1992-2008

Longest Chain

The idea of proving work by spending it — expensive to produce, free to check — is from 1992 and was invented to make junk mail cost something. What 2008 added was using it to decide whose version of history is real, and it did that with no authority and no vote. The rule is that the history everybody agrees on is whichever one was most expensive to produce, and everything strange about the arrangement follows from taking that literally. Nothing is ever final. A payment is only probably permanent, and how probably is a number you can compute. An attacker with enough of the hash power rewrites the past without breaking anything at all: they simply outspend everybody, and the same rule that protects the chain hands it to them.

A chain, the work behind it, and the race that decides

1 A hash chain, and what editing a block three back does to it

Three blocks, each naming its parent by hash. Edit the middle one and nothing is checked against a database: the hashes simply stop matching.

The middle block says

Each block: what it says, its hash, the nonce that found it, and whether it is still valid
#	contents	hash	nonce	state
0	the first block	00099b55442b20	866	valid
1	Alice pays Bob 10	00032366351266	4,265	valid
2	Bob pays Carol 4	000f504dc3052d	231	valid

broken by that edit: none: every block is still below the target
cost to make it stick: nothing to redo

The chain holds: every block hashes to something below the target and each names the one before it.

2 Work: a hash below a target, expensive to find and free to check

A block only counts if its hash starts with enough zeros. Finding one takes as many tries as the target demands; checking it takes one.

The target: 3 leading zeros, so about 4,096 tries expected

work to build it: 5,365 hashes for 3 blocks
work to check it: 1 hash, whoever is asking

That asymmetry is the whole mechanism. It is not that forging a block is forbidden; it is that it costs the same as making one honestly, and then the honest chain has moved on.

3 Two histories from one parent, and the one that survives

Two chains from one parent. The rule picks the one with more work behind it, so an attacker is not breaking anything — they are racing.

The attacker has: 30 per cent of the hash power

Starting: 3 blocks behind

4 An attacker's share of the hash power, raced thousands of times

Nakamoto's formula says: 7.87 per cent
racing it out says: 8.57 per cent over 3,000 races
do they agree: the formula and the races agree

An attacker with 30 per cent of the hash power, 3 blocks behind, catches up with probability 7.87 per cent. That is why waiting for more blocks is the only thing that makes a payment safer, and why it never makes it certain.

How many blocks to wait before the odds fall below one in a thousand.

Each attacker share, the blocks needed, and the odds at that depth
attacker has	wait for	odds then
10 per cent	4 blocks	0.02 per cent
20 per cent	5 blocks	0.10 per cent
30 per cent	9 blocks	0.05 per cent
40 per cent	18 blocks	0.07 per cent

What this page checked when it loaded.

Each claim, whether it held, and the values behind it
claim	held	measured
SHA-256 of the empty string matches the published value	yes	e3b0c44298fc1c14…
and of "abc", likewise	yes	ba7816bf8f01cfea…
finding a hash with three leading zeros took thousands of tries	yes	4,552 tries
and checking it takes exactly one	yes
the catch-up formula agrees with a simulation of 4,000 races	yes	formula 7.9 per cent, simulated 8.4
at half the hash power catching up is certain, given time	yes

All 6 checks held when this page loaded.

What is real here, and what is not

The hashing is real; the difficulty is a millionth of a millionth of real

This is genuine SHA-256 over a genuine byte string, and the tries counted are tries actually made. What is not real is the target: three leading hex zeros is about four thousand attempts, and bitcoin's target in 2026 is around ninety zeros' worth of difficulty, which is a number of hashes with more than twenty digits in it. The mechanism is identical and the scale is not remotely.

There is no network here, and the network is where it gets hard

One machine, no peers, no propagation delay, no orphaned blocks, no mempool and no difficulty adjustment. Blocks arriving at different times at different places is what makes a fork happen in the first place, and selfish mining — where withholding a block beats publishing it — is a real result that this model cannot express at all. The race here is a random walk, which is Nakamoto's own simplification and not a simulation of a network.

The catch-up formula is the paper's, and it assumes an attacker who never gives up

The expression is from section 11 of the 2008 paper: an attacker with q of the hash power, z blocks behind, catches up with probability (q/p) to the power z. It assumes they keep trying forever and that the honest chain grows at a constant rate. The simulation beside it is a bounded random walk, so a race that would take longer than two thousand steps is counted as a loss, which makes the simulated figure very slightly low rather than high. It is checked against the formula rather than trusted on its own.

Fifty per cent is not a cliff, and the page tries not to draw one

Below half the hash power the odds fall off exponentially with depth; at half and above they are one, from any distance, given time. It is a genuine discontinuity in the formula. But an attacker at forty-five per cent already catches up from three blocks behind more than half the time, so the interesting region starts long before the famous number, and treating the majority threshold as the point where security stops is the wrong reading of it.

Proof of work is from 1992 and was not invented for this

Dwork and Naor proposed it to make sending junk mail cost the sender something: a puzzle expensive to solve and cheap to verify, attached to each message. Hashcash reused it against spam in 1997. What 2008 contributed was not the work but what the work is FOR — using accumulated cost as the rule that decides which history everybody follows — which is why the era on this page starts sixteen years before the paper it is about.

Sources

Logical Art builds interactive explanations of difficult machines.

The machines:

1935-1991 RangekeeperThe answer is on both sides of the equation, so it had to be a machine.
1964-1990s AbendThe loop you did not write, and the day it cost to get it wrong.
1975 Front PanelA working 1975 Altair 8800 you program by flipping switches.
1980s 300 BaudA real dial-up modem and the BBS on the other end of it.
1994 WinsockThe two seconds after the modem stopped screeching, before anything worked.
2020s LLM LabTrain a tiny language model and watch every number as it learns.

Smaller pieces, on the studio itself: Morse, Baudot, Punch Cards, Interlace, Bitwise, Stored Program, Trigger, Bit, Nibble, Byte, Transistor, Hamming, Huffman, Core Memory, The Interrupt, Score Reel, CRC, Page Fault, ASCII, CPU Cache, Race, Fifteen Planes, B-tree, Backoff, Checkout, Diffie-Hellman, Fringes, LZ77, Zero Address, Signature, Z-Characters, Merkle Proof, Branch Prediction, Interleave, Eight Sprites, DNS, Floating Point, Slow Start, UTF-8, Write-Ahead Log, JPEG, Masking, PageRank, Merge Collapse, Merkle DAG, Count Distinct, Longest Chain.

A Logical Art machine by RoamingPigs, Inc. Built by Cisco Caceres in Las Vegas, NV.