The Attacker's Dilemma

If a greedy attacker is able to assemble more CPU power than all the honest nodes, he would have to choose between using it to defraud people by stealing back his payments or using it to generate new coins. He ought to find it more profitable to play by the rules, such rules that favour him with more new coins than everyone else combined, than to undermine the system and the validity of his own wealth.

- Satoshi Nakamoto, Bitcoin Whitepaper

To conduct a double spend attack on the network, the attacking node must accumulate enough hash power to overrule more than half of the other nodes on the network, and must then pay to maintain that hash power for an indefinite period of time, while it tries to convince the remaining nodes on the network to support its illegal actions.

Maintaining the attack as a single malicious actor is tremendously expensive due to the cost of performing proof of work, yet the attacker must break the law in plain sight using the Bitcoin ledger in full view of the public and law enforcement.

It is easy to see that it is far less risky and much more lucrative for a node controlling such a large quantity of hash power to participate as an honest actor securing the network to legitimately win honest rewards as income.