Blockchain
Proof of Work: security through energy
In January 2009, an ordinary computer could find a Bitcoin block in 10 minutes and receive 50 BTC. Today the entire Bitcoin network consumes more electricity than Norway, while thousands of specialized machines compete every 10 minutes for the right to earn 3.125 BTC. How does a system where every participant acts purely for profit reliably protect a trillion dollars for 15+ years without a single administrator? The answer: Proof of Work turns electricity into trust, and miners' greed into network security.
- **Bitcoin** processes ~150 TWh of electricity per year, securing a $1+ trillion network - the cost of a 51% attack exceeds $10B in hardware plus millions of dollars in electricity every day
- **Halving** (reward cut by half every ~4 years) creates a deflationary model: by 2140 all 21M BTC will be mined and miners will rely solely on transaction fees
- **Mining pools** (Foundry USA, AntPool, F2Pool) control 70%+ of hashrate - a paradox: a decentralized network with centralized mining infrastructure
Предварительные знания
Mining: a lottery with a trillion tickets
In the consensus lesson we learned that nodes must agree on a single version of the blockchain. But **who exactly** has the right to add the next block? In an open network where participants are anonymous, voting is impossible - an attacker could create a million fake nodes (Sybil attack). Satoshi Nakamoto proposed an elegant solution: **vote not with nodes, but with computational power**.
**Mining** is the process of finding a number (nonce) such that the block hash falls **below a given target**. A miner collects transactions from the mempool, assembles a block, and starts trying nonce values. Due to the avalanche effect of hash functions, every attempt yields an unpredictable result - it is a pure lottery.
The first transaction in every block is the **coinbase transaction**. It creates new BTC "out of thin air" and sends them to the miner. This is the only way new Bitcoin is created. The block reward is halved every 210,000 blocks (~4 years) - this process is called **halving**.
| Period | Block Reward | Total Emission |
|---|---|---|
| 2009–2012 | 50 BTC | 10,500,000 BTC |
| 2012–2016 | 25 BTC | 15,750,000 BTC |
| 2016–2020 | 12.5 BTC | 18,375,000 BTC |
| 2020–2024 | 6.25 BTC | 19,687,500 BTC |
| 2024–2028 | 3.125 BTC | 20,343,750 BTC |
| ~2140 | 0 BTC | 21,000,000 BTC (cap) |
**Lottery analogy:** mining is like buying lottery tickets. Each hash is one ticket. The more tickets you buy per second (hashrate), the higher your chance of winning. But unlike a regular lottery, checking whether a winning ticket is valid takes **one** hash - instant.
A miner found a block and received 3.125 BTC. Where did those coins come from?
Difficulty: a self-adjusting mechanism
If the target (the threshold the hash must fall below) stayed constant, blocks would be found faster and faster as more miners joined. Doubling the network's power would halve block time. Within a few years blocks would appear every millisecond - the network would choke on data.
**Difficulty adjustment** is an automatic correction mechanism. In Bitcoin, every **2016 blocks** (~2 weeks) the network recalculates the target so that the average block time stays at **~10 minutes**.
**Why 10 minutes?** This is Satoshi's trade-off. Faster → more orphan blocks (two miners find a block simultaneously; one is lost). Slower → long wait for confirmation. 10 minutes gives enough time for a block to propagate through the entire P2P network.
Real difficulty adjustment: China bans mining (2021)
How the network survived losing 50% of hashrate
In May–June 2021, China banned mining. More than 50% of global hashrate went offline within a few weeks. What happened: 1. Blocks started taking ~20 minutes instead of 10 2. After 2016 blocks (~4 weeks at 20 min/block), difficulty dropped ~28% 3. After another 2016 blocks - another drop 4. By end of 2021 difficulty recovered: miners relocated to the US and Kazakhstan The network never stopped for a second - difficulty adjustment worked exactly as designed.
Bitcoin's hashrate grew 4x in 2 weeks (2016 blocks). What happens at the next difficulty adjustment?
Nonce: searching for a needle in a hash haystack
**Nonce** (Number used ONCE) is a 32-bit number in the block header that the miner iterates through searching for a valid hash. Range: 0 to $2^{32} - 1$ (4,294,967,295 - just over 4 billion values).
But modern difficulty requires iterating through **trillions of trillions** of combinations. 4 billion nonce values are catastrophically few. What happens when all values have been tried and no valid hash is found?
**In real Bitcoin** **double SHA-256** is used: `SHA256(SHA256(block_header))`. This does not double security, but protects against a specific class of attacks (length extension attacks) to which a single SHA-256 is vulnerable.
A miner has tried all 4,294,967,295 nonce values but found no valid hash. What does he do next?
Hashrate: an arms race
**Hashrate** is the number of hashes a miner (or the whole network) computes per second. It is the direct measure of computational power invested in network security.
| Unit | Value | Scale |
|---|---|---|
| H/s | 1 hash/sec | Manual calculation on paper (theoretical) |
| KH/s | 10^3 hashes/sec | CPU (2009, first miners) |
| MH/s | 10^6 | GPU (2010–2012) |
| GH/s | 10^9 | FPGA (2012–2013) |
| TH/s | 10^12 | Single ASIC miner (2014+) |
| PH/s | 10^15 | Large mining farm |
| EH/s | 10^18 | All of Bitcoin (~700 EH/s in 2024) |
The evolution of mining is a classic **arms race**: CPU → GPU → FPGA → ASIC. Each stage delivered 100–1000× performance gains, rendering previous hardware obsolete.
**Mining pools** combine the hashrate of thousands of miners. Instead of hunting for a block solo (which could take years), miners submit "near-solutions" (shares) to the pool. When the pool finds a block, the reward is split proportionally among participants.
**Pool centralization risk:** if a single pool controls >50% of hashrate, it can theoretically execute a double-spend attack. In 2014, pool GHash.IO briefly reached 51% - and miners voluntarily left for other pools. But voluntariness is a weak guarantee.
A miner with a 100 TH/s ASIC joins a pool with a total hashrate of 10 PH/s. The pool found a block with a reward of 3.125 BTC. How much does the miner receive?
Energy consumption: the price of decentralized trust
Proof of Work **intentionally** consumes energy. This is not a bug - it is a fundamental property. The security of PoW is directly tied to the cost of an attack: to rewrite the blockchain you must spend **more** electricity than the entire network spent during that time. Energy is the physical bridge between the digital world and reality.
**Cambridge Bitcoin Electricity Consumption Index (CBECI)** is the most authoritative source for Bitcoin energy consumption data, maintained by Cambridge University. CBECI estimates consumption based on a hardware model: which ASICs are active, their energy efficiency, and current hashrate.
| Critics' argument | Supporters' response |
|---|---|
| 150 TWh/year - wasteful | The banking system consumes ~260 TWh/year (including offices, ATMs, cash transport), yet doesn't serve the whole world |
| 707 kWh per transaction - absurd | An incorrect metric: energy is spent on network security, not individual transactions. Lightning Network processes millions of txs without additional energy |
| Carbon footprint | ~50% of mining uses renewable energy. Miners go where electricity is cheapest - often hydro, wind, solar, stranded gas |
| PoS exists - why waste energy? | PoS requires trusting large stakeholders. PoW is the only mechanism tied to physical reality rather than token distribution |
**Stranded energy and flexible load.** Miners can operate where energy is in surplus: associated gas at oil fields (which would otherwise be flared), hydroelectric plants with seasonal surpluses, solar farms during peak production hours. Bitcoin is a unique "buyer of last resort" for energy that would otherwise go to waste.
The energy spent on mining is "wasted" - it produces nothing useful
PoW energy produces a concrete product: **immutability and security** of the ledger. Every kilowatt-hour spent on mining raises the cost of attacking the network. This is analogous to the costs of gold mining (fuel, equipment, labor) - gold also "just sits in a vault", but the cost of extracting it creates trust in its value.
The confusion arises from comparing PoW to traditional payment systems on the "energy per transaction" metric. But PoW protects not individual transactions but the entire network history. The correct metric is "cost of attacking the network", and by that metric the energy expenditure is justified: a 51% attack on Bitcoin costs billions in hardware and millions in electricity every day.
Bitcoin consumes ~150 TWh per year. If the entire network switched to Proof of Stake (like Ethereum), consumption would drop ~99.95%. Why doesn't Bitcoin do this?
Key ideas
- **Mining** - finding a nonce such that `SHA256(SHA256(block_header)) < target`. It is a computational lottery: verifying a solution takes one hash, finding it takes trillions of attempts. The coinbase transaction creates new BTC as the reward
- **Difficulty adjustment** - every 2016 blocks the network recalculates the target, keeping average block time ~10 minutes. The mechanism survived losing 50% of hashrate in 2021 (China ban) without stopping
- **Nonce** - a 32-bit number (4B values), extended via extra nonce in coinbase to $2^{96}$ combinations. Double SHA-256 protects against length extension attacks
- **Hashrate** evolved from CPU (MH/s) to ASIC (TH/s) in 15 years. Mining pools solve income variability but create centralization risk
- Remember how in 2009 an ordinary computer could find a block in 10 minutes? Today that requires gigawatts of power - and exactly this cost is what makes Bitcoin secure. Proof of Work turns electricity into something no government can forge: mathematically verifiable trust
Related topics
Proof of Work is the central mechanism of Bitcoin, connecting cryptography with economics:
- Consensus: why and how — PoW is a concrete implementation of Nakamoto consensus, solving the Byzantine Generals problem through computational work instead of voting
- Proof of Stake — The alternative to PoW: economic stake instead of energy. 99.95% less energy, but a different security model
- Bitcoin Mining (in practice) — Implementation details: pool protocols, ASIC architecture, mining farm economics, halving cycles
Вопросы для размышления
- Bitcoin consumes ~150 TWh/year, while VISA processes 200B transactions on ~0.2 TWh/year. Is it valid to compare these systems on the "energy per transaction" metric? What exactly does the spent energy buy in each case?
- The four largest mining pools control ~73% of Bitcoin's hashrate. Is this a 51% attack in slow motion? Or do pools have no incentive to attack the network that pays them?
- Quantum computers could theoretically speed up nonce iteration quadratically (Grover's algorithm: $2^{128}$ instead of $2^{256}$). Would increasing difficulty be sufficient, or would PoW need a fundamental redesign?
Связанные уроки
- bc-02-hashing — SHA-256 hashing is the atomic operation of PoW
- bc-05-consensus-intro — Consensus context - why PoW exists
- bc-15-pos — PoS is an alternative consensus without energy
- bc-16-bft — BFT is classical consensus without puzzle
- prob-02-combinatorics — Nonce search is a combinatorial problem with hash
- st-10-economics — Mining economics - game theory in energy market
- crypto-19-hash-functions