If it were even possible, it would probably take close to $1trillion to pull this off. The price of bitcoins would skyrocket if someone was trying to buy up that many of them.
Although most of the existing hardware for sale out there only accepts bitcoin for payment; I'd imagine if the NSA wanted to attempt a 51% attack they'd know better than to wait for private companies to ship to them and simply build their own ASIC factories... Which they can do with USD.
They could do some serious damage by taking control of the 3 largest bitcoin pools. Afterall, bitcoin is not really that decentralized as people like to think.
This was a big fear of the bitcoin dev community for a while, but they figured out a way around it by basically installing the equivalent of a silent alarm button for each of the big pool operators... If any government tries to take them over, no matter how silently, the pool operator can simply do one small action (I have no clue what the action is; perhaps just a twitter tweet) and suddenly their whole community is warned about the compromise.
Even if they can't do the action; Miners have the most to lose from a government attempt at a 51% attack... So as soon as they see the consolidation of any one pool grow too close to 50%, members of that pool will bail, plain and simple.
In fact members bail from the biggest pools NOW on a daily basis. There's no one any one will get close to 51%.
Selfish mining attack, somewhere around 33%.
Lol... Selfish mining is no threat.
Is bitcoin broken? Gavin Andresen responds to mining vulnerability paper
Explain to me how it's impossible.
Well I'll try... It's a big subject though with hundreds of threads devoted to it on bitcointalk... But in a nutshell, the mining community isn't blind.
What I told Jacky8 above explains half the problems with a 51% attack; you certainly couldn't go through the pools... But let's say you were uncle sam and had a trillion bux to spend on this project... Here's what they think would happen:
1. A huge factory is created to make and assemble ASICs. It would clearly have to have a capacity at least 2x or more larger than all other ASIC manufacturers put together at a very minimum. 10x the size of the existing industry gives them more of a real chance. 100x might be a sure-thing, if they build it very quickly. (Of course such a factory would take up a whole state, but I digress...)
2. As they bring these new miners online, the hash rate goes up by the amount they've added, and miners will have to adjust their calculations.
3. Since the known output of all GHs produced by existing miners is already known and reported on; all this new hashing power coming out of nowhere might as well be wearing a clown suit with a giant red target on it.
4. Responding to this imminent threat, the Devs will code up something for the miners that will have them whitelist each other.
Boom; no more gov mining allowed on the blockchain.
Just like that, the government wastes $1 trillion, and looks like an ass to the world.
(So you know, like normal.)