A 51% attack is priced wrong in almost every conversation I have about it. The number people quote is the price of hardware. The number that matters is the price of an hour.
The naive number
Count the network’s hashpower. Price the mining rigs that produce it. Add electricity, cooling, and a warehouse. For Ethereum Classic in May 2018 that arithmetic ran to tens of millions of dollars, and the comfortable conclusion followed: nobody would pay it. The mistake sits in the first step. You do not have to own hashpower to direct it.
The rented number
Hashpower became a commodity with an hourly rate. Marketplaces list Ethash capacity like a menu; cloud-mining contracts fill in the rest. Renting turned the attacker’s capital expense into an operating expense. My estimate, at May 2018 prices: about US$1.5 million to run a working attack end to end — rent the power, mine a private chain, release it, collect. No warehouse. No hardware on anyone’s books. When you are done, you hand the power back.
Proof-of-work is a market. Whatever a market sells, an attacker can rent.
The trade
The attack pays twice. Once in the double-spend itself: deposit on an exchange, trade out, withdraw, then rewrite the history that contained the deposit. And once in the short position opened before the first block, because news of a successful 51% attack does the selling for you. The revenue side clears seven figures. The cost side is a rental invoice.
Why publish
Every ingredient here was already public; I published an estimate, not a manual. A risk nobody prices is a risk nobody fixes. Security budgets should be compared against rental markets, not hardware catalogs. Rindex came out of the same question — how much attack can a chain absorb before the economics tip.
What happened next
2019-01-05 — Ethereum Classic was 51%-attacked. Deep reorganizations rewrote confirmed history; roughly US$1.1 million was double-spent. Coinbase paused ETC transactions. The rented number was the right number.