Module 3 of 4
Proof of Work
The cryptographic mechanism that secures the Bitcoin network, explained for people who do not want to read a cryptography textbook.
Film · Earned by work · 1:36
Block ———A short film for module 3 of Bitcoin as Money: the double-spend problem and the old answer, a bank that keeps the ledger; miners hashing a block until the result starts with enough zeros, shown with real tries on the header of bitcoin's first block; why that work is hard to find and easy to check; how the target resets every 2,016 blocks so a block arrives about every ten minutes; why rewriting history means redoing the work of every block since; the electricity as the network's security budget; the new coins and fees miners are paid; and the contrast with fiat currency, which banks create by lending, almost free to write. It loops while on screen; use Pause to stop it. Turn on Narration to hear it explained aloud. A transcript follows.
Read the film, with its sources
- Bitcoin as Money · Module 3 of 4Proof of Work. Digital money has an old problem: a file can be copied. What stops someone spending the same coin twice?
- The double-spend problemA digital coin is only data, and data can be copied, so the same coin could be sent to two people at once. Until bitcoin, the answer was a middleman: a bank keeps the ledger and decides which payment counts. As the white paper put it, the benefits of digital cash are lost if “a trusted third party is still required to prevent double-spending”.Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §1
- The raceBitcoin replaces the middleman with a race. Miners gather payments into a block, add a number called a nonce, and hash the lot with SHA-256. The result is unpredictable: the only way to find one that starts with enough zeros is to try nonce after nonce. These are real tries, on the header of bitcoin’s first block: nonce 2,083,236,888 to 2,083,236,892 miss, and 2,083,236,893 gives a hash starting with 10 zeros.Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §4Bitcoin block 0 (the genesis block), block header, 3 January 2009
- 3 JAN 2009Hard to find, easy to check. Bitcoin’s first block, mined on 3 January 2009, carries the nonce 2,083,236,893 and the hash 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f. Anyone can confirm the work with a single hash, and once the effort is spent, in the white paper’s words, “the block cannot be changed without redoing the work”.Bitcoin block 0 (the genesis block), block header, 3 January 2009Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §4
- The paceHowever much computing power joins the race, the target adjusts. Every 2,016 blocks, about two weeks, the network resets how many zeros a hash needs: harder if blocks came too fast, easier if too slow. So a new block arrives about every 10 minutes on average.Bitcoin Core, src/kernel/chainparams.cpp, mainnet consensus parameters (read 16 Oct 2026)
- Rewriting historyEach block is chained to the one before it. To change an old payment, an attacker would have to redo the work of that block and of every block since, then overtake the honest miners, who keep adding blocks all the while. Votes are counted in work, not in names: in the white paper’s words, proof-of-work is “one-CPU-one-vote”. The more blocks sit on top of a payment, the harder it is to undo.Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §4
- The security budgetThe work is physical. In the white paper’s words, it is “CPU time and electricity” that is expended. That is not waste: it is the security budget. Rewriting history would mean outspending everyone mining honestly, so the cost of an attack rises with the honest work, and the record holds without anyone having to be trusted.Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §6
- The miner’s payMiners are paid for the work. The first payment in every block creates new coins for whoever found it, plus the fees of the payments inside: since 20 April 2024, 3.125 new bitcoin a block. There is no central issuer; new bitcoin comes into being only as the work is done, on a schedule that ends at 21,000,000.The Bitcoin Transition, the 21 million schedule (computed from the issuance rules)Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §6
- Fiat currency and bitcoinFiat currency is made differently. Most of it is created by commercial banks when they lend: in the Bank of England’s words, “bank lending creates deposits”. The new money is an entry in a ledger, almost free to write, limited by rules and policy rather than by cost. New bitcoin costs real work, and anyone can check it was done. Few prices are set in bitcoin yet, and keeping it safe takes care, but no one can type more of it into being.McLeay, Radia and Thomas, “Money creation in the modern economy”, Bank of England Quarterly Bulletin 2014 Q1, p. 14Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), §6
- The Bitcoin TransitionWhat is proof of work? Fiat is typed into being. Bitcoin is earned by work.
Proof of work is the cryptographic mechanism that Bitcoin uses to decide the order of transactions. It is also the mechanism that makes the Bitcoin ledger immutable — that is, that makes previous transactions practically impossible to rewrite. Understanding it clears up most of the confusion about how Bitcoin actually works.
The Basic Idea
When a miner wants to add a new block of transactions to the chain, they must solve a computational puzzle. The puzzle is: find a number (called a nonce) such that when you hash the new block together with the nonce using the SHA-256 algorithm, the result starts with a specific number of leading zeros.
Hashing is deterministic — the same input always gives the same output — but unpredictable in the sense that you cannot calculate the output without doing the hash. To find a nonce that produces an output starting with enough zeros, you have to try many, many different nonces. There is no shortcut. The only way to solve the puzzle is to burn through computational effort.
Why This Matters
The difficulty of the puzzle adjusts automatically based on how quickly blocks have been found recently. Bitcoin targets one block every ten minutes on average. If blocks are being found too fast, the puzzle gets harder. If too slow, it gets easier. The network maintains a stable heartbeat regardless of how much computing power is competing.
The amount of computing power currently competing is enormous. The Bitcoin network's total hash rate is measured in the hundreds of exahashes per second — that is, 10^20 hashes per second. To rewrite a block from a week ago, an attacker would need to redo the work not just of that block but of every block since, and they would need to do it faster than the honest network is producing new blocks. This is, practically speaking, impossible.
This is why Bitcoin's history is considered final after a few confirmations. The further back in the chain a transaction is, the more accumulated proof-of-work is sitting on top of it, and the more energy an attacker would need to rewrite it. For large sums, six confirmations — roughly an hour of work — is considered the standard threshold for final settlement.
The Energy Question
Proof of work is often criticised for its energy consumption. The criticism tends to ignore what the energy is doing. It is paying for the security of the network. There is no free lunch: if you want a ledger that cannot be rewritten by any authority, you need a mechanism for making rewrites expensive. Proof of work does that by making the cost of an attack proportional to the cost of honest operation.
Bitcoin mining also has the unusual property that it can use stranded or otherwise-wasted energy. Miners deploy to wherever electricity is cheapest, which tends to be where generation capacity exceeds local demand — flared gas at oil fields, curtailed renewables, geothermal sites with no grid connection. A significant share of Bitcoin's hash rate is powered by energy that would otherwise be wasted or vented.
What This Means for a User
From the user's perspective, proof of work is invisible. You do not interact with it. You send a transaction, wait a few confirmations, and consider it settled. The mechanism matters because it is what makes that settlement final without a trusted third party.
Remove proof-of-work, and you remove the trustlessness that defines Bitcoin. Every proposed alternative to proof-of-work reintroduces some form of central coordination — a validator set, a staking committee, a council. None of them are Bitcoin.