Proof of work

What a miner is actually doing

Mining is a search. A node assembles pending transactions into a block, then hashes the header repeatedly with a different nonce until the result falls below a target set by current network difficulty. There is no shortcut and no partial credit. The whitepaper sets difficulty by a moving average targeting an average number of blocks per hour, so the target tightens as hardware arrives and loosens when it leaves.¹

The puzzle itself is not the clever part. What it stands in for is. Proof-of-work is essentially one-CPU-one-vote, and the majority decision is represented by the longest chain, which has the greatest proof-of-work effort invested in it.¹ No registry of participants is needed, because the vote is the electricity bill.

Settlement is a probability, and there is a published table

Proof-of-work settles probabilistically. The whitepaper does that arithmetic rather than waving at it: an attacker's catch-up chance follows a gambler's ruin curve, and the probability drops exponentially as honest blocks stack on top.¹

The published numbers are far more useful than the folklore. To hold an attacker's success probability below 0.1 percent, an attacker holding 10 percent of hashpower takes 5 confirmations, 20 percent takes 11, 30 percent takes 24, 40 percent takes 89, and 45 percent takes 340.¹ Six confirmations is not a universal constant. It is the answer to one assumption about who might be attacking you. Set your confirmation policy from the attacker share you consider plausible and the value at risk, then write both down where your finance team can find them.

The energy figure is a range, and the ranges disagree

Two publishers run continuous estimates and they do not agree. The Cambridge Centre for Alternative Finance reported an annualized best guess of 155.02 TWh as of 2 August 2026, alongside its own published scenarios of 77.36 TWh at the low end and 253.28 TWh at the high end.³ Digiconomist's index read 204.44 TWh on 3 August 2026.⁴

The gap is methodological. Cambridge models the mix of mining hardware and its efficiency, applies a seven day moving average to damp hashrate volatility, and assumes electricity at 0.05 USD per kWh, publishing a low, a high and a best guess rather than a point estimate.³ Digiconomist rejects that approach, deriving consumption from miner economics on the premise that miner income and costs are related, and argues that hardware mix models understate consumption because they ignore machine reliability, climate and cooling.⁴

So state it as it is. Bitcoin's annualized electricity draw is estimated somewhere between roughly 77 and 253 TWh depending on whose model you use and which scenario inside it, and the two most cited publishers sat about 50 TWh apart in the same week. Anyone quoting one figure as settled has picked a methodology without telling you. Worth knowing before a diligence questionnaire arrives with the number already filled in.

The security budget is an operating expense

That electricity gets bought, and something has to buy it. The whitepaper funds the incentive with a block subsidy plus transaction fees, and states that once a predetermined number of coins have entered circulation the incentive can transition entirely to transaction fees.¹ That transition is the open question in the model, not a settled detail.

The margin is thinner than most people assume. Digiconomist reported annualized miner income of about 10.5 billion dollars against estimated annualized electricity costs of about 10.2 billion, a cost ratio of 97.26 percent under its 5 cents per kWh assumption, read on 3 August 2026.⁴ Treat those as one publisher's model outputs, not audited accounts. The design point holds regardless: hashrate tracks revenue, so a mechanism whose subsidy steps down on a fixed schedule is a mechanism whose security budget depends on fee income growing into the gap.

Written against proof-of-stake

The honest comparison is about where the cost lives. Proof-of-work's cost is external: hardware and power bought outside the system, unforgeable, and unrecoverable if you attack and lose. Proof-of-stake's cost is internal: capital bonded in the chain's own token, destroyable by the protocol itself once misbehaviour is provable. One buys security from the physical world, the other from its own balance sheet.

Each direction carries a real weakness. Proof-of-work's expense recurs every block whether the chain is busy or idle, and producing malicious yet valid blocks consistently required over 51 percent of network mining power, a threshold that only holds while enough hardware stays pointed at the chain.² Ethereum switched proof-of-work off in 2022 and now documents it as deprecated.² Bitcoin did not. Two of the largest networks weighed the same tradeoff and went opposite ways, which is the clearest signal available that the answer is not obvious.

What this changes for a founder

You are almost certainly not launching a proof-of-work chain. What survives into an actual decision is narrower than the debate suggests. If your product settles on a proof-of-work chain, probabilistic finality is a product requirement rather than a footnote: pick a confirmation count off the table above and make it a function of transaction size. If any part of your token story touches mining, expect diligence to ask for the energy number, and hand over the range with both publishers named instead of the figure that flatters you.

And if a design arrives proposing a new proof-of-work network, the cryptography is not the question. Who funds the hashrate in year three is the question, along with whether the application sitting on top generates fees at anything close to the rate the security budget spends them.