Proof of work
Making the right to add a page to the ledger cost real electricity. It is deliberately wasteful, and the waste is doing a job.
Somebody has to decide which transactions go in the next block. In a system where anyone can join and identities are free to create, letting participants vote is meaningless — one person can be ten thousand participants.
The solution: make participation cost something
Proof of work ties the right to propose a block to a resource that cannot be faked: computation, and therefore electricity. You cannot pretend to have done the work, because the work's output is checkable in microseconds.
The puzzle itself
A miner assembles candidate transactions into a block, then repeatedly changes one meaningless field — the nonce — and hashes the whole thing, looking for an output below a target value. Since hash outputs are effectively random, this is guessing, and the only way to guess faster is to own more hardware.
Suppose the rule is that a valid hash must begin with four zeros. Roughly one in 65,536 random attempts will qualify, so a machine doing a million attempts per second finds one roughly fifteen times a second. Require ten zeros and the expected search grows by a factor of nearly seventeen million. The difficulty knob is simply how many leading zeros are demanded.
Difficulty adjustment
If blocks are arriving faster than ten minutes apart, the target tightens. If slower, it loosens. This is why adding enormous amounts of hardware to the network does not produce coins faster — it produces the same number of coins, competed for more expensively. Every miner's individual incentive to expand is collectively self-defeating, which is a feature of the design rather than an accident.
What the energy buys
The accumulated work behind the chain is the cost of rewriting it. To reverse a transaction six blocks deep, an attacker must produce a longer competing chain from that point — redoing six blocks of work while the honest network extends its own.
The 51% attack, precisely
An attacker controlling a majority of hashing power can reliably outpace the rest and rewrite recent history. What that permits, and what it does not, is narrower than the name suggests.
- Possible: reversing their own recent transactions after taking delivery of something, and excluding transactions from blocks.
- Not possible: spending coins they have no key for, creating coins outside the rules, or altering history from years ago at any plausible cost.
The claim is not that an attack is impossible. It is that acquiring majority hashing power costs more than the attack could extract, and that succeeding would damage the value of the asset the attacker just spent a fortune to attack. Several smaller proof-of-work chains with less hashing power behind them have been attacked this way, which is the clearest evidence that the protection is a matter of cost rather than of cryptography.