What is a confirmation?

When you send bitcoin, the transaction first waits in nodes’ mempools, unconfirmed. Once a miner includes it in a block, it has one confirmation. Every block mined on top of that one adds another. The count tells you how deep the payment is buried.

Unconfirmed is not final

Until it is in a block, a payment can still change. Since Bitcoin Core 28.0, nodes accept replace-by-fee by default, whether or not the original signalled it. The sender can broadcast a new version that spends the same coins with a higher fee, and it may pay someone else. Treat any unconfirmed payment as replaceable. “Pending” in a wallet, or “sent” on an exchange, is not a confirmation.

Why depth matters

Now and then two miners find blocks at almost the same time. For a while, nodes disagree on the tip. When one branch pulls ahead, every node switches to it and the other block drops out. That is a reorg. The dropped block’s transactions go back to the mempool and usually make a later block. A payment is lost only if the winning branch holds a conflicting spend of the same coins.

To undo a payment buried under more blocks, an attacker has to redo all of their proof of work faster than the rest of the network extends the chain. Each extra block makes that much harder. Section 11 of the Bitcoin whitepaper works through the odds for an attacker with less than half of the hashrate.

How many is enough

There is no protocol number. Six confirmations, about an hour on average, is a common convention for large payments. Many people accept fewer for small amounts. Exchanges set their own counts. Blocks arrive about every ten minutes on average, and some gaps are much longer, so the wait for any count varies.