timestamps are submitted by the miner solving the block, so a misconfigured clock could be the culprit, but most often these are attacks against a difficulty ad

timestamps are submitted by the miner solving the block, so a misconfigured clock could be the culprit, but most often these are attacks against a difficulty adjustment algorithm or re-org scheme where a lot of hashrate is used to overwhelm consensus and assert that their tampered chain is the correct chain. This is typically used for forcing a block history in smaller networks where it is easier to dominate the hashrate. Zawy12 is a researcher who has put a considerable amount of work into different rolling window hashrate adjustment algorithms to combat this, like LWMA etc. It's a fun fact that not a lot of people know: These same algorithms are used in heating elements and thermocouples so that the heat level does not 'overshoot' the objective and is able to maintain heat in windy environments or variable temp environments while staying in a certain window. If you've ever used an e-nail or soldering iron, chances are you've used something that employs this same tech.