A block is a batch of transactions with its own fingerprint
A block contains a coinbase transaction and may contain other valid transactions selected by the miner. Their identifiers are summarized in a Merkle root stored in the header. The header also contains the hash of the previous block, the difficulty target, time data and values used for proof of work.
Changing an old transaction would change its identifier, the Merkle root and the block header. The reference from the following block would no longer match, so an attacker would have to redo the proof of work for the altered block and its successors while catching a growing valid chain. Linking blocks therefore makes interference with the past progressively more costly.
A confirmation is a position in the valid chain
A transaction has one confirmation when a full node finds it in a block that belongs to its best valid chain. When another block is added above that block, people normally speak of two confirmations. The number describes transaction depth, not how many servers or people pressed an Approve button.
A wallet may show a payment before confirmation, but such a transaction can still disappear because of a conflict or remain unmined for a long time. One confirmation changes its status substantially, yet the risk is not identical in every situation. A cup of coffee, a car and settlement between exchanges do not need the same security threshold.
- 0 confirmations: the transaction is not yet in an accepted block
- 1 confirmation: the block containing it is at the tip or within the valid chain
- further confirmations: more proof-of-work blocks have accumulated above it
Two valid blocks can appear at almost the same time
If two miners find different valid blocks at about the same time, some nodes may first see one and some the other. Both branches can have the same height. When a later valid block extends one branch and gives it more accumulated work, nodes on the other branch switch to the stronger valid chain.
That change is called a reorganization. The block removed from the active branch becomes stale. Its ordinary transactions are not necessarily lost: if they do not conflict and remain valid, they can return to the mempool and enter a later block. A conflicting transaction may instead be replaced by the one accepted in the resulting history.
Bitcoin provides increasing assurance, not a time guarantee
Proof of work makes rewriting a confirmed transaction increasingly expensive, but it does not mathematically declare a fresh block immutable forever. Reversal risk depends on depth, an attacker's share of hash power, node connectivity and the nature of the payment. Six is a common practical threshold, not a universal law of the protocol.
A user should select a confirmation threshold according to risk. A small in-person payment may justify fewer; a large irreversible transfer may justify more along with additional checks. Confirmations secure ordering in the block chain, but they do not prove that goods are genuine, a counterparty is honest or the sender acquired the coins lawfully.