Last lesson left a juicy cliffhanger. We said miners batch transactions into blocks, earn a block reward, and that difficulty quietly adjusts so a new block lands roughly every ten minutes — but we hand-waved the most important part: how does the network actually pick who gets to add the next block? No boss hands out turns. No vote is taken. Instead, Bitcoin runs a giant, planet-scale lottery — and the price of a ticket is electricity. The mechanism is called proof-of-work, and by the end of this lesson you’ll know exactly how it crowns a winner, why that winner can’t cheat, and why the scariest-sounding attack on Bitcoin can do far less than the headlines claim.
The Guessing Game
Before you read — take a guess
Guess before reading: to 'win' the right to add the next block, what does a miner actually do?
Recall from crypto-basics that a hash is a fixed-size fingerprint of data, and that it has the avalanche effect — change the input by one bit and the entire fingerprint scrambles unpredictably. Bitcoin leans hard on that. To add a block, a miner assembles a block header (which includes the previous block’s hash, a summary of the block’s transactions, a timestamp, and a number called the nonce) and runs it through a hash function. Bitcoin specifically uses double SHA-256 — it hashes, then hashes the result again.
Here’s the game. The network sets a target — a big number. A miner wins only if the header’s hash comes out below that target. Equivalently, the hash has to start with a certain number of leading zeros. Because hashing is one-way and avalanche-y, there is no clever way to design a header that hashes low. The miner’s only move is to change the nonce, re-hash, look at the result, and if it’s too big, change the nonce again. And again. Trillions of times a second, across the whole network.
That repeated tweak-and-rehash is proof-of-work: the “work” is the staggering pile of failed guesses you had to burn through before stumbling onto a winning one.
Play with it. Hit mine and watch the miner grind through nonces until the fingerprint finally lands below the target. Then drag the difficulty slider up and watch the expected number of attempts explode:
- Hashes tried
- 0
- Nonce
- 0
Each attempt is one guess: a new nonce, a fresh fingerprint, a check against the target. Crank the difficulty and the work needed multiplies — fast.
Myth: “miners solve useful math problems”
A stubborn legend says mining computes something valuable — protein folding, prime numbers, curing cancer. It does not. The “problem” is to find a nonce whose header hashes below the target, and the answer is useful for exactly one thing: proving you spent the work. It’s deliberately arbitrary. The point isn’t the answer; it’s that finding it was provably expensive.
Fill in the core mechanics of a single mining attempt.
Pick the right option for each blank, then check.
The miner changes a number called the , re-runs the block header through , and checks whether the result is . If not, it changes the number and tries again.
A Lottery Weighted by Hashrate
Before you read — take a guess
Two miners are racing for the next block. Miner A can compute twice as many hashes per second as Miner B. Who finds the next block?
Because every guess is independent and equally (un)likely to win, mining is best pictured as a lottery. Each hash you compute is one lottery ticket. The more hashes per second you can churn out, the more tickets you hold, and the higher your odds of finding the next block. The total guessing speed of the whole network is called the hashrate — hashes per second — and your probability of mining the next block is roughly your share of the total hashrate.
Control 10% of the network’s hashrate? You’ll find roughly 10% of blocks over time. Control 0.001%? You’ll win occasionally, on a timescale that may stretch into years. The network’s collective difficulty is tuned so that, summed across everyone, a winning ticket turns up about once every ten minutes — that’s the retargeting we met last lesson, quietly nudging the target up or down to hold that pace as hashrate rises and falls.
Independent tickets, no “due” numbers
A miner who has hashed for an hour with no luck is no more likely to win on the next guess than a miner who just switched on. Past failures don’t build up credit — each hash is a fresh, independent draw. There’s no such thing as being “due” for a block.
Because the law of large numbers smooths randomness out. A single hobbyist with a tiny share sees wild, lumpy luck — long droughts, occasional jackpots. A pool combining millions of machines holds a huge, steady share of the tickets, so its results hug the average closely: it wins close to its hashrate share, block after block. The dice are still fair; there are just enough rolls to make the odds visible.
Hard to Do, Easy to Check
Before you read — take a guess
A miner announces a new block. How much work does everyone else do to confirm the block's proof-of-work is valid?
Here is the elegant asymmetry at the heart of proof-of-work: it is astronomically hard to produce, but trivial to verify. Finding a nonce that makes the header hash below the target might take the whole network trillions upon trillions of attempts. But once a miner announces, “here’s my block, and the winning nonce is 487,221,003,” every other node can check it by hashing the header just once and confirming the result really is below the target. One hash. Done.
The everyday picture: a fiendish jigsaw puzzle. Assembling it takes hours of grinding; but glancing at a finished puzzle to confirm it’s solved takes a second. Proof-of-work lets a miner shout “I did the work!” and lets everyone else verify that claim almost for free — without trusting the miner one bit.
Sort each statement by whether it describes producing a valid block or verifying one.
Place each item in the right group.
- Burn enormous amounts of electricity
- Confirm the result is below the target
- Try trillions of nonces until one hashes below target
- Hash the announced header a single time
- Takes a fraction of a millisecond per node
- Takes about ten minutes for the whole network
Why Work = Security
Before you read — take a guess
Why does spending real work make old transactions hard to reverse?
In crypto-basics we saw that editing one old block breaks every block after it because each stores the previous block’s hash. Proof-of-work supplies the missing ingredient: it makes re-creating those broken blocks ruinously expensive. Each block isn’t just linked to the last — it’s sealed with work. Rewriting an old block means redoing its proof-of-work and redoing the proof-of-work of every block built on top of it, and doing all of that faster than the honest network is busy extending the genuine chain.
This is why we talk about confirmations. When your transaction is in the latest block, it has one confirmation; each new block stacked on top adds another. The deeper your transaction is buried, the more cumulative work an attacker would have to out-pace to undo it. A transaction six blocks deep would require re-mining six blocks faster than thousands of honest machines mine new ones — practically, it’s not happening. That’s what people mean when they call the chain immutable: not magically un-editable, but protected by a mountain of accumulated work that grows higher every ten minutes.
“Longest” really means “most work”
You’ll hear “longest chain,” but the precise rule is most cumulative proof-of-work. Length is just a convenient stand-in, since more blocks usually means more total work poured in. When honest nodes choose between competing histories, they pick the one with the heaviest pile of work behind it — that’s the chain everyone agrees is real.
Forks and the Longest Chain
Before you read — take a guess
Two miners on opposite sides of the world find a valid block at almost the same moment. What happens?
Sometimes two miners find a valid block at nearly the same instant, before the news of either has spread across the globe. Now the network briefly disagrees: some nodes heard about block X first, others heard about block Y. The chain has temporarily forked into two competing branches of equal length.
This isn’t a crisis — it’s expected, and the rule resolves it automatically. Nodes keep mining on whichever branch they saw first, but the tie breaks the moment the next block lands on one of the branches. That branch now has more cumulative work, so every honest node switches to it. The losing block becomes an orphan (or “stale”) block: it’s discarded, and any transactions it contained that aren’t already in the winning chain drop back into the mempool to be picked up by a future block. No transactions are lost; the network simply converges on the heaviest chain.
Match each proof-of-work term to its meaning.
Pick a term, then click its definition.
Target ↔ Difficulty
Before you read — take a guess
The network adjusts the target so that requiring one MORE leading zero in the winning hash makes mining...?
Target and difficulty are two views of the same dial. A lower target means fewer hashes qualify as winners (you need more leading zeros), which makes mining harder. A higher target loosens the bar and makes it easier. “Difficulty” is just the human-friendly number that goes up as the target goes down.
The crucial, often-missed point is that this scaling is exponential, not linear. Each additional leading zero you demand shrinks the set of acceptable hashes by a large factor, so the expected work to find a winner roughly multiplies with every step. That’s why difficulty can climb to mind-bending heights: tiny-looking tightenings of the target translate into colossal jumps in the number of guesses required. The slider on the miner island above shows exactly this — bump the difficulty by one and watch the expected attempts leap, not creep.
Sort each change by whether it makes mining a block harder or easier.
Place each item in the right group.
- Requiring fewer leading zeros
- Raising the target
- Requiring more leading zeros
- Raising the difficulty number
- Lowering the target
From last lesson: roughly every two weeks, the network looks at how fast the recent blocks actually arrived and retargets — if blocks came too fast (hashrate rose), it lowers the target to make mining harder; if too slow (hashrate fell), it raises the target. That self-correcting feedback loop is what holds the average block time near ten minutes even as the global hashrate swings wildly. The difficulty chases the hashrate; the ten-minute heartbeat stays steady.
The 51% Attack (and Its Limits)
Before you read — take a guess
An attacker somehow controls a MAJORITY of the network's hashrate. What can they actually do?
The scariest phrase in Bitcoin is the 51% attack — and it’s worth being precise, because the reality is both real and far narrower than the panic implies. If an attacker controls a majority of the hashrate, they can build blocks faster than everyone else combined. With that power they could reorder or exclude (censor) transactions and pull off a double-spend of their own recent coins: pay you in a transaction, let it confirm, then secretly mine a longer competing chain in which that payment never happened, and publish it to override the chain you saw. The coins they sent you effectively snap back to them.
That’s genuinely dangerous. But look hard at what it does not allow.
| A 51% attacker CAN | A 51% attacker CANNOT |
|---|---|
| Double-spend their own recent coins | Steal coins from arbitrary addresses |
| Censor or delay transactions | Forge anyone else’s signature |
| Reorder very recent blocks | Create coins beyond the supply schedule |
| Reverse a few shallow confirmations | Cheaply reverse old, deeply buried blocks |
The line everything hinges on: the attacker has no one’s private keys. Moving coins requires a valid signature from the owner’s key, and proof-of-work does nothing to break that. So an attacker can rearrange which valid transactions appear and in what order — they cannot conjure a transaction that spends your coins, because they can’t sign for you. Nor can they mint extra supply or rewrite a transaction buried under thousands of blocks, because out-pacing all that accumulated honest work is astronomically expensive.
Myth: “a 51% attacker can drain anyone's wallet”
False. Hashrate buys you control over block ordering, not over ownership. Spending coins still demands the owner’s private-key signature, which an attacker doesn’t have. The worst they can do is unwind their own recent payments — not reach into your wallet.
And there’s a poetic catch: a successful 51% attack is self-destructive. Amassing a majority of hashrate costs a fortune in hardware and power, and the moment the world sees the chain being rewritten, confidence — and the price — would crater. The attacker would be torching the value of the very asset they spent a fortune attacking. The economics, as much as the cryptography, are part of the defense.
Select EVERY action a 51% attacker could realistically pull off. (More than one is correct.)
The Big Picture
Proof-of-work is one machine with a handful of interlocking gears: a guessing game, a weighted lottery, a verify-cheaply asymmetry, and a heaviest-chain rule that together turn spent electricity into tamper-resistance. Here’s the whole thing in one frame:
Big picture
Proof-of-work at a glance
- Proof-of-work
- The guessing game
- Tweak the nonce, double-SHA-256 the header
- Win if the hash is below the target
- No shortcut — just guess, hash, check, repeat
- A weighted lottery
- Each hash is one independent ticket
- Win odds ≈ your share of the hashrate
- Whole network: a block about every 10 minutes
- Why it secures the chain
- Hard to produce, trivial to verify (one hash)
- Rewriting old blocks means redoing all the work since
- Heaviest-chain (most-work) rule resolves forks
- 51% attack — limits
- CAN: double-spend own coins, censor, shallow reorg
- CANNOT: forge signatures, mint supply, undo old blocks
- Expensive and self-destructive to attempt
- The guessing game
A mixed recap pulling from the whole lesson:
What is a miner physically doing when mining a block?
Check your answer to continue.
Key Takeaways
What to remember
- Mining is a guessing game. A miner tweaks the nonce in the block header and re-runs it through double SHA-256, hunting for a hash below the target (enough leading zeros). There’s no shortcut — just guess, hash, check, repeat, trillions of times.
- It’s a lottery weighted by hashrate. Each hash is one independent ticket; your odds of the next block ≈ your share of total hashrate. The network is tuned so a winning ticket appears about every ten minutes.
- Hard to produce, trivial to verify. Finding a valid nonce is astronomically expensive; checking it is a single hash. That asymmetry lets anyone confirm a block without trusting the miner.
- Work = security. Rewriting an old block means redoing its proof-of-work and every block after it, faster than the honest network adds new ones. More confirmations = more buried work = effectively immutable.
- Heaviest-chain rule. Honest nodes follow the chain with the most cumulative work. Simultaneous blocks cause a temporary fork; the next block decides it, and the orphan’s transactions return to the mempool.
- A 51% attacker can double-spend their own recent coins, censor, and reorder recent blocks — but cannot forge signatures, steal arbitrary coins, mint extra supply, or cheaply undo old transactions. And it’s expensive and self-destructive.
- The energy is the point. Proof-of-work deliberately burns real electricity. Critics call it wasteful; proponents argue the cost is the security — the dollar value of the work is exactly what makes rewriting history uneconomic. A fair trade-off to weigh, not a settled verdict.
Proof-of-work answers who adds the next block and why we trust it. But it also quietly hands the winner freshly minted coins — and that raises the next question: where do new bitcoins come from, and why will there only ever be 21 million of them? Next up: the 21-million cap and halvings.