Corollary 4.1 (Exponential Security). The probability that an attacker with less than 50% hash power can reverse a transaction with z confirmations drops exponentially in z, as stated in Section 11 of the whitepaper.

This follows from the Gambler's Ruin analysis in the whitepaper, interpreted as random walk on the 1-skeleton of the blockchain complex.

The deficit z is the distance between the honest chain tip and the attacker's fork tip on this graph.