Bitcoin and Crypto, Explained: From Simple to Complex

What money does Simple

Before we can understand Bitcoin, we have to understand money itself. Money is anything people agree to use for three jobs:

Money is not a fixed thing. It has changed shape many times over thousands of years, and each change looked strange to the people living through it.

From cows to code Simple

Money has been upgraded four big times. Tap or click any stop on the timeline to open the story behind it.

Look at the quotes. When coins arrived, people said they could not eat gold or milk silver. When paper arrived, a scrap of paper felt worthless next to the weight of a coin. When money became numbers on a screen, people wanted bills they could hold. That is the backdrop for Bitcoin.

Enter Bitcoin Simple

On October 31, 2008, someone using the name Satoshi Nakamoto published a nine page paper called Bitcoin: A Peer to Peer Electronic Cash System. On January 3, 2009, the network produced its first block. Nobody knows for certain who Satoshi is, and the network has kept running without them since 2010.

Bitcoin is fully digital money that moves between people without a bank, card company or government in the middle. Three traits make it different:

And yes, it met the same resistance as every money before it: "it's not real money," "you can't touch it," "it's just internet magic." The same things were said about coins, paper and cards.

How money works right now Simple

When your paycheck lands, no truck delivers bills to your house. Your bank adds a number to a row in its ledger, a private database with your name on it. When you pay rent, the bank subtracts from that row and tells another bank to add to someone else's. Your "money in the bank" is really the bank's promise, written in the bank's records.

For most people, most of the time, that works well. Deposits are insured up to limits, and payments settle smoothly. But it means you do not control your own ledger. Someone else holds the record and can decide, for their own reasons or under orders, when and how much of your money you can reach. That has happened many times:

The same is true of crypto held by a company. In 2022 Celsius froze withdrawals for its roughly 1.7 million customers, and FTX stopped withdrawals days before filing for bankruptcy. FTX customers were later projected to recover more than their claims, but they waited years. If an exchange holds your keys, it holds your ledger too. Celsius · FTX

That is the core idea behind Bitcoin: a ledger nobody owns. Bitcoin held with your own keys sits on a public record that no single bank, company or government controls. Nobody can freeze it, and nobody can rescue it if you lose the keys. That tradeoff runs through the rest of this guide.

What a bitcoin costs Simple

There is no official price of bitcoin. The price is whatever buyers and sellers agree to on exchanges around the world, minute by minute, every day of the year. Here is the live price right now:

Bitcoin's price has been famously volatile. A few milestones show the scale:

Big drops happened along the way too, several of more than 70 percent from a peak. The price moves with demand, news, interest rates and the halving cycle, while the supply schedule stays fixed. See the history of bitcoin for the full story.

The Bitcoin team Simple

Three kinds of participants keep Bitcoin running. Think of them as a team where nobody is the boss.

Jargon in plain English Simple

Bitcoin people borrowed words from gold rushes and lotteries. Here is what they actually mean:

Wallets and keys Simple

Every wallet is built on a pair of keys. The easiest way to picture them is a mailbox.

• Public key or address: like your mailing address. You give it to anyone who wants to send you bitcoin.
• Private key: like the only key to the box. Whoever has it controls the coins, so it stays private.
• Software wallets are apps on a phone or computer. Hardware wallets are small devices that keep the keys offline.
• Seed phrase: most wallets show 12 or 24 ordinary words when you set them up. Those words can rebuild every key in the wallet, so anyone who sees them can take the coins.

Small change: satoshis Simple

You do not have to buy a whole bitcoin. Each bitcoin divides into 100,000,000 satoshis, or "sats," named after the creator. A dollar can buy sats the same way it can buy a fraction of a share of stock. The live box above shows how many sats a dollar buys right now.

Bitcoin and the crypto family Simple

"Crypto" covers thousands of digital assets. They fall into a few families:

Bitcoin is the oldest and the largest by market value, and it does one thing: move and store bitcoin. Most other networks add programmable features on top. Part 3 covers how they differ.

Everything else, simply Simple

Parts 2 and 3 go deep. Before we get there, here is every big idea in a few plain sentences. Tap a topic to open it; opening one closes the last. Each has a link to the deeper version.

How a payment travels Medium

Say Alice sends Bob 0.01 BTC. Here is the trip that payment takes:

Notice who is missing: no bank approves the payment. The rules are checked by thousands of independent nodes, and the ordering is settled by miners competing to add the next block.

Blocks and the chain Medium

A block is a page in the ledger. It holds a batch of transactions plus a short header. The header includes a fingerprint, called a hash, of the block before it. That is what chains the pages together.

This is why the ledger is called tamper evident. Every node can recompute the hashes in seconds and spot an edit immediately.

Inside an ASIC Medium

ASIC stands for Application Specific Integrated Circuit: a computer chip built to do exactly one task. A Bitcoin ASIC runs one calculation, SHA‑256, over and over at enormous speed. Here is a common workhorse model, the Bitmain Antminer S19 XP:

Hash rate and its units Medium

Every guess an ASIC makes is called a hash. Hash rate is guesses per second. The numbers get large quickly, so they use the same prefixes as computer storage:

For perspective: if all 8 billion people on Earth each made one guess per second, together they would still be about 17,000 times slower than a single S19 XP.

From laptops to ASICs Medium

In 2009 Satoshi mined the first blocks on an ordinary computer, and anyone with a laptop could earn coins. Gamers then found graphics cards were far faster. From 2013 on, purpose built ASICs took over, and mining moved from bedrooms to industrial buildings.

Solo mining and pools Medium

A new block arrives about every 10 minutes, and only one miner wins each one. One S19 XP has about 141 TH/s against a network near 1,000,000,000 TH/s. On average, a single machine mining alone would find a block roughly once every 135 years. It could happen tomorrow, or not once in the machine's working life.

That is why nearly all mining runs through pools. Machines send the pool small proofs of work called shares. When anyone in the pool finds a block, the payment is split by each member's shares. Pools pay in different ways. Some pay for every share whether or not a block is found, and others pay only from the blocks the pool actually finds. A pool's choice of method and fee changes what a machine earns on a given day.

Supply and the halving Medium

New bitcoin enters circulation only as payment to miners. The payment per block started at 50 BTC and is cut in half every 210,000 blocks, about every four years. That event is the halving. It is why the supply approaches 21 million but stops short, with the last fractions due around the year 2140.

Every halving, past and future

Past dates are actual. Future dates are estimates at the 10 minute target pace from block 972,522 (October 21, 2026); recent blocks have averaged about 9.4 minutes, so the real dates tend to come a little earlier. The reward is halved by shifting the satoshi amount, so it reaches exactly zero at the 33rd halving, block 6,930,000, around 2140. Total issued then: 20,999,999.9769 BTC.

By late 2026 roughly 20 million of the 21 million bitcoin exist. Today the network issues about 450 new BTC per day: 144 blocks times 3.125 BTC. A halving cuts that in half overnight, which is why miners plan around it. A case we covered, a dispute that turned on halving timing, shows how much rides on that date.

Fees and the waiting room Medium

Each block has limited space, about 4 million "weight units," which usually fits a few thousand transactions. When more people want in than will fit, they bid with fees. Fees are quoted in sats per virtual byte (sat/vB), because bigger transactions use more space. Miners usually fill blocks with the highest paying transactions first.

The mempool is the waiting room. On a quiet day a low fee clears in the next block or two. During a rush, low fee payments can wait for hours or days. Miners collect these fees on top of the block reward, and as halvings shrink the reward, fees become a larger share of what keeps miners running.

Power and the grid Medium

Every hash costs a little electricity, and the network makes about a billion trillion hashes per second, so Bitcoin mining uses a lot of power. A 2025 University of Cambridge study estimated about 138 TWh per year, roughly 0.5% of the world's electricity. The same survey found 52.4% of mining power came from sustainable sources (42.6% renewables and 9.8% nuclear), up from 37.6% in 2022, while coal fell from 36.6% to 8.9% and natural gas rose to 38.2%. In the United States, the Energy Information Administration estimated in 2024 that crypto mining used 0.6% to 2.3% of the country's electricity.

The unusual part: miners can switch off in seconds

Most big power users cannot stop on short notice. A hospital, a steel mill or a data center serving websites has to keep running. An ASIC can power down in seconds and restart later, losing only the bitcoin it would have earned in between. That makes a mining site one of the most flexible loads a grid can have: it soaks up spare power when there is plenty and hands it back when there is not.

When it has actually happened

• Winter Storm Uri, February 2021, Texas. As the grid neared collapse, mining sites shut down. ERCOT paid one Rockdale mine an average of about $175,000 an hour for the power it gave back. The Independent
• July 2022 heat wave. ERCOT set a record peak of 78,206 MW. The Texas Blockchain Council said miners returned more than 1,000 MW for stretches of 10 hours or more, and Riot Platforms alone curtailed 11,717 MWh that month. Texas Tribune · Decrypt
• Winter Storm Elliott, December 2022. According to an ERCOT task force presentation, large flexible loads cut their use from 1,530 MW to 130 MW, a 96% response, and all 20 tracked sites curtailed. The same month ERCOT created a voluntary curtailment program for large flexible loads "such as bitcoin mining facilities." ERCOT task force deck · ERCOT
• August 2023 heat. Riot reported $31.7 million in power and demand response credits for one month, curtailing more than 95% of its load at peak times. Riot Platforms
• January 2024 freeze. Network hash rate fell about 34% in four days as Texas miners powered down. Cointelegraph
• January 2026 winter storm. The Foundry USA pool's hash rate dropped from about 260 to 124 EH/s in two days as US miners eased load on stressed grids. Decrypt

Why grid planners care

ERCOT lets qualifying flexible loads register as Controllable Load Resources, dispatched in real time like a power plant, and counts a reduction in load the same as added generation. ERCOT explainer. A 2025 Duke University study found US grids could add about 76 GW of new demand if those loads agreed to curtail just 0.25% of the year. Utility Dive. Researchers at Cornell estimated mining revenue could help fund new solar and wind projects by buying their power before transmission is built. Cornell. Some companies also run miners on natural gas that oil fields would otherwise flare. Crusoe

The other side of the debate

Critics raise real points. An ERCOT staff analysis found that loads curtailing on their own, outside formal programs, make demand harder to forecast. Advocacy groups cite estimates that mining raises Texas power costs. Earthjustice. Neighbors of some sites have sued over noise, a case we covered in the Granbury noise lawsuits, and a 2025 Harvard study linked large mines to higher fine particle pollution near the power plants that supply them. Harvard. For how curtailment works in power contracts, see curtailment explained.

Inside a hosting facility Medium

Most of the world's ASICs do not sit in anyone's garage. They run in hosting facilities: sites built to deliver a lot of electricity, move a lot of air and keep thousands of machines online. Owners of the machines often pay a host, usually per kilowatt hour, to provide the power, space, cooling, internet, security and day to day care. (For how those deals are written, see reading a hosting agreement.)

The pieces of a site

• Substation and transformers. Grid power arrives at high voltage. A substation and pad mounted transformers step it down to the voltage the machines' power supplies use.
• Containers or buildings. Many sites use shipping container style "mobile data centers." They are built in a factory, set on simple foundations and can be moved if the power deal changes. Others use large metal buildings.
• Racks, breakers and network. Inside, machines sit on shelves wired to breaker panels, and every machine has a network cable back to switches that connect the site to its mining pool.
• Monitoring. Software watches every machine's hash rate, temperature, fan speed and errors around the clock, so technicians know which unit needs attention.

Air in, air out

Nearly every watt a machine uses turns into heat, so an air cooled site is really a giant air handler. Outside air comes in through filters, passes over the machines and leaves as hot exhaust.

For more on how air moves through these sites, see hot air and cold air, and for the electrical side, power basics for ASIC sites. Disputes over hosted machines are the subject of my ASIC hosting expert witness page.

Stablecoins and networks Medium

Not all crypto swings in price. Stablecoins are tokens designed to stay at one dollar each. They pair the speed and reach of crypto with the steady value of a dollar, and they live on a blockchain instead of in a bank.

The same token can live on several networks. ERC‑20 means a token on Ethereum, the original smart contract chain, where fees are usually higher. TRC‑20 means a token on Tron, built for low fees and fast transfers. Sending a token on the wrong network is a common way to lose it, which is why exchanges ask you to pick the network on every withdrawal. In the United States, the GENIUS Act, signed in July 2025, set the first federal framework for payment stablecoins.

Exchanges, self custody and scams Medium

There are two basic ways to hold crypto:

Because crypto payments are fast and hard to reverse, they attract fraud. The FBI's Internet Crime Complaint Center and the FTC have published warnings about patterns like these:

• Guaranteed returns. Investment or "cloud mining" offers promising fixed daily profits.
• Romance and "pig butchering" schemes. A new online friend steers you to a trading site that shows fake gains.
• Fake support. Someone posing as an exchange or wallet company asks for your seed phrase or remote access.
• Giveaways. "Send 1 BTC, get 2 back," often with a deepfaked celebrity video.

The common thread: real wallet companies do not ask for your seed phrase, and real investments do not promise fixed profits.

Proof of work under the hood Complex

The "math puzzle" miners solve is simple to state and very hard to shortcut. A miner takes the 80 byte block header and runs it through SHA‑256 twice. The output is a 256 bit number. If that number is below a target set by the network, the block is valid. If not, the miner changes a field called the nonce and tries again.

Two properties make this work. A hash is easy to check: any node verifies a winning block with a single calculation. It is impossible to predict: changing one bit of input scrambles the whole output, so the only strategy is brute force. That asymmetry is the heart of proof of work. Finding a block is expensive and verifying it is nearly free.

The 32 bit nonce gives only about 4.3 billion tries, which a modern ASIC burns through in a fraction of a millisecond. Miners also vary an "extra nonce" inside the first transaction of the block, which changes the Merkle root and opens a fresh set of tries.

Going deeper: the header, the target and the hash

From bits to target. The compact "bits" field holds an exponent byte and a 3 byte coefficient:

The genesis block used bits 0x1d00ffff, so its target was 0xFFFF × 2²⁰⁸. That is the "difficulty 1" target, and difficulty is defined against it:

Rearranged for a 600 second block: difficulty ≈ network hash rate × 600 ÷ 2³². At about 1 ZH/s (10²¹ hashes per second) that gives a difficulty near 1.4 × 10¹⁴, about 140 trillion, which is the scale of the number published on block explorers.

Inside SHA‑256. SHA‑256 works on 512 bit chunks. Each chunk is expanded into a 64 word message schedule and pushed through 64 rounds that mix eight 32 bit working words with rotations, additions and the Ch, Maj and Σ functions. The 80 byte header fills one full chunk plus part of a second. Because the first 64 bytes do not change while a miner rolls the nonce, ASICs compute that first chunk once (the "midstate") and then only run the second chunk and the outer hash on each try. Roughly two compression passes per nonce instead of three.

AsicBoost. In 2016 Timo Hanke described a way to reuse part of the message schedule across tries by finding headers that share the last 4 bytes of the Merkle root. The open version of the trick rolls bits in the version field, which BIP 320 set aside for that purpose, and it is now standard in mining firmware and pool protocols. Miners also roll an extranonce inside the coinbase transaction and, within limits, the timestamp, which gives effectively unlimited search space.

The difficulty adjustment Complex

If more machines join, blocks would come faster than every 10 minutes. Bitcoin corrects for that on its own. Every 2,016 blocks, about two weeks, each node compares how long those blocks actually took with the 20,160 minute goal and moves the target. A single adjustment can change difficulty by up to a factor of four in either direction.

This is why a miner's output depends on everyone else. Add the same machine to a network that grew 10 percent and it earns about 10 percent less bitcoin, with no change in the machine itself.

Going deeper: the retarget formula and block timing

1,209,600 seconds is two weeks: 2,016 blocks times 600 seconds. The measured time is clamped between one quarter and four times that span, which limits any single change to a factor of four. A higher target means an easier puzzle. A quirk of the original code measures 2,015 intervals instead of 2,016, one of several edge cases, along with the "time warp" timestamp trick, that the proposed Great Consensus Cleanup soft fork would tidy up.

Timestamp rules. A block's time has to be later than the median of the previous 11 blocks, and no more than two hours ahead of a node's network adjusted clock. Miners have some freedom inside that window, which is why block times are not strictly increasing.

Blocks arrive randomly. Finding a block is a memoryless process, so block intervals follow an exponential distribution with a 10 minute mean. The chance of waiting longer than t minutes is e^−t/10: about 37% of blocks take longer than 10 minutes, about 5% longer than 30, and about 0.25% longer than an hour. Long gaps are normal, not a sign that something broke.

Mining economics, the math Complex

A machine's share of new bitcoin is its share of the network's hash rate. Everything else follows from three formulas:

Here is a worked example using round numbers: network hash rate of 1,000 EH/s, a bitcoin price of $100,000 and power at $0.05 per kWh. These are illustrations, not current prices or a forecast.

"Other costs" is doing a lot of work in that last row: pool fees, hosting or facility costs, repairs, labor, financing and taxes all come out of it. The difference also moves every day with price, difficulty and fees. A small grid makes the point for one machine:

Two numbers summarize a machine. Hashprice in this example is $45 per PH/s per day (450 BTC × $100,000 ÷ 1,000,000 PH/s). Breakeven power price is what the machine earns per kWh it uses: $6.35 ÷ 72.24 kWh, or about $0.088 per kWh. A more efficient machine, with fewer joules per terahash, has a higher breakeven, which is why efficiency drives which models stay switched on. For how power contracts and curtailment fit in, see curtailment explained and power basics for ASIC sites.

Live: today's numbers in the same formulas

The worked example above uses round numbers. This panel pulls live data and runs the same math for one Antminer S19 XP (141 TH/s, 3,010 W) at $0.05 per kWh:

Going deeper: variance, payouts and breakeven efficiency

Luck is Poisson. A miner with hash rate h on a network with hash rate H expects λ = 144 × h/H blocks per day. The chance of finding at least one block in a day is 1 − e^−λ, and the standard deviation of the count is √λ. A 1.41 EH/s site on a 1 ZH/s network expects about 0.2 blocks a day: solo, it could go a week with nothing, then hit two in an afternoon. Pools exist to flatten that curve.

How pools pay. A share is a hash that beats an easier pool target with difficulty d. Its expected value is:

Under FPPS (full pay per share) the pool pays that expected value for every share right away and absorbs the luck. Under PPLNS (pay per last N shares) miners are paid from blocks the pool actually finds, split across the most recent shares, so miners carry the luck in exchange for a lower fee. Newer pools also offer TIDES and similar variants. The pool protocol itself is changing too: Stratum V2 encrypts the connection and lets miners build their own block templates instead of taking the pool's.

Breakeven efficiency. Divide hashprice per TH/s per day by the cost of running one joule per second for a day:

With hashprice at $45 per PH/s per day ($0.045 per TH/s) and power at $0.05, breakeven is 0.045 ÷ 0.0012 = 37.5 J/TH. Any machine more efficient than 37.5 J/TH covers its electricity at those numbers. The S19 XP at about 21.4 J/TH uses 57% of its revenue on power; a 2025 machine near 12 J/TH would use about a third. That ratio, not the hash rate alone, decides which machines stay switched on when hashprice falls.

What 10,000 machines look like Complex

Multiply one machine by ten thousand and mining becomes heavy industry. Using the same S19 XP figures:

Behind those numbers is a long list of physical systems: substations and transformers, medium and low voltage distribution, racking, fiber, monitoring, and cooling. Most air cooled sites use the same idea as a data center, separating cool intake air from hot exhaust:

For photos of a real site, from the substation to the exhaust fans, see inside a hosting facility.

Coins, keys and signatures Complex

Bitcoin does not track account balances. It tracks individual chunks of bitcoin called UTXOs, unspent transaction outputs. Your "balance" is the sum of the UTXOs your keys can unlock. To pay, a wallet spends whole UTXOs and sends any extra back to you as change, like paying with a $20 bill.

Ownership is proven with digital signatures on the secp256k1 curve. Bitcoin launched with ECDSA signatures and added Schnorr signatures with the Taproot upgrade in November 2021. The private key signs, and anyone can check the signature against the public key without learning the private key. Address formats tell you which script locks the coins:

Going deeper: the curve and the signature math

Bitcoin keys live on the elliptic curve secp256k1: y² = x³ + 7, over the prime field p = 2²⁵⁶ − 2³² − 977. A private key is a random number d between 1 and n − 1, where n ≈ 1.16 × 10⁷⁷. The public key is the curve point P = d·G, the generator point added to itself d times using fast doubling. Going forward takes microseconds. Going backward, finding d from P, is the elliptic curve discrete logarithm problem, with no known shortcut on classical computers.

The nonce k has to be secret and unique to every signature. Reusing it across two signatures lets anyone solve for the private key, which is exactly what happened to some Android Bitcoin wallets in 2013 when a faulty random number generator repeated nonces. Modern wallets derive k deterministically from the key and message (RFC 6979). Schnorr signatures are linear, so keys and signatures can be added together: several signers can produce one ordinary looking signature (MuSig2, BIP 327), and nodes can verify many signatures in one batch.

A transaction, field by field: version; a list of inputs (each pointing to a previous transaction id and output index, plus an unlocking script or witness and a sequence number); a list of outputs (an amount in satoshis and a locking script); and a locktime. The transaction id is the double SHA‑256 of everything except the witness data.

Script, SegWit and Taproot Complex

Every output is locked by a tiny program in Bitcoin Script, a stack based language with no loops, so every script finishes in predictable time. To spend, you supply data that makes the script finish with "true." The classic pay to public key hash lock is:

The spender provides a signature and public key. The script duplicates the key, hashes it, checks it matches the locked hash, then checks the signature. Other opcodes build multisig ("2 of 3 keys"), absolute timelocks (OP_CHECKLOCKTIMEVERIFY, BIP 65) and relative timelocks (OP_CHECKSEQUENCEVERIFY, BIP 112), the building blocks of Lightning and vaults.

SegWit (August 2017, BIP 141) moved signatures into a separate "witness" area. That fixed transaction malleability, where a third party could alter a transaction id before confirmation, which Lightning needed. It also changed how size is counted:

Witness bytes cost a quarter of other bytes, which is why fees are quoted per vbyte. Since 2023, "inscriptions" have used that cheap witness space to store images and text, which pushed fees up at times and is still debated.

Taproot (activated November 2021 at block 709,632) bundled three proposals: BIP 340 (Schnorr signatures), BIP 341 (Taproot outputs) and BIP 342 (Tapscript). A Taproot output key is an internal key tweaked by the hash of a tree of scripts:

If everyone agrees, coins move with one signature for Q (the key path), and the spend looks like any single signer payment. If not, the spender reveals only the one script branch used plus a Merkle proof (the script path), keeping every other condition private.

Replacing a stuck payment. Replace by fee (BIP 125) lets a sender rebroadcast the same payment with a higher fee, and Bitcoin Core 28 made "full RBF" the default in 2024. Child pays for parent (CPFP) lets the receiver spend the unconfirmed output with a high fee, so miners take both transactions together.

Merkle trees Complex

A block can hold thousands of transactions, but the header has room for only one 32 byte summary of them: the Merkle root. Transactions are hashed in pairs, then the pair hashes are hashed in pairs, and so on until one hash is left.

To prove Tx C is in the block, you need only Tx C, Hash D and Hash AB, not every transaction. That short proof is what lets lightweight wallets, called SPV clients, confirm a payment without downloading the whole chain.

Going deeper: proof sizes and edge cases

A Merkle proof for one transaction among n needs about log₂(n) hashes. For a block of 4,000 transactions that is 12 hashes, 384 bytes, against megabytes for the whole block. When a level has an odd number of hashes, the last one is paired with itself, a design choice that once allowed two different transaction lists to produce the same root (CVE‑2012‑2459). Nodes now reject those mutated blocks. Light clients today mostly use compact block filters (BIP 157 and 158), which let a phone ask "does this block touch my addresses?" without revealing which addresses are its own.

The Lightning Network Complex

About seven transactions per second fit on the base chain. The Lightning Network handles many more by moving small payments off the chain. Two parties lock bitcoin into a shared channel with one on chain transaction, then send each other payments by updating a signed balance sheet as often as they like. Only the final balance goes back on chain when the channel closes.

Going deeper: commitments, HTLCs and onion routing

A channel is a 2 of 2 multisig output. Each party holds a signed commitment transaction that would pay out the current balances. When the balance changes, both sign new commitments and swap revocation secrets for the old ones. If someone broadcasts an old state, the other side can use the revocation secret to take the whole channel balance in a "justice" transaction. Watchtowers can do that on a user's behalf while they are offline.

Multi hop payments use hash time locked contracts (HTLCs). Bob picks a secret preimage and gives Alice its hash. Alice offers Carol a payment that Carol can claim only by revealing the preimage before a timeout; Carol offers Bob the same with a shorter timeout. When Bob claims his payment he reveals the preimage, which lets Carol claim hers. Either everyone is paid or nobody is. The route is wrapped in layered encryption (Sphinx onion routing), so each node knows only the hop before and after it. The protocol is specified in the BOLT documents.

The tradeoffs are real: channels need inbound liquidity, large payments can fail to find a route, and nodes have to stay online or use a watchtower. Newer designs such as splicing, which resizes a channel without closing it, keep chipping away at those limits.

Proof of work and proof of stake Complex

Bitcoin secures its ledger with energy and hardware. Most newer chains use proof of stake, where validators lock up coins as collateral and are chosen to add blocks in proportion to their stake. Ethereum switched from work to stake in an upgrade called the Merge on September 15, 2022.

Supporters of each model argue about which trade offs matter more. Proof of work ties security to something physical and outside the system. Proof of stake ties it to capital inside the system and uses far less energy. Both are live, multi billion dollar experiments.

Going deeper: how Ethereum's proof of stake finalizes

Ethereum's consensus, called Gasper, combines a fork choice rule (LMD GHOST) with a finality gadget (Casper FFG). Time runs in 12 second slots grouped into 32 slot epochs of 6.4 minutes. Validators, each with 32 ETH at stake, attest to blocks. When two thirds of the stake attests across two consecutive epochs, a checkpoint becomes final, which takes about 13 minutes. Reversing it would require at least one third of all staked ETH to be destroyed by slashing.

Proof of stake brings its own puzzles. The "nothing at stake" problem, where validators sign every fork for free, is answered by slashing. Long range attacks, where old keys rebuild an alternate history, are answered by weak subjectivity: new nodes start from a recent trusted checkpoint instead of verifying from genesis on raw rules alone. Bitcoin supporters point to that as a key difference, since a new Bitcoin node can verify the whole history from the first block using only the rules and the work.

Consensus and attacks, the math Complex

Nodes follow the valid chain with the most accumulated proof of work, not simply the longest. The classic threat is a 51% attack: someone with more hash rate than everyone else secretly builds a competing chain, then releases it to undo their own recent payments, a double spend. Even then, they cannot forge signatures, take coins from other people's addresses or create coins beyond the schedule, because every node rejects blocks that break those rules.

Why confirmations work. Section 11 of the white paper treats an attacker as a gambler trying to catch up. If honest miners hold share p of hash rate and the attacker holds q, the chance the attacker ever erases a lead of z blocks is:

Accounting for the blocks the attacker mines while waiting, Satoshi's table gives the confirmations needed to push the attacker's odds below 0.1%:

The probability falls exponentially with each block, which is why six confirmations became the custom for large payments against a much smaller attacker.

Attacks below 50%. Eyal and Sirer (2013) showed "selfish mining": a pool that withholds blocks and releases them strategically can earn more than its share with roughly a quarter to a third of hash rate, depending on how quickly its blocks propagate. Eclipse attacks isolate a node by filling all of its connections with attacker peers. Bitcoin Core has since added protections such as more diverse peer selection and anchor connections. Fast block relay (compact blocks, BIP 152) reduces stale blocks, which also blunts selfish mining.

The cost side. Attacking means acquiring and powering hash rate on the order of the whole network, about 1 ZH/s, which is more machines than manufacturers produce in many months, and the attack would undermine the value of the coins it targets. Open questions the industry watches include the concentration of hash rate in a few large pools, the long term fee market as subsidies shrink, and quantum computing, covered next.

Quantum computers and Bitcoin Complex

Quantum computing comes up in almost every serious conversation about Bitcoin's future. Here is what is actually at risk, how far away the threat is, and what is being done about it.

What a quantum computer could break, and what it could not

• Signatures are the exposed part. Bitcoin's ECDSA and Schnorr signatures rely on the elliptic curve discrete logarithm problem. Shor's algorithm, run on a large, error corrected quantum computer, could solve it and recover a private key from a public key. Chaincode Labs report
• Mining is mostly safe. Against SHA‑256, Grover's algorithm gives only a square root speedup, and quantum hardware is far slower per operation than an ASIC. The Chaincode report calls a mining impact "significantly less likely."
• Which coins are exposed. Coins sit behind a hash of the public key until they are spent, so the key is hidden. The exposed ones are those whose public key is already visible: early pay to public key outputs (about 1.72 million BTC, including many of the earliest mined coins), reused addresses and Taproot key path outputs. Estimates of the total range widely, from about a quarter to about a third of all bitcoin. CoinDesk

How big a quantum computer would need to be

Each new paper has lowered the estimate, and that trend is the main reason the topic gets attention. The hardware, though, is still thousands of times short: hundreds of physical qubits today against hundreds of thousands needed, and a few hundred logical qubits on public roadmaps for 2029 against more than a thousand needed. Expert surveys put meaningful odds on a cryptographically relevant machine within 10 to 15 years. Global Risk Institute

The defenses are already being built

• Standards exist. In August 2024 NIST finalized its first post quantum standards: FIPS 203 (ML‑KEM), FIPS 204 (ML‑DSA) and FIPS 205 (SLH‑DSA, a hash based signature). In March 2025 it added HQC as a backup. NIST 2024 · NIST 2025
• Bitcoin proposals are in the official repository. BIP 360, now called Pay to Merkle Root, is a draft soft fork that removes Taproot's exposed key path. BIP 361 lays out a phased migration that would eventually stop legacy signatures. It grew from a 2025 mailing list proposal and is openly debated. A post quantum signature scheme for Bitcoin itself is still to be chosen.
• Other networks are moving too. The Ethereum roadmap includes a post quantum effort, Algorand already signs state proofs with the Falcon scheme, and QRL was built on hash based signatures from the start.

To be fair to the other side: the Chaincode report estimates a full migration could take about seven years, Google's authors urged crypto communities to migrate without delay, and BlackRock's bitcoin ETF prospectus lists quantum computing among its risks. The Quantum Insider. Whether the migration finishes in time is the open question.

DeFi, tokens, ETFs and CBDCs Complex

Rules and taxes, the big picture Complex

Rules differ by country and change often, so this is only a map of the landscape in the United States:

• Property, not currency. Since IRS Notice 2014‑21, the IRS has treated digital assets as property. Selling, trading or spending them can create a gain or loss.
• Mining income. IRS guidance treats mined coins as income at their value on the day they are received.
• Reporting. Form 1040 asks every filer about digital asset activity, and brokers began issuing Form 1099‑DA for transactions starting in 2025.
• Stablecoins and markets. Congress passed the GENIUS Act for payment stablecoins in 2025. Who regulates which tokens, the SEC or the CFTC, is still being worked out.

For anything specific to your situation, a tax professional or attorney is the right person to ask.

New tech: the latest ASICs Complex

Machines keep getting faster and more efficient. The guide's reference machine, the Antminer S19 XP from late 2021, is rated by Bitmain at 140 TH/s and 21.5 J/TH (we round to about 141 TH/s in the examples). ForkLog. Here is how the newest models compare:

Manufacturer ratings, usually with tolerances of about 5% to 10%. One source lists the S21 XP Hyd at 5,976 W; 473 TH/s at 12 J/TH works out to about 5,676 W, which matches retail listings.

Trends to watch

• Efficiency roughly halved in five years: from 21.5 J/TH in 2021 to about 9.5 J/TH in 2025 and 2026 machines.
• The best numbers are liquid cooled. Hydro and immersion machines run chips harder and hotter than fans allow. MicroBT's rack scale M79S hydro unit runs about 930 TH/s at 14 kW. Bitcoin News
• Chips are at 3 nm. Block agreed in 2024 to supply about 15 EH/s of its 3 nm mining chips to Core Scientific. Bitcoin Magazine. Chip roadmaps have slipped too: Bitdeer targeted about 5 J/TH for its SEAL04 chip, and the first SEAL04 machines are rated 9.45 to 10.9 J/TH. Bitdeer filing
• Modular, upgradable rigs. Block's Proto Rig lets operators swap hash boards as chips improve, and its fleet management software is open source. Cointelegraph
• Quiet miners for the home. Canaan's Avalon Q runs up to 90 TH/s at an adjustable 800 to 1,600 W, and the Avalon Nano 3S does 6 TH/s at 140 W, doubling as a space heater. Canaan