

become subject to arrest in a lot of the places

I have an idea for a much cheaper way to store and transfer money that also relies on the existence of a police.

Unless I'm missing something, this doesn't pass the sniff test. If a 51% attack was successful, every other miner could easily spot this and would stop mining. The fact that this has not happened is more trustworthy than a random guy on Twitter.

Why would every other miner stop mining, making it a 100% attack?

Yesterday I was running a Monero node and looking at it, and got an unusually very high number of chain reorganization messages. I could believe a 51% attack happened.

A network might collectively just fork the chain and blacklist the attacker in that fork.

That isn't possible - miners don't have an "identity" to blacklist.

You could do it with a whitelist. If there is a fork, give disproportionate weight to blocks mined by a whitelisted participant when doing the longest-chain calculation. Ideally you should include the proof of being on the whitelist in the block itself, but if that's not possible for some reason you could always send the information off-chain.

That's centralization, which is the opposite of what's intended and has its own risks. Most blocks are mined by pools, so you'll have to whitelist them, and while you might trust the pool operators now, will you forever? You'll be making the cost of an attack significantly cheaper for them (or someone who steals their magic key, or tricks you into adding them to the blessed list).

I agree that it is not ideal. But addressing some of the specific point brought up:

1. a) The list doesn't need to be hardcoded, it could be a configuration. b) So trust doesn't need to be permanent. c) It could be decentralized in the sense of allowing different people to have configs 2. Miners not on the list can still participate just with lower weight in the case of a fork. And they still get full reward.

1. A cryptocurrency requires consensus, so no, you can't have different configs for determining the validity of a chain. Making it a config variable only makes it faster to close the barn door after the horse has bolted. 2. Has no bearing on any point I made.

What will likely happen is a PoS BFT layer on top of PoW, although there are other options being considered:

https://github.com/monero-project/research-lab/issues/136

I am way OOTL with crypto drama.

Anyone have any context about who Qubic are, and what their deal is?

It's a long story, I wrote a blog about it here: https://rdrama.net/h/slackernews/post/385556/chud-chudsmug-u...

Qubix(group performing attack) founder x post

https://x.com/c___f___b/status/1955158154213220492

This man is a true poet, just beautiful look at this quote found on his exTwitter:

(quote starts here)

"""Writing this date here to memorize when the concept of Decentralized Artificial Intelligence (#DAI) got its final shape.

Not bullshit like "It runs on a #blockchain so it must be decentralized". In this concept each entity holds a secret know-how which modifies #IntelligentTissue (in cooperation with other know-hows owned by other entities, if needs to solve a complex task). Secrecy of each know-how ensures nobody can copy it, others can only attempt to create something similar by spending computational resources.

Each #AI is an original object, #IntelligentTissue is its hologram. #Qubic is the platform for AI creation, their convergence and intelligent tissue hosting"""

Psychosis or marketing scheme? Who can even tell the difference anymore...

To summarise:

* One actor in the space appears to have done a proof of concept takeover of 51%.

* It’s not clear there was any malicious action nor intent in doing so.

* Performing something like this is definitely expensive.

* The potential impact of doing so is disputed.

* Whether or not it was achieved is also disputed

However, what has been known you some time is that the largest BitCoin miners have more power than the entire community of many alt-coins. Whether this is an issue is a matter for debate. Certainly, until now, no-one has chosen to flex like this.

until now, no-one has chosen to flex like this.

The two networks have wildly different proof-of-work algorithms, they're incompatible. A BTC ASIC will never mine Monero, ever.

That's not true for all altcoins however

Pretty much everything other than bitcoin, monero, and dogecoin are running proof of stake these days anyhow, so it kind of doesn't matter.

That's not at all relevant to parent post's point. BTC mining is famously centralized, and continues to get more so. It is inevitable that a manufacturer of BTC asics with access to cheap power will become large enough to control 51% of the hash. It's inevitable. It's bad system design - it makes being able to manufacture your own custom silicon table stakes to run a financial system for some reason.

BTC will have to move to a proof of stake design to survive. It's unavoidable.

That is debatable, but also besides anything else, changing to PoS means changing the tokenomics (some tail emission for staking rewards, no 21m hard cap), which means it's incredibly unlikely to happen

why would staking rewards be any more necessary than mining rewards?

In the end state (after ~2140), mining rewards just come from TX fees. But true, it is possible you could just redistribute TX fees to stakers.

Post-merge ethereum is designed so that the gas fees and the staking rewards roughly cancel out on balance (so overall inflation is around zero), but they are decoupled so even if nobody is using the network you still get a staking yield

so overall inflation is around zero

Pedantic point: monetary inflation is around zero, not necessarily price inflation (which is what people typically mean when they just say "inflation").

It is inevitable that a manufacturer of BTC asics with access to cheap power will become large enough to control 51% of the hash

The ASIC manufacturer would also need a backdoor. ASIC manufacturers don't control mining.

Large miners are unlikely to allow backdoors into their mining network.

BTC can't move to proof of stake because religious zealots would keep their money in the old fork.

It's doomed in general, see the cash fork.

I ask this not as a gotcha (I don't know the first thing about this), but rather because I'm interested: How do you know not "ever"?

Like, trivially, it's an ASIC, so I can use it to simulate a von Neumann[*] machine, hence I can use it to run whatever algorithm I want. Would that be more efficient than using a modern OoO superscalar? Almost surely not, but that doesn't mean it can't be done, just that it shouldn't be done that way.

*: I realize that the ASICs used in Bitcoin miners don't have dram access, but that isn't a general limitation of ASICs, just those ASIC 'chips' (and maybe not even those chips, just their implementations in bitcoin miners)

EDIT: Thanks to everyone who answered! For some reason, I had it in my head that the way we implement fixed function stuff in an ASIC was basically the same as a "burn once" FPGA. Brains gonna brain.

In all seriousness, can you explain why the "impact of doing so is disputed". In my laypersons understanding, if you control ~51% of the hashrate you can outpace everyone else in producing blocks, which means you can change (reorganize) your blockchain history which means the ledger isn't trustworthy. Right?

That's the point, you can only change YOUR history. From the perspective of future merchant, that's the trivial to deal with. And for existing transactions, you'd need the value of the goods from the transactions to exceed the cost of controlling to network to be worth it. But what kind of goods that can be transferred so quickly be worth that much?

Maybe there's more resilience to prevent chain swaps now, but my understanding of the original blockchain algorithm is that:

At block N someone could start to privately mine (empty) blocks.

They keep mining in private until block N+x is public, at which time the private (51%) chain is length N+x+1.

They then announce their longer chain.

By the protocol, this longer chain (technically "most work" chain) is the more trusted one, and undoes any transactions in N+1 through N+x.

More or less, but the private chain doesn't need to contain empty blocks.

A more sophisticated attack would include all the legitimate transactions on the network except for their own transaction(s) which they're trying to double spend. That way the network isn't disrupted apart from the parties you're double spending against.

That way you can also claim 100% of mining rewards with 51% hash rate.

How? If that were true you’d also be able to get 50% of block chain rewards with 25.1% of the hashing power. But you can’t because it isn’t true.

It's worth being precise here:

- The attacker can doublespend their transactions if their hashing power is high enough to create more blocks than what the recipient is waiting for. E.g. you buy a lambo, the shop waits 10 blocks after the tx is in a block and gives you the lambo, then you create a longer chain with 11 blocks to replace the other one, and don't include the original lambo tx. 51% of hashing power is enough to create new blocks, but not enough to create 11 alternative blocks. That requires more hashing power.

- The attacker can prevent other transactions from landing in a block, as long as they have majority

- But the attacker can't create fake transactions (e.g. if they only have 1k Monero, they can't create a tx with 2k Monero). Because all nodes (not only miners) still verify the transactions

- And the attacker can also not steal your money, because they don't have your private keys

In my head I kind of simplified it - if I can reorder the blocks in my history I can "reverse" a transaction, like "erase" that I bought a lambo yesterday so today I have not only the lambo, but the money that was in my account before I bought the lambo, too. But maybe me trying to over simplify and missing the forest for the trees (this is very much not my domain).

Newb question, but why's it expensive, aren't they mining the whole time and can therefore make the usual money from that mining?

"Performing something like this is definitely expensive"

That is false. A 51% attack is only expensive to the degree to which the hashpower required to exceed 50% is obtained at negative margins.

If an attacker can collect the total 51% or more hashpower at what would be a profitable rate despite the attack, then the attack is not "definitely expensive" - no, the attack is definitely profitable and the expense falls sorely on the minority.

Just because something is profitable doesn't mean it's not expensive, which only means it costs a lot of money.

Or, you need to spend a lot of resources to do the attack even if it's the case that you get that money back when you succeed. And the attack is not available to you if you can't front those resources (because it's expensive rather than cheap).

Or, you need to spend a lot of resources to do the attack even if it's the case that you get that money back when you succeed.

There is a word for this. We call it risk.

I'm not sure I'd call this risk. Risk would be "you can invest the money, but you might not get it back" however the above is referring to the "a 51% attack absolutely works but you need a shit ton of money to do it" aspect instead. This makes it capital intensive, not (necessarily) risky.

The fact that it succeeds does not mean that you get the money back (eg the price of monero could drop if that happens). You may also have miscalculated some parameters in all this or something unexpected happens (where human factor is involved). So there should always be risk involved imo. Otherwise I agree, even in a probability 1 success situation this would still not be called "cheap".

Having the power to deny others to mine blocks does not mean that you can obtain the tokens from their wallets. Miners can't sign transactions on users' behalf. You can rewrite all of history but then no exchange will accept your version of it to let you exchange the tokens for fiat. Also this will almost certainly crash the price of XMR substantially. And later people will be able to fork/restore the original version. The technological side of the blockchain is only part of the consensus/trust/market/popularity. People are the other part, and people will not pay the attacker for their successful attack.

The attacker doesn't need to steal tokens. They just need to short the token while they sufficiently disrupt the network to drive down the price. They get the money and your tokens become worthless.

Controlling 51% of XMR costs ~$30M per day, you'd have to short a huge amount of XMR to make that worthwhile. Who would be the counter party and how would you do that anonymously?

The attack itself is unprofitable, the "profit" for Qubic is the publicity they get. (or at least that's what they're betting on)

It is absolutely risky. Your facilities can burn down once the ASICs arrive and before they are turned on, or your employees simply steal them for their own uses. Heck, you can have a fire once they get powered-on, because a power cable was poorly made. You might get sent the wrong product, or you could be ghosted without a delivery.

Expensive is a better fit than capital intensive, because there are massive ongoing costs to actually perform the attack, electricity for one.

If you want to understand the risks for a project, pretend you are at arms length and are being asked to fund the project 100% up-front. You'll find a huge list of risks very soon.

surely the fall in value of XMR caused by such an attack would make it unprofitable as well

You could just short XMR heavily and profit that way.

You can only do that on centralized exchanges, which would mean that you effectively doxx yourself by shorting. Also the exchange will most probably seize your funds before you are able to withdraw them.

Not sure how are you doxxing yourself, what stopping me from YOLOing my life savings into this short after reading a few comments in this thread?

You'd have to spend $30M per day in order to control 51% of XMR, and then you'd YOLO your life savings (which would have to be another couple hundred million dollars) on centralized exchanges without anyone noticing?

Unless they drive the price into the ground.

Right? If an attack like this is successful _and_ obvious/detectable, then it _should_ drive the price into the ground.

Whether this is an issue is a matter for debate.

Monero uses RandomX, which is intentionally chosen to make it difficult to accelerate using hardware that is common with other coins. It’s almost certainly not what happened here.

CPU was a terrible choice.

why? what's better?

It would be interesting if a "coin" were tied to protein folding prediction or something else useful.

Proof-of-Work fails if the work has value.

why?

I don't think it's true, look up Proof of Useful Work

In Proof-of-Work the cost of the work is what keeps the network honest. If the work has value then an attacker is free to invest as many resources as I want into subverting the network. Even a failed attack can still be profitable, just less so.

In another scenario, where the works value is less then the cost you're still hoping that at no point in the future will an attacker figure out a way to do the work at a net profit.

The only way the network can be trusted is if the work has definitely now and always, 0 value.

Disclaimer: ran a 150k GPU eth mining operation

PoS is the obvious choice now that ETH has had a bit of time to run. But, I remember when they went through the switch (before ETH PoS). Doing some sort of variation on GPU memory hard mining would have been a smart choice (ethash, progpow, etc), knowing full well that ETH would eventually go PoS. It would have given all the miners something to switch to, instead of just shutting down entirely, because there wasn't anything but ghost chains.

I'm still a fan of PoW. PoS incentivizes centralization.

Hilariously posting in a thread about a 51% attack happening, because of miner centralization.

It's mainly an argument against CPU/GPU mining. If you have invested in specialized hardware that can mine only one coin, you're strongly incentivized to protect trust in that coin. An attacker like Qubic would need to pay you a lot more than they need to pay a CPU miner.

No one is spending $75M a day to do a proof of concept. There's obviously some kind of intent to profit.

https://xcancel.com/p3b7_/status/1955173413992984988

https://nitter.net/tuxpizza/status/1955191610410401816#m

Looks like they are winning.

Looking at that website I see that the unknown pool keeps getting a longer chain and it switches to it

100% a fed action. Government influence has been pushing Monero off of exchanges and now this. Why? Because Monero has true anonymity.

Interesting, I don’t disagree but would like to learn more.

If you exchange Bitcoin for cash, the IRS can retroactively look at every wallet that this money originated through. If they decide that they don’t like how certain coins were earned, they can mark them and any wallet they touched as poisoned, and put you in jail if you try to exchange them further.

Monero transactions are inherently obfuscated, which solves this problem. If you want more details, the Monero whitepaper is well written to be accessible for the common reader.

The tldr is it works atop ring signatures: https://en.m.wikipedia.org/wiki/Ring_signature

Monero transactions are inherently obfuscated, which solves this problem.

It solves the problem by making all participants culpable. The blockchain community is very good at imagining they have technical solutions to social problems.

By your logic, anyone using cash would be culpable for illegal transactions. Same with VPNs/Tor.

I think speech is not the same money, and that any kind of property you expect others to respect comes with obligations. Why should I respect your property claims if you can't show me you didn't steal your property?

But that's really beside the point, because it isn't me who will come after you, it's the IRS (or equivalent). If you spend a lot of money, you're in trouble if you can't explain how you got it. And if you explain that you participated in a network which has as its only purpose to destroy evidence of how you got it, you're usually in extra big trouble.

There's a little bar in Cupertino, Paul & Eddie's Monta Vista Inn. They only accept cash. Should they be shut down and have their assets seized? After all, what possible reason could they have to operate as cash only, in Silicon Valley, other than that they want to destroy evidence of how they earned it?

What is qubic offering to miners that other pools can't?

Much better link - https://www.cointribune.com/en/qubic-hits-52-72-of-moneros-t...

Appears to be legit, but not really a nefarious attack.

This is odd. The current hash rate is around its nominal 5 GH/s, and neither any pool nor individual seems to be above 50%:

https://miningpoolstats.stream/monero

This Qubic group claims to concentrate 3 GH/s of hashing power, yet there has been no increase in the global hash rate either:

https://www.coinwarz.com/mining/monero/hashrate-chart

Could this be just a bait?

dumb question: i took a look at https://miningpoolstats.stream/ethereumclassic for ethereumclassic and f2pool.com seems to have ~64% of the total hashrate... is that a takeover as well ?

Sustaining this attack is estimated to cost $75 million per day.

This is how proof of work systems operate.

They are very expensive to attack but very cheap to recover from.

$75m per day is clearly unstainable.

Soon they will give up and the network will recover cheaply.

The attack is more of a nuisance than the end of Monero.

$75m per day is clearly sustainable.

Is this a typo or am I misunderstanding something?

Thanks.

"unsustainable"

Depends what the goal is. A state that wants to break the anonymity of the system doesn't care about $75m per day, specifically a state that can just print that...

The problem is not that the system is constantly under attack. It's that it can no longer be trusted to be secure. Nobody with money on chain will say 'oh well, probably nobody will steal my money today'.

A 51% attack doesn't let you steal random people's money.

It absolutely does, just not directly. Say that you have 100k fiat equivilent in monero and I demonstrate a successful monero double-spend attack. How much do you think your monero is worth?

My man. What do you think the word "steal" means? You can't just redefine words because you don't like new technology.

Do we need to drop down to 1st grade story problems?

---

Alice has 1 apple. Eve has 0 apples.

Eve steals Alice's apple.

Now Alice has 0 apples. Eve has 1 apple.

---

Alice has 1 XMR. Eve has 0 XMR.

Eve 51% attacks Alice's network.

How many XMR does Alice have? How many XMR does Eve have? Show your work.

The only reason this seems like an unusual definition to you is that you haven't thought about it very hard, yet. The critical thing is not how many XMR you have. It's what value those XMR carry. If I create from thin air 1000 XMR and it's known to the market I didn't just 'make' a certain amount of value, I made myself richer by making a lot of people less so. I stole value from them and gave it to myself, just like someone stealing a ham at the market. The only difference is that instead of burning one ham of value for one ham of benefit, I burn many ham of value for one ham of benefit.

A 6 re-org does not mean a '51% attack' was successful. In that case, we'd see unbounded-depth re-orgs/no blocks mined by any other mining pool (assuming the adversary censors other mining pools, as this one does).

It does mean an adversary with a high amount of hash got lucky. I noted there's a discrepancy between their claimed network hashrate and pools' claimed network hash rate.

They may not be including their own hash rate in the network's, in which case they'd need to exceed it. Having 51% would only be 34% of total.

They're an unreliable narrator and I wouldn't trust any data from them. There's insufficient evidence to claim they have 51% of the network's hash power.

(https://nitter.net/kayabaNerve/with_replies)

Qubic never actually hit 51% btw. Don't fall for it.

However they do have a large enough hashrate to perform multi-block re-orgs with their selfish mining strategy.

They disabled API hashrate reporting so that they could lie about it.

Keep mining and ignore the noise.

(https://nitter.net/tuxpizza/status/1955191610410401816#m)

I am not that well versed in crypto. I understand the concept of a blockchain and what an n block reorg is, but what is the downside of a reorg? Like who can profit financially and why?

who are "they" you're talking about?

"They" refers to Qubic (by Sergey Ivancheglo), a blockchain network that uses a "Useful Proof-of-Work" system, so it is not built for traditional cryptocurrency mining that solves arbitrary puzzles. Instead, it uses the collective processing power of its miners to train an AI. Qubic's AI-training work is performed by CPUs, same as used by RandomX (Monero's mining algo).

Qubic was able to orchestrate its network of miners to temporarily halt their AI-related tasks and redirect their collective CPU power to mine on the Monero network instead.

Also, Qubic has implemented an economic strategy that involves selling the Monero it mines for a stablecoin like USDT and then using those funds to benefit its own ecosystem and attract more miners, and renting hardware to gain more hash power. The proceeds from the sale of XMR are used to buy Qubic's native token (QUBIC) from exchanges. These purchased tokens are then "burned" or permanently removed from circulation.

What's their objective?

My guess would be to turn the crank of a ponzi scheme until it falls off.

However,

Qubic's AI-training work is performed by CPUs, same as used by RandomX (Monero's mining algo).

I don't understand how this makes any sense at all.

I've looked into the "source code", and it doesn't. There is no such thing as useful PoW. Qubic isn't actually a decentralized cryptocurrency. It's closed source, runs as a EFI executable, and is only accessible from their discord channel.

The attack is no different than paying miners to join a malicious pool. It works as long as money flows in.

There is such a thing as useful proof of work. Qubic may not be doing it but it does exist. The linked papers [1][2] are examples of way to do it. They aren't 100% "useful" but rather achieve partial efficiency by essentially forcing miners down random paths in a manner that limits the ability to complete work ahead of time or otherwise "cheat".

1. https://eprint.iacr.org/2021/1379

2. https://eprint.iacr.org/2023/1059

Proof of useful work feels like it's one and a half steps removed from discovering seigniorage and reinventing money.

There is such a thing as useful proof of work.

Not really-- or, rather, the security provided by proof of work is only proportional to the part of the cost above the fair value of the useful work.

One of the main idea behind POW security is that you spend energy and the thing you get for it is income in the blockchain. And so if you mine unfaithfully your work will end up on a chain of debased value or won't end up in the eventual consensus chain at all.. so your effort is burnt out.

Now imagine a POW that costs $5 in energy and does $5 in "useful work" --- well in that system you can now attack for 'free'. Or say it costs $6 in energy to mine plus due $5 in "useful work". There your security is related to the $1, the $5 is mostly coming along for a ride.

There are other problems with "useful" proof of work: e.g. A POW function should ideally be approximation free and optimization free... if an attacker invents a better version they gain an advantage. So e.g. if the miner detects that this particular work instance is 'hard' they can just discard it and try another. This makes it really hard to do much of anything 'useful' except the most contrived kinds of 'useful' without creating vulnerabilities.

But difficulties aside, the fact that outside benefits don't contribute to security (or at least don't contribute much) makes the whole idea space kind of unexciting.

What's a "6 re-org"?

I'm a little rusty with the terminology, but in a blockchain, the canonical current block is the one that has the greatest amount of proof of work (I think they call this the heaviest chain). Typically, each new block is the descendant of the most recent block. But it is possible to create a heavier chain from an earlier block. This invalidates any transactions on what was previously known to be the heaviest chain, and is called a reorg.

The farther back, the less likely a reorg is, so to have a reorg that invalidates is blocks is extremely unusual.

If one entity has a majority of the hash power, they gain the ability to try to force reorgs with a likelihood that increases with their advantage in hash power.

I typed all this before realizing I could have recommend you ask an LLM, and it probably would have given you a better answer.

This was a great answer. I'm glad you spent the time on it. Though I am curious what the 6 indicates.

I typed all this before realizing I could have recommend you ask an LLM, and it probably would have given you a better answer.

Please don't. This would be useless spam, and is completely rude. Do we tell people to "Just google it?" here?

America would be screwed if owning 51% of its value meant you could rewrite ownership.

*gestures wildly*

Good thing you need 30 percent, a larger number

Didn't know ChatGPT was on HN

The thing about 51% attacks is they're hard to pull off in secret. And once they happen, who's going to accept the coin anymore? Plenty of potential for sheer destruction, but it seems pretty counter-productive to value.

Maybe destruction is their goal.

If only someone offered derivatives contracts that could be used to make money from destruction...

https://www.kraken.com/en-ca/features/derivatives/monero

Yeah, but the moment that happens they will confiscate/block the funds of the shorters.

Based on which specific law or rule?

Unknown crypto vulnerabilities and 51% attacks are crypto currency risks that are theoretically out there, but we mostly haven't seen play out.

At some point, someone doing AI might amass enough GPUs to do a 51% attack on Bitcoin. You're right that it destroys confidence in the coin, so if you short Bitcoin futures before the attack, you might make money.

Monero has been under constant attack from its inception. It’s one of the only truly anonymous, untraceable payment systems so there has been a huge push to make it unviable. It was unexplainably delisted from major crypto exchanges in the past and now is under direct attack.

A couple researchers have told me that it's not necessary to even reach 51%. It's probably something closer to 35% to maintain the ability to perform censorship etc

Not quite. You can make selfish mining economically viable below 51%, which eats into the profitability of the majority, but it's not possible to sustain a long term censorship attack with that.

With PoS protocols, >33% is usually when you have the ability to inhibit finality, which may be what you're thinking of.

they ran numbers on it. Do you have any references to support what you're saying?

You are not only appealing to the imaginary authority of someone that you talked to while demanding that someone else cite sources, but you also seem neither to understand the subject you're talking about nor able to accurately recall the hearsay you're offering as evidence. When you are lost in the woods, seek out a map!

One of the major things that has always bothered me about crypto: if an economically "irrational" large player wanted to 51% something like Bitcoin, they could.

I am thinking of, for example, a nation-state. Let's say the US, EU, or China decided for some reason that it was in their national interest to blow up Bitcoin. This could happen if an adversary like Russia or its allies were using Bitcoin for funding and there was a war or a major Cold War style struggle. Such players could afford to purchase and build, in secret, a huge mining farm, and then suddenly turn it on, not caring about the cost because the goals are strategic. It would be massively expensive but it doesn't matter for this case.

The moment anyone does this, people will notice, and the coin plummets.

Which is what they want.

at 75 million a day what is the motive?

A more economical version of the same thing is to engage in honest mining through several front companies that together have 51%. Until a strategic opportunity presents itself and they start colluding.

Sure, and this is well within the capabilities of any competent large intelligence agency.

It's only a secure system if adversaries are either small or economically rational.

State entities can also destroy real banks with all sorts of means if they really want. The vulnerability is real, but beyond the scope of discussion because then it's war we're talking about.

What really happens to a crypto coin if trust in the ledger is shattered?

Does the coin stay alive purely because people still speculate on hype or does everyone try to cash out simultaneously and send price into a death spiral?