Proof of work vs proof of stake: how blockchains agree, and the trade-offs

Every blockchain faces the same problem: thousands of computers that don’t trust each other must agree on a single record of who owns what, without a central authority deciding. The method they use is called a consensus mechanism. The two best known are proof of work, used by bitcoin, and proof of stake, used by Ethereum since 2022.

This guide explains how each works, how they defend against attacks, the energy debate and the trade-offs, with each side’s arguments attributed to its own documentation.

Proof of work: security from computing power

Bitcoin’s white paper describes proof of work: miners repeatedly hash a block until they find a result with enough leading zeros, which takes huge amounts of work to find but a moment to check. The chain with the most work behind it is the valid one, so rewriting history means redoing all that work faster than everyone else.

Bitcoin.org describes mining as a competitive lottery that makes it very difficult for anyone to add several blocks in a row. That protects the network’s neutrality by stopping any individual from blocking certain transactions or rolling back their own payments. See bitcoin mining explained.

How a bitcoin block gets made

The Bitcoin developer documentation describes the process:

1. A miner gathers waiting transactions into a candidate block and hashes its header again and again, changing a small value each time, until the result falls below a target.
2. The lower the target, the more attempts are needed on average, which is what makes a valid block costly to find but quick to check.
3. Every 2,016 blocks, the network checks how long those blocks took. The ideal is 1,209,600 seconds (two weeks), or about 10 minutes per block. If blocks came faster, the difficulty rises; if slower, it falls, within set limits.
4. If two miners find a block at almost the same time, the chain briefly splits. Nodes follow the chain that is most difficult to recreate and discard the stale block once one side pulls ahead.

Because each block is chained to the one before, changing an old transaction means redoing that block and every block after it. The developer guide notes that the cost of modifying a block increases with every new block added.

Proof of stake: security from collateral

In proof of stake, there’s no mining race. Instead, validators lock up coins as a stake. On Ethereum, ethereum.org explains:

• validators must stake at least 32 ETH;
• the network can destroy staked ether to punish validators who misbehave, which is called slashing;
• blocks backed by votes from at least two-thirds of the stake become finalized, meaning they can’t be removed or reorganized.

Ethereum moved from proof of work to proof of stake in The Merge on 15 September 2022. See what is crypto staking?

How an Ethereum block gets made

ethereum.org explains that, unlike proof of work, where timing depends on mining difficulty, proof of stake has a fixed tempo:

1. Time is divided into slots of 12 seconds and epochs of 32 slots.
2. In every slot, one validator is randomly selected to propose a block.
3. Also in every slot, a randomly chosen committee of validators checks the block and votes for it. These votes are called attestations. Committees keep the network load manageable, and every active validator attests once per epoch.
4. The first block of each epoch is a checkpoint. When a pair of checkpoints gets votes representing at least two-thirds of all staked ETH, the newer one becomes justified and the older one finalized.

Once a block is finalized, ethereum.org says reverting it would require an attacker to lose at least one-third of all staked ETH, which makes it economically unviable.

How attacks are discouraged

Both systems aim to make cheating more expensive than it’s worth.

Proof of work: an attacker needs more computing power than the honest miners combined. The bitcoin white paper argues that someone with that much power should find it more profitable to follow the rules and earn new coins than to undermine the system.

Proof of stake: an attacker needs a large share of all staked coins. ethereum.org says that with more than a third of the stake an attacker could disrupt finality, but would lose their stake through slashing and be ejected, and would need to rebuild that stake to try again.

Penalties in proof of stake, in practice

ethereum.org separates ordinary penalties from slashing:

• Missing votes: a validator that misses its votes loses about what it would have earned for them. There’s no penalty for failing to propose a block; it just misses the reward.
• Slashing: for dishonest behavior, namely proposing two different blocks for the same slot, or casting contradictory votes. A slashed validator takes a small immediate penalty and is forced out over 36 days, with a further “correlation penalty” on day 18. That penalty is bigger when many validators are slashed around the same time: from less than 0.1% of the stake for a single validator slashed on its own, up to 100% in a mass slashing.
• Inactivity leak: if more than a third of the stake goes offline and the chain fails to finalize for more than four epochs, the stake of the inactive validators gradually drains until the remaining validators hold a two-thirds majority again and can finalize the chain.

The design means a coordinated attack is very costly, while an honest validator with a brief outage mainly loses the rewards it missed.

NIST’s blockchain overview notes that both models face the possibility of a 51% attack, by obtaining enough computing power or enough financial power. See what is a 51% attack?

The energy debate

This is where the two sides differ most.

• ethereum.org cites an estimate by the Crypto Carbon Ratings Institute that The Merge cut Ethereum’s annualized electricity consumption by more than 99.988%, and its carbon footprint by about 99.992%.
• Bitcoin.org argues that spending energy to secure and operate a payment system is hardly a waste, pointing out that banks, card networks and armored vehicles also use a lot of energy, though their total use is less transparent. It adds that mining hardware has become more specialized and efficient over time, and that miners stop when it becomes unprofitable.

Decentralization and fairness

• ethereum.org argues proof of stake is more decentralized, because mining hardware arms races tend to price out individuals, while in staking the cost and percentage return are the same for everyone. It also acknowledges centralization concerns because a few large liquid staking providers manage large amounts of staked ETH. See liquid staking explained.
• Bitcoin.org notes that in bitcoin’s early days anyone could mine with a computer’s processor, but that today the only cost-effective method is specialized hardware.

Side by side

What it means for you

• As a user, you rarely notice the consensus mechanism directly when you send or receive crypto.
• As an investor, consensus mechanism is one factor among many, and no mechanism removes price risk.
• If you stake or mine, read about the specific risks and taxes. See crypto staking taxes.

For more background, see bitcoin vs Ethereum and the bitcoin white paper explained.