Proof of work, and why the chain is expensive to rewrite

A single valid hash proves almost nothing. Any miner will eventually find one, and a lucky machine could find several in a row. What secures the chain is the total work embedded in it: the sum of the expected hashes behind every block from the genesis block to the tip. Each block adds to that total in proportion to the difficulty at which it was mined, so the chain's weight is a running record of how much computation has been spent on it.

Nodes do not follow the longest chain; they follow the chain with the most accumulated work. The distinction matters whenever difficulty has changed, because a shorter chain mined at a much higher difficulty can outweigh a longer one mined at a lower difficulty. In practice the two rules agree almost always, since difficulty adjusts slowly, but the work rule is the one the protocol actually enforces.

This is what makes a deep confirmation meaningful. To rewrite a block that sits six blocks below the tip, an attacker must produce an alternative chain from that point that accumulates more work than the chain everyone else has been extending — and must do so faster than the honest network adds new blocks. The attacker's expected cost is therefore not the cost of the original blocks but the cost of outrunning the entire network for as long as the reorganisation takes. The deeper the block, the more work stands on top of it, and the more implausible that becomes.

The whitepaper framed the same argument probabilistically: an attacker's chance of catching up decays geometrically as the honest chain extends, so a merchant who waits for a handful of confirmations can bound their exposure to a chosen probability. The security is not absolute and never was claimed to be. It is a cost function, and the cost is paid in electricity by everyone competing to extend the chain.

The energy expenditure is not a side effect that the design failed to avoid; it is the mechanism itself. A chain that was cheap to extend would be cheap to rewrite, and a history that anyone can rewrite at low cost is not a settlement record. Proof of work converts an external, physical cost into an ordering of transactions that every participant can verify independently, without trusting any authority to tell them which history is real.

Verification is the other half of the asymmetry. Producing a valid block requires an enormous number of hashes; checking one requires a single hash of the header plus a check of the target. A full node running on modest hardware can verify the entire chain's work in far less time than it took to produce, which is why the security model scales: the cost falls on those who want to extend or rewrite the chain, and almost none of it falls on those who merely want to check it.

The difficulty adjustment is what keeps this arrangement stable as hardware improves and participants enter and leave. It is covered in detail on the difficulty adjustment page, and the rate at which the network performs that work is the subject of the hashrate page. Readers who want the supply side of the same mechanism should start from the supply schedule.