The design of Bitcoin allows for one obvious attack. The attack is called a 51% attack, after the amount of hashing power that is required to mount such an attack. At various times, mining pools have come close or have achieved 51% of the hashing power. A dishonest pool operator could use that hashing power to mount an attack. Therefore, a responsible miner should monitor the pool and when a pool gets close to that threshold, the miner should switch to another pool. Keeping the hashing power distributed is in everyone's interest.
Let's now discuss what a 51% attacker can and cannot do. We'll start with what they cannot:
An attacker cannot steal coins belonging to an existing address. This is because the attacker does not know the private key required to sign a transaction allowing transfer of the coins.
The attacker, also, cannot prevent transactions from being propagated throughout the network, since we are assuming that the attacker does not control the...