Proof-of-work: how Bitcoin turns energy into security

Basics

Miners race to find a block whose fingerprint (hash) is below a target number. The only way to find one is to try again and again, which costs electricity and hardware. Anyone can check a winning block instantly. Because every block builds on the one before, changing an old transaction means redoing all the work since then, faster than everyone else combined. The white paper calls it "one-CPU-one-vote": the chain with the most work wins (section 4).

History

• 1992: Cynthia Dwork and Moni Naor proposed making senders compute a moderately hard function to fight junk mail, in "Pricing via Processing or Combatting Junk Mail" (paper).
• 1997: Adam Back proposed Hashcash in May 1997 to throttle abuse of email and anonymous remailers; his 2002 paper describes its CPU cost-function as a token "which can be used as a proof-of-work" (Back, 2002).
• 2004: Hal Finney released RPOW, reusable proofs of work built on Hashcash-style tokens (Nakamoto Institute).
• 2008: Satoshi Nakamoto's white paper uses "a proof-of-work system similar to Adam Back's Hashcash" to build a distributed timestamp server (white paper, section 4).

Go deeper: how it works

• The block header has six fields: version, the previous block's hash, the Merkle root of the block's transactions, a timestamp, nBits (the compact target) and the nonce (block.h).
• SHA-256d. A block's hash is SHA-256 applied twice to the header; Bitcoin Core's HashWriter computes "the double-SHA256 hash" (hash.h).
• The target. A block is valid only if its hash, read as a number, is not greater than the target decoded from nBits; Bitcoin Core rejects it otherwise (CheckProofOfWork in pow.cpp).
• The nonce. Miners change the 32-bit nonce (and other fields such as the timestamp or transactions, which change the Merkle root) and rehash until they hit a valid hash (block.h).
• Difficulty adjustment. Every 2,016 blocks the target is recalculated so blocks keep arriving about every 10 minutes, and each change is limited to a factor of four in either direction (pow.cpp; two-week timespan and 10-minute spacing in chainparams.cpp). See our difficulty adjustment tracker.

Go deeper: why it secures Bitcoin

• Sybil resistance. Votes based on identities or IP addresses can be faked cheaply. The white paper notes one-IP-address-one-vote "could be subverted by anyone able to allocate many IPs"; proof-of-work ties influence to real computing power instead (white paper, section 4).
• Most-work chain. Nodes follow the valid chain with the greatest total work (the white paper says "longest chain, which has the greatest proof-of-work effort invested in it") (section 4).
• Cost of attack. To reverse a payment an attacker must outpace the honest network; the white paper shows the chance of catching up falls exponentially with each new block if honest miners hold the majority of hash power (section 11).
• Incentives. The block reward and fees make it more profitable to follow the rules than to attack (section 6). See mining.

Advanced

• Chainwork, not length. "Longest chain" really means most cumulative work. Each block's work is derived from its target, so a short chain of hard blocks beats a long chain of easy ones (GetBlockProof in chain.h).
• Validation is asymmetric. Finding a valid hash takes enormous numbers of tries; checking one takes a single double hash, which is why every node can verify (CheckProofOfWork).
• The four-times clamp stops a sudden swing in hash power from changing difficulty by more than 4x in one period (pow.cpp).
• Majority assumption. Security assumes honest nodes control most CPU power; the white paper states this assumption explicitly (abstract).

Energy: a fair debate

Cambridge's Centre for Alternative Finance publishes a live estimate of Bitcoin's electricity use, the Cambridge Bitcoin Electricity Consumption Index. Its April 2025 industry report, based on a survey of mining firms representing nearly half the network's hash power, estimated about 138 TWh a year and 39.8 MtCO2e of emissions, about 0.08% of global greenhouse gas emissions (Cambridge Digital Mining Industry Report).

• Critics' case: the energy is spent on security rather than goods; fossil fuels were still 47.6% of surveyed miners' electricity, with natural gas the largest single source at 38.2% (Cambridge); and fast hardware turnover creates electronic waste (de Vries & Stoll, *Bitcoin's growing e-waste problem*, 2021).
• Supporters' case: 52.4% of surveyed miners' electricity came from sustainable sources, and miners reported curtailing 888 GWh of load in 2023 when grids needed it (Cambridge); they argue the energy cost is what makes the ledger expensive to attack.
• Caveat: the Cambridge mix figures come from a voluntary survey of firms covering about half of hash power, so they may not represent the whole network (Cambridge).

Proof-of-work vs proof-of-stake

In proof-of-stake, validators lock up coins instead of spending energy. On Ethereum a validator deposits 32 ETH, and dishonest behavior such as proposing conflicting blocks can get some or all of that stake destroyed ("slashing") (ethereum.org). Ethereum switched from proof-of-work to proof-of-stake on September 15, 2022, which ethereum.org estimates cut its energy use by about 99.95% (ethereum.org: The Merge).

• Case for PoS: far lower energy use, and attacks are punished by destroying the attacker's own stake (ethereum.org).
• Case for PoW: security rests on external, physical cost rather than on coins already inside the system, so anyone can join by buying hardware and energy, and a new node can find the valid chain by checking work alone (white paper).
• Trade-off: PoS supporters see PoW's energy as waste; PoW supporters see staking as favoring those who already hold the most coins. Both are active design choices, not settled questions.