Mining is guessing a number, and the guessing is the security model

Part one ended with two header fields I refused to explain: bits and nonce, a padlock we hadn't opened. Part two ended with signed, valid transactions sitting in the mempool, waiting for someone to make them permanent. Both cliffhangers are the same cliffhanger. The thing that turns a waiting transaction into settled history, and the thing that makes rewriting that history absurd, is one mechanism, and this post is where you finally run it.

Everything below is real. The chain your browser extends is the captured blocks 0–2 from part one (fetched from blockstream.info), the transactions in the toy mempool are real transactions from block 57055, and on the same date I captured the header of block 959,340 — the tip of the actual chain as I wrote this — so the difficulty numbers you'll see are the network's, not round ones I made up. The miner is not a progress-bar animation. It performs real double SHA-256, in your tab, and your CPU will notice.

01 · A ledger with no referee

Start with the attack the whole machine exists to stop. I own one coin. I sign two transactions spending it: one pays a merchant in Montevideo, the other pays an accomplice in Osaka. Both signatures are perfect — the part-two stack machine says yes to both, because each one is internally valid. Then I broadcast one to each half of the planet. That's the double-spend problem, and notice what it isn't: it isn't a forgery problem. Nothing is fake. The question is purely which valid thing came first, and "first" is exactly what a distributed system can't see.

This is the Byzantine generals' dilemma wearing a money costume: armies coordinating an attack by courier, where messages arrive late, arrive never, or arrive from liars, and everyone must still end up acting as one. Computer science ground on that problem from 1982 onward, and the classical solutions all assume you know who the participants are. Git has the same escape hatch, one layer up: a repo detects rewritten history, and then a human owner rejects it. Detection plus authority. Bitcoin's design goal was to delete the authority and keep the agreement — anyone can join, nobody signs up, and the network must still converge on a single order of events. Detection alone stops being enough the moment there's no one to complain to. Satoshi's answer wasn't a cleverer voting protocol. It was to make writing history cost something, and then let everyone independently prefer the history that cost the most. That's the whole trick. The rest of this post is just watching it work.

02 · The waiting room

Before a transaction is history, it's a rumor. You broadcast it, each node that hears it checks the signatures and scripts (every node re-validates everything; nobody trusts the messenger), and if it passes, the node drops it into its mempool — a patch of RAM where transactions wait to be mined — and gossips it onward. There is no the mempool. There are tens of thousands of them, one per node, each a slightly different view of the same rumor mill, which is precisely why "first" is unknowable: Osaka's mempools and Montevideo's mempools legitimately disagree about what they heard first, and both are right.

One 2026 reality worth being blunt about, because most older material (my own university notes included) tells it wrong: a transaction in the mempool is a bid, not a fact. Since Bitcoin Core v29 (2025), replacement is unconditional — anyone can re-spend the same inputs with a higher-fee version and nodes will relay the replacement, no opt-in flag required. The older etiquette, where nodes kept whichever version arrived first unless the sender had politely signaled replaceability, is gone. The mempool is an open auction: miners fill their candidate block with whatever bids pay the most per byte, and an unconfirmed payment to you can be outbid until the moment it's buried. "Zero-conf" was never safe; now it isn't even pretending.

So the auction has bids. What turns a bid into a fact is winning a block. Who gets to write the block?

03 · Open the padlock

Whoever guesses a number first. That's not a simplification — that is the mechanism. A miner assembles a candidate header exactly like part one's: prev_block pointing at the tip, merkle_root committing to the chosen transactions, a timestamp, and bits encoding a target. Then it varies the one meaningless field, nonce, hashing the 80 bytes over and over, until sha256d of the header lands below the target. There is no cleverness. SHA-256 has no known shortcut; every attempt is an independent lottery ticket; the target just decides how many tickets the winner should have expected to buy. And the asymmetry is the beautiful part: finding the nonce takes quintillions of attempts, but checking it takes anyone exactly one hash — you did that check in part one without knowing it, every time a figure said "below target".

Enough theory. Mine block 3 of an alternate 2009 yourself — the real block 2 as prev_block, three real transactions from part one's Pizza Day block as the payload, your clock as the timestamp:

Things worth watching for:

Drag the difficulty up one bit at a time. Each extra zero bit doubles the expected hashes, and you will feel every doubling as real seconds. 14 bits is a blink; 20 makes you wait; 24 makes you consider your life choices. The real network's current target demands about 79 zero bits.
Watch the near-misses stream by. Hashes with 9, 11, 13 leading zero bits, so close and worth exactly nothing — a hash either clears the target or it doesn't; there's no partial credit and no memory between attempts.
The winning nonce is meaningless. It proves nothing except that you burned the attempts. That's the point: it's a proof of work, not a proof of intelligence.
Compare your rate to the network's. The figure computes it live from your measured hash rate against the captured difficulty: the network currently performs on the order of 9×10²⁰ sha256d per second, and it redoes your last hour of mining in a few trillionths of a second.

Honesty about the toy: your slider tops out 51 bits short of reality, my miner is single-threaded JavaScript while real ones are warehouses of ASICs, and real miners don't just spin the nonce — they also grind the timestamp, version bits, and coinbase (the "extranonce") because 2³² attempts is nowhere near enough anymore. The rule they're satisfying, though, is byte-for-byte the one your browser just satisfied.

04 · The thermostat

The target isn't a constant — it's the network's thermostat. Here is the real tip of the chain as I wrote this, captured from mainnet, trimmed to the fields that matter:

$ curl -s https://blockstream.info/api/blocks/tip/hash
000000000000000000023647620d072d7ad419fcb0feffa204c35cc1a8b77be9

$ curl -s https://blockstream.info/api/block/000000000000000000023647…b77be9
{
  "height": 959340,
  "version": 537264128,        // 0x20060000 — BIP9 signal bits, as promised in part one
  "timestamp": 1784855994,
  "tx_count": 6300,
  "nonce": 1458680220,
  "bits": 386021021,           // 0x1702369d
  "difficulty": 127170500429035.19
}

That bits field is the same 4-byte compressed number from the genesis header, seventeen years later. Expand both and compare — the figure does it live from the captured bytes:

Things worth watching for:

Difficulty is just a ratio of targets. Genesis target divided by today's target ≈ 127 trillion, computed in your browser with exact integer math, matching the explorer's float to the decimal. Difficulty 1 means "about 2³² hashes per block" — hence the ×2³² in the expected-hashes line.
The retarget is a feedback loop, not a decision. Every 2016 blocks, each node looks at how long the last 2016 actually took versus the two weeks they should have taken, and rescales the target. More hashpower arrives → blocks come fast → target shrinks → blocks slow back down. Ten-minute blocks are not a constant of nature; they're a policy enforced by arithmetic, with nobody's hand on the dial.
The expected-hashes number is the security budget. ~5.5×10²³ attempts per block, around 79 zero bits. When part one said rewriting old history means re-mining everything above it, this is the per-block price.

05 · Two blocks, one height

Ten-minute averages mean occasional ties. My old course notes tell the story with geography, and I'm keeping it: a miner in America and a miner in Asia both find a valid block at the same height, seconds apart. Latency does the rest — nodes near America hear America's block first, nodes near Asia hear Asia's, and each side, following protocol to the letter, starts mining on the tip it saw. The chain forks, and nothing is wrong: no bug, no attack, just physics. What happens next is the part everyone hand-waves as "longest chain wins". The three competing blocks below are mined live in your browser at a toy difficulty — honestly labeled, every hash real — so you can step through what the nodes actually compare:

Things worth watching for:

The rule is heaviest, not longest. Nodes sum the expected work behind each chain (that's what the running tally shows). Length is the shorthand and it's usually the same thing — but a chain of many easy blocks loses to fewer hard ones, so work is what's compared.
The orphaned block's transactions go back to the pool. Nothing in 3A is invalidated by losing the race — the transactions not already confirmed on the winning chain simply return to the mempool as pending, and a later block picks them up. Losing a fork delays transactions; it doesn't destroy them.
The orphaned coinbase, though, dies. Miner A's 50 toy BTC existed only on a chain nobody follows anymore. This is why the protocol makes miners wait 100 blocks before spending a block reward, and why your payment is safe at a much shallower depth.
Confirmations are burial depth, nothing more. A transaction "has 6 confirmations" when 6 blocks sit on top of it — meaning a rewrite now needs to out-mine the entire network for 6 block-lengths. The famous "wait for 6" is that probability calculation rounded to a custom.

The forks above heal in minutes because both sides agree on the rules and merely disagreed on timing. When the rules themselves change, forks get intentional: backward-compatible tightenings (soft forks, like segwit) let old nodes keep following along, while incompatible rule changes (hard forks) split the network permanently if part of it refuses to upgrade — that's how Bitcoin Cash and Ethereum Classic became separate coins with a shared childhood. Same mechanism you just stepped through; the only difference is that nobody converges afterward.

06 · The bill

I've been describing the machine with admiration, so here's the invoice. Proof of work converts electricity into ordering, and the conversion is deliberately, irreducibly wasteful: the ~5.5×10²³ hashes behind each block compute nothing, verify nothing, and are thrown away — globally, an energy appetite comparable to a mid-sized country, spent on dice rolls. Defenders note it's the only known way to make a permissionless ledger cost real-world resources to attack; both things are true, and my course notes' blunt phrasing still holds: useless, wasted computation is the price of not having a referee.

The subtler cost is where the authority went. It didn't vanish — it moved to whoever has the most compute. A miner controlling a majority of the hashpower (not "51% of the nodes", as half the internet and my own old notes misquote it — your node count is irrelevant, your hash rate is everything) can outrun the honest chain: censor transactions, orphan competitors' blocks, even un-confirm recent history and double-spend it. And the economics push exactly that way: competitive mining now requires specialized, capital-intensive ASICs, so individual miners sell their hashpower to a handful of coordinating pools, and most days a small club of them could jointly cross the majority line. The system built to delete the trusted referee has evolved a shortlist of candidates for the job. Ethereum answered by switching to proof of stake in 2022 — replacing burned energy with locked capital, and trading this critique for new ones — but that's a different series.

07 · What's next

The mental model, compressed: consensus is "the heaviest pile of provably wasted electricity wins", checked independently by every node with one hash per header. The mempool is an open auction of bids; a block turns bids into facts; the target is a thermostat holding the fact-rate at ten minutes; forks are ties, resolved by weight; confirmations are burial depth.

And the padlock fields pay for the money itself: each block's coinbase mints the subsidy — 50 BTC in 2009, halved every 210,000 blocks, 3.125 since April 2024 (block 840,000), dropping to 1.5625 at block 1,050,000 around early 2028. Sum the geometric series and you get the famous ceiling: 210,000 × 50 × (1 + ½ + ¼ + …) = 21 million, with the last satoshi minted around 2140. After that, fees are the whole prize — the auction from section 02 quietly becomes the security budget.

Next in the series, storage: what a full node actually keeps on disk after 959,000 blocks, what it dares to throw away, and how the Merkle tree from part one lets a phone verify a payment with twelve hashes instead of 700 gigabytes. Same promise as always: it's bytes all the way down, and you can read every one of them.