In simple terms a double spend attack can happen if someone has more than 51% of the network's mining power.
Let's say you are selling goods online for BTC, The attacker will send you the BTC and after confirmations, you send them the goods, This can all be done while the attacker has another chain on standby where he has not yet sent out any BTC. After receiving the goods, the attacker can decide to release the other chain that has been on standby and since he has more hash power than the rest of the network, the network switches to the newer alternate chain.
This implies that the original transaction will disappear from the network and so will the BTC sent to you whilst the attacker will have got the goods from you.
With this the attacker can
- Block confirmations from taking place
- Reverse transactions
Please note that this kind of attack is currently very expensive and close to impossible to implement on the bitcoin network. I was just using BTC as an example in the explanation.
I would love you to read this small explanation too to grasp the whole concept
How A 51% Attack Occurs
Whenever a transaction is carried’ out on a blockchain, be it by Bitcoin or any other cryptocurrency, it is usually put in a pool of unconfirmed transactions. Miners in return are allowed to select transactions from the pool to form a block of transactions.
For a transaction to be added into a blockchain, a miner must find a correct answer to a puzzle. Miners find solutions to complex mathematical puzzles by using computational power. The higher the computational power a miner has, the likelihood of him finding the correct answer to be allowed to add a block to a blockchain.
A correct answer to a puzzle has to be broadcasted’ to other miners and can only be accepted if all transactions in a block are valid according to the existing record on a blockchain. Corrupt miners, on the other hand, don’t broadcast solutions to the rest of the network.
What this practice does is that it always results in the formation of two versions of a blockchain. One, which is the original blockchain followed by legitimate miners and a second block chain used entirely by a corrupt miner who is not broadcasting results of a puzzle to the original network.
A corrupt miner will most of the time continue to work on his own version of the blockchain, which in this case is not broadcasted to the rest of the network. With the second blockchain now isolated from the network, the corrupt miner can spend his or her bitcoins on the truthful version of the blockchain, the one that all the miners are following.
Source: https://www.fxempire.com/education/article/51-attack-explained-the-attack-on-a-blockchain-513887