Blockchain Finality Compared: How Many Confirmations to Wait
Quick answer. Wait for each chain's finality, not a fixed count: Ethereum's finalized checkpoint (typically 64 to 96 blocks), Tron's solidified block, Solana's finalized commitment, and Ethereum finality for rollup batches. Credit sooner only what you can afford to reverse.
Video transcript
A deposit credited before it is final can disappear. If the chain reorganizes, your customer may have already spent the balance.
On Bitcoin, each block makes a reversal less likely, but never impossible. On Ethereum, a checkpoint is final once two thirds of staked ETH votes for it.
Rollups give two answers. The sequencer confirms in under a second, which is only a promise. On Base, the batch reaches Ethereum in about two minutes and is final in about twenty.
Ethereum takes about thirteen to nineteen minutes, by our calculation. Tron takes about a minute, Polygon a few seconds, and Bitcoin never becomes final.
Published counts are snapshots. Kraken waits 250 confirmations on Polygon, though Polygon's docs put finality at two to five seconds.
A Bitcoin client bug split the chain in 2013. Ethereum Classic suffered three attacks in 2020, Polygon rolled back 157 blocks in 2023, and Ethereum's finality once stalled.
Small deposits post on inclusion, marked pending. Standard deposits credit at finality. Large ones are checked on two node providers and reviewed before withdrawal. The dollar tiers are examples.
Store each block hash and re-read it at finality. If a credited deposit vanishes, reverse it and hold withdrawals. If finality stalls, keep deposits pending.
Guardian's fintech pentests can be scoped to the services that credit deposits. Read the full article, or talk to Guardian at guardian.security.
A deposit credited before it is final can disappear. If the chain reorganizes, the transaction may vanish after the customer has spent the balance.
Exchanges publish how many confirmations they wait for, but rarely explain the number. And the numbers change.
Below: what final means on each major chain, what Kraken and Circle wait for, and a crediting policy you can adapt. Figures were read on November 6, 2026.
Probabilistic vs Deterministic Finality
On a probabilistic chain, each new block makes a reversal less likely, but never impossible. Bitcoin works this way.
The Bitcoin Wiki says the 6-block convention assumed an attacker unlikely to hold more than 10% of hashrate. For high-value irreversible sales, it suggests far more, such as 144 blocks, about a day.
On a deterministic chain, validators vote, and a block is final once a supermajority agrees.
Ethereum finalizes a checkpoint when two-thirds of staked ETH votes for it. Reverting it would cost an attacker at least one-third of all staked ETH, ethereum.org says.
Deterministic finality can still stall. When it does, deposits wait, and your policy must say what happens next.
L2 Finality and the Sequencer
A rollup gives two answers to "is it final?" Its sequencer confirms a transaction almost at once. Ethereum makes it final later.
- Sequencer confirmation: under a second. Arbitrum calls this soft finality, and it relies on trusting the sequencer.
- Batch posted to Ethereum: about 2 minutes on Base.
- Batch final on Ethereum: about 20 minutes on Base, and 15 to 30 minutes on OP Mainnet.
OP's docs say the sequencer can reorganize "unsafe" blocks, those not yet published to Ethereum. Arbitrum's call soft finality "not suitable for high-value transactions."
Base reports that fewer than 0.00000002% of its transactions have ever reorged before reaching Ethereum, and none after. A good record is not a guarantee.
Do not confuse finality with the withdrawal wait. OP's docs say the 7-day bridge delay "does not impact transaction finality" on the chain itself.
Circle's waits for ZK rollups run longer: about 2 to 4 hours on Starknet and 6 to 32 hours on Linea. For what each rollup trusts beyond finality, see ZK vs optimistic rollups.
Confirmation Table by Chain
What final means on each chain
| Chain | Final when | Time to final |
|---|---|---|
| Bitcoin | Never; reversal odds fall each block | None; 6 blocks by convention |
| Ethereum | Two-thirds of stake finalizes the checkpoint | ~13 to 19 min (our calculation) |
| Solana | Finalized commitment (same as confirmed under Alpenglow) | ~150 ms, Anza's design target |
| Tron | 19 of 27 producers build at or past it | ~1 min |
| Polygon PoS | Two-thirds of validators agree a milestone | 2 to 5 s |
| Avalanche C-Chain | Block accepted | ~1 s |
| Arbitrum One | Batch final on Ethereum | ~12 to 15 min |
| Base | Batch final on Ethereum | ~20 min |
| OP Mainnet | Batch final on Ethereum | 15 to 30 min |
Ethereum's time is our calculation: Kraken's 64 to 96 blocks at 12 seconds each. The others are the chains' own estimates.
What Kraken and Circle wait for
Kraken's column is its deposit requirement. Circle's is how long its CCTP waits before attesting a standard USDC transfer.
| Chain | Kraken waits | Circle CCTP waits |
|---|---|---|
| Bitcoin | 3 confirmations, ~45 min | Not listed |
| Ethereum | Finalization, ~20 min | ~65 blocks, ~15 to 19 min |
| Solana | No count; under 1 min | 32 blocks, ~17 s |
| Tron | 20 confirmations, ~1 min | Not listed |
| Polygon PoS | 250 confirmations, ~25 min | 2 to 3 blocks, ~8 s |
| Avalanche C-Chain | 20 confirmations, ~4 min | 1 block, ~8 s |
| Arbitrum One | Finalized, ~20 min | ~65 Ethereum blocks, ~15 to 19 min |
| Base | Finalized, ~20 min | ~65 Ethereum blocks, ~15 to 19 min |
| OP Mainnet | 40 Ethereum blocks, under 20 min | ~65 Ethereum blocks, ~15 to 19 min |
Kraken's times assume the deposit lands in the first possible block.
Published counts do not always track protocol changes. Kraken waits 250 Polygon blocks, though Polygon's docs put milestone finality at 2 to 5 seconds.
Circle still lists 32 Solana blocks, in line with Tower BFT's finalized rule of 31 or more blocks on top. Alpenglow replaced Tower BFT on October 21, 2026.
Counts also move after attacks. After Ethereum Classic's 51% attacks in August 2020, Coinbase extended ETC confirmation times to roughly two weeks, CoinDesk reported.
Treat any published count as a snapshot. Kraken's page was last updated October 22, 2026.
Reorgs That Mattered
Bitcoin, 2013: a client bug
Bitcoin 0.8 accepted a block that older nodes rejected, and the chain split. Two large pools downgraded to end it, and 0.8 nodes reorganized onto the older chain, BIP 50 records.
At least one large double spend succeeded during the split. Software bugs, not only attackers, can reverse blocks.
Ethereum Classic, 2020: three 51% attacks
The attacks reorganized 3,693, then 4,000, then more than 7,000 blocks, CoinDesk reported. Our map of blockchain security risks covers the consensus layer.
Polygon PoS, 2023: 157 blocks
On February 22, 2023, a 157-block reorg rolled back about five minutes of activity, Protos reported. Co-founder Jaynti Kanani blamed a bug and said the next release would bring finality in a few seconds.
Polygon now finalizes through milestones, typically within 2 to 5 seconds, its docs say.
Ethereum, 2023: finality stalled
On May 11 and 12, 2023, Ethereum's finality was delayed by 4 and then 9 epochs, Prysm's post-mortem says. Clients struggled to process some old attestations.
A policy that waits for finality must say what happens when finality is late.
A Crediting Policy to Copy
Adapt this to your risk appetite and review it each quarter. The dollar tiers are examples.
| Tier | Example size | Credit to balance | Allow withdrawal |
|---|---|---|---|
| Small | Under $1,000 | On inclusion, marked pending | At finality |
| Standard | $1,000 to $100,000 | At finality, per the table above | At finality |
| Large | Over $100,000 | At finality, checked on two node providers | After manual review |
On Bitcoin, which never becomes final, use 6 blocks for standard deposits and raise the count for large ones.
Read the chain's own finality signal
- Ethereum and EVM rollups: query with the "finalized" block tag, a standard JSON-RPC parameter.
- Polygon PoS: compare the deposit's block with the latest "finalized" block, as Polygon's docs suggest.
- Tron: confirm through the /walletsolidity endpoints, which read solidified state.
- Solana: request "finalized" commitment.
- Bitcoin: count blocks, and scale the count with the amount.
Handle reorgs
- Store each deposit's block hash, not only its height.
- At finality, re-read the transaction and confirm the hash still matches.
- If a credited deposit disappears, reverse the credit and hold the account's withdrawals.
- Alert on any reorg deeper than the chain's normal depth.
- If finality stalls, keep deposits pending. Do not fall back to block counts.
- Read from at least two independent node providers.
- Match the token contract address, not the symbol.
Never let a deposit fund a withdrawal before it is final. Our guide to withdrawal security controls covers that side, and crypto exchange security the wider picture.
How Guardian Helps
Guardian's pentests for fintechs attack the flows that authenticate users, authorize actions and approve withdrawals, function by function.
Web app, API and infrastructure pentests can be scoped to the services that credit deposits. Managed Security then keeps your controls in place as you grow.
Frequently Asked Questions
How many confirmations does Ethereum need?
No fixed count. Wait until the block is finalized, typically after 64 to 96 blocks: about 13 to 19 minutes at 12 seconds a block. Kraken waits for finalization, and Circle's CCTP waits about 65 blocks.
How long does a USDC deposit take to confirm?
It depends on the chain. Circle's CCTP standard transfers wait about 15 to 19 minutes on Ethereum, Arbitrum, Base and OP Mainnet. Solana takes about 17 seconds, and Polygon PoS and Avalanche about 8.
Is an L2 sequencer confirmation final?
No. It is the sequencer's promise. OP Stack docs say the sequencer can reorganize blocks not yet published to Ethereum. Treat an L2 deposit as final once its batch is final on Ethereum.
What is the difference between probabilistic and deterministic finality?
Under probabilistic finality, as on Bitcoin, a reversal gets less likely with each block but never impossible. Under deterministic finality, as on Ethereum, a block is final once a supermajority of validators agrees.
Sources
- Kraken: Cryptocurrency deposit processing times (last updated October 22, 2026; read November 6, 2026)
- Circle: CCTP required block confirmations (read November 6, 2026)
- ethereum.org: Proof-of-stake (updated October 7, 2026)
- ethereum.org: JSON-RPC API, default block parameter
- Bitcoin Wiki: Confirmation
- Anza docs: Commitments under Tower BFT and Alpenglow
- Solana Compass: Solana Alpenglow Is Live on Mainnet as Anza Retires TowerBFT (October 21, 2026)
- TRON Developer Hub: Consensus and block solidification
- TRON Developer Hub: Confirmation semantics
- Polygon Knowledge Layer: Finality
- Avalanche Builder Hub: Avalanche Consensus
- Arbitrum docs: Finality
- Optimism docs: Transaction finality
- Base docs: Transaction finality
- Bitcoin BIPs: BIP 50, March 2013 Chain Fork Post-Mortem
- CoinDesk: Ethereum Classic Hit by Third 51% Attack in a Month (August 29, 2020)
- Protos: Polygon hit by 157-block reorg despite hard-fork to reduce reorgs (February 24, 2023)
- Prysm (Offchain Labs): Mainnet postmortems, May 2023 finality incidents
- Guardian: Blockchain Security Risks, a Layer-by-Layer Map
- Guardian: Crypto Exchange Withdrawal Security
Test the pipeline that credits deposits
Guardian pentests the apps, APIs and cloud behind deposits and withdrawals, then keeps your controls in place as you grow.