Proof of work

In brief

Bitcoin uses a Hashcash-style proof of work so that a peer-to-peer network can agree on a single history without a mint. Miners assemble transactions into a block and search for a hash that meets a target. Difficulty adjusts every 2,016 blocks so that blocks arrive about every ten minutes. Nodes follow the valid chain with the most accumulated work. A majority of hash power can attempt to double-spend or censor; it cannot quietly invent coins that break the rules honest nodes enforce. Proof of work is not a synonym for “blockchain.” Ethereum left it in 2022. Electricity and hardware are costs miners incur while competing for protocol rewards and fees; they are not themselves the protocol's “security budget,” nor are they inherently good or bad.

Before Bitcoin: Hashcash and costly puzzles

Satoshi Nakamoto’s 2008 paper introduces Bitcoin’s proof of work as “similar to Adam Back’s Hashcash.” Back’s 2002 technical report says Hashcash was originally proposed in May 1997 to throttle systematic abuse of unmetered internet resources such as email and anonymous remailers. A sender computes a CPU-cost token so that mass abuse becomes expensive while checking a token remains cheap.

The broader “pricing via processing” line of research predates Hashcash. Bitcoin’s specific lineage is clear but limited: Nakamoto cited Hashcash and adapted a similar partial-hash puzzle for transaction ordering and chain selection, rather than using Hashcash stamps unchanged.

Bitcoin repurposes that style of puzzle: instead of stamping email, it uses proof of work to order transactions and to weight branches in a disagreement about history.

What Bitcoin’s proof of work is

Section 4 of the whitepaper:

• Scan for a value that, hashed (double-SHA-256 in Bitcoin’s implementation), produces a block-header hash below the target. The whitepaper explains this approximately as requiring a number of leading zero bits. Expected work rises as the target becomes harder; checking a candidate is cheap.
• In the timestamp network, increment a nonce in the block until the block’s hash meets the required target.
• Once the work is done, changing the block means redoing it. Changing an old block means redoing it and every block after it.

A block contains a header (previous hash, Merkle root of transactions, timestamp, nonce and compactly encoded target) and the transaction list. The first transaction is the coinbase, which pays the miner the subsidy plus fees.

Mining is the search. Miners are the people and machines doing the search. They are not a company called Bitcoin. Individual mining devices or pool participants need not each run a full node, but their blocks are accepted only if they follow the rules full nodes check.

The whitepaper’s network loop is: broadcast transactions; collect them into a block; work on a difficult proof-of-work; broadcast a successful block; accept it if transactions are valid and unspent; express acceptance by mining on top of it.

Targets, difficulty and the ten-minute clock

The target is a 256-bit threshold, compactly encoded in each block header's nBits field. A valid block hash must be less than or equal to that target. Difficulty expresses how hard the current target is relative to the easiest allowed target. The Bitcoin Wiki documents that difficulty changes every 2,016 blocks. At one block per ten minutes, that interval is two weeks. If the prior adjustment period was too fast, difficulty rises; if too slow, it falls. Difficulty can go down.

Individual blocks are not a metronome. The process is random around that average. The whitepaper already said difficulty is a moving average targeting a constant block rate.

This adjustment is Bitcoin-specific. Other PoW coins choose other intervals and other hash functions. Do not generalize “every two weeks” or “SHA-256” to “proof of work.”

Chain selection: accumulated work

When two miners find blocks at once, nodes may temporarily see competing branches; once one has more accumulated work, the other is abandoned. “Longer” in the whitepaper's shorthand means more accumulated proof-of-work, not merely more blocks (a longer chain of easy blocks should not beat a shorter chain of harder ones). The whitepaper calls majority decision “one-CPU-one-vote” and says the majority is represented by the chain with the greatest proof-of-work effort invested.

Honest majority hash rate is assumed to grow the heaviest valid chain faster than an attacker. A short reorganization is normal. A deep one is possible if a large share of hash power works on a competing history; it becomes rapidly more expensive as blocks accumulate.

Published history is expensive to rewrite. It is not metaphysically impossible to rewrite.

Double-spends and majority hash power

Digital signatures stop other people from spending your coins. They do not stop you from signing two different spends of the same coin. The whitepaper’s problem is double-spending without a mint.

Proof of work plus broadcast gives payees a way to see a public history and to wait for work to pile on top of their payment. More confirmations make a reversal harder. They do not make it a logical contradiction.

If an attacker controls a majority of hash power, the whitepaper’s own analysis is that they can outpace honest miners, reverse their own recent spends, and censor. They still cannot create coins under a rule honest nodes will reject, or spend other people’s coins, unless those nodes also change the rules. A 51% attack is a history-and-censorship attack on this consensus rule set, not a magic key to the entire system.

Smaller PoW coins have seen majority attacks in the wild. Bitcoin’s defense is the cost of assembling that hash power and the economic consequences an attacker expects — contingent economic and social facts, not a theorem that 51% is unachievable.

Energy is the mechanism

The whitepaper’s incentive section is explicit: new coins are distributed the way gold miners expend resources, “in our case, it is CPU time and electricity that is expended.” Fees can eventually replace the subsidy.

That expenditure makes sustained competition costly. If producing proof of work were free, reproducing it would be free too. But the protocol does not prescribe a fixed quantity or energy mix: miners decide how much hardware and electricity to use based on expected revenue, equipment efficiency, energy prices and other costs.

The phrase security budget usually means the subsidy and fees available to pay miners. Miner expenditure is related but not identical: competition influences how much of that revenue is spent on hardware, electricity and operations. Hash rate is likewise not a direct energy meter because hardware efficiencies differ.

Two mistakes sit on opposite sides of the same fact:

• Treating energy use as a bug that Bitcoin’s designers forgot.
• Treating energy use as a moral virtue or as “securing the grid” without a separate, sourced argument.

This article does neither. Bitcoin's Sybil-resistant lottery exposes block production to real resource costs. Other consensus designs use other scarce resources and penalties, such as staked capital and slashing. Those are different security models, not a scoreboard.

Not a synonym for blockchain

Proof of work is one way to agree on a history. Proof of stake selects proposers and attesters by deposited capital; some designs punish specified misbehavior by slashing stake. Ethereum launched with proof of work and switched to proof of stake on 15 September 2022 (The Merge). The ledger, the EVM and account balances continued; the block-production contest changed.

Other systems use Byzantine-fault-tolerant votes, or mix a clock (Solana’s Proof of History) with a vote protocol (Tower BFT). Those are not “PoW with extra steps.”

A database with a hash chain and no costly Sybil resistance is not Bitcoin-style proof of work. A blockchain can exist without PoW. PoW can exist without a currency (Hashcash stamps).

Issuance, briefly

Bitcoin’s subsidy started at 50 BTC per block and halves every 210,000 blocks. The Bitcoin Wiki’s controlled-supply page: the number of bitcoins will not exceed slightly less than 21 million. That rule is orthogonal to the idea of proof of work; it is Bitcoin’s monetary schedule, enforced by the same nodes that check hashes.

When the subsidy is negligible, the whitepaper says the incentive can move to fees alone. Whether fees alone will secure the chain at some future date is a live research and engineering question, not a fact this article will pretend to settle.