Why does waiting for more confirmations make a payment safe from being reversed?

An attacker rewriting history is a "Gambler's Ruin" race; with an honest majority, the chance of catching up from z blocks behind falls exponentially as z grows.

* Nakamoto's own calculation: the odds an attacker ever catches up fall off exponentially with each confirmation — and the weaker the attacker (smaller q), the steeper the drop. *

Model the honest-vs-attacker contest as a binomial random walk: +1 when the honest chain gains a block, −1 when the attacker does. Because honest nodes control more than half the power, the probability the attacker ever catches up from z blocks behind decreases exponentially with z.

Concretely, an attacker with 10% of the power already sits below ~0.02% success after 6 confirmations. So the recipient waits until the transaction has z blocks on top of it — deeper = safer — before treating it as final.

Tip: the weaker the attacker, the fewer confirmations you need; a stronger attacker (higher q) needs many more blocks for the same safety.

Go deeper:

• Gambler's ruin — Wikipedia — the random-walk result behind why a trailing attacker's catch-up odds vanish.
• Bitcoin whitepaper, section 11 "Calculations" — Nakamoto — the exact Poisson calculation and probability table this plot reproduces.