Proof of work vs proof of stake: security, energy and the trade-offs

Proof of work and proof of stake are the two main ways a blockchain decides who adds the next block. In proof of work, used by Bitcoin, miners spend electricity and hardware racing to solve a puzzle, so attacking the network means outspending them. In proof of stake, used by Ethereum since September 2022, validators lock up the network's own coins as collateral and can lose them for cheating, so attacking the network means buying and risking a large share of those coins.

Both aim at the same goal: making it more expensive to rewrite history than anyone could gain from doing so. They get there in very different ways, with different costs, weak points and arguments for and against. If you are new to how blocks and hashes fit together, start with what a blockchain is.

The problem both systems solve

A public blockchain lets anyone join. That openness creates a problem: if producing blocks were free, an attacker could create thousands of fake identities and outvote everyone else. This is known as a Sybil attack. Any consensus mechanism for an open network has to tie influence to something scarce that cannot be faked.

• Proof of work ties influence to computing power, which costs real money in hardware and electricity.
• Proof of stake ties influence to coins locked up as stake, which also cost real money and can be destroyed for misbehaviour.

Everything else follows from that choice of scarce resource.

How proof of work works

Miners gather pending transactions into a candidate block and then repeatedly hash its header, changing a number called the nonce each time, looking for a hash below a target set by the network. There is no shortcut; the only method is trial and error at enormous scale. The first miner to find a valid hash broadcasts the block, and other nodes check it in a fraction of a second.

• Rewards: the winning miner receives newly created coins (the block subsidy) plus the fees from the transactions in the block. In Bitcoin the subsidy halves every 210,000 blocks; see the bitcoin halving explained.
• Difficulty: Bitcoin adjusts the target every 2,016 blocks so that blocks keep arriving roughly every ten minutes, however much computing power joins or leaves.
• Which chain wins: nodes follow the valid chain with the most accumulated work. If two blocks appear at once, the tie resolves when the next block extends one of them.

Modern Bitcoin mining uses specialised chips called ASICs, designed to do nothing but compute SHA-256 hashes. Mining is concentrated where electricity is cheap, and most miners join pools that combine their computing power and share the rewards to smooth out income.

How proof of stake works

There is no puzzle. Instead, participants called validators deposit coins as collateral. On Ethereum, the minimum to activate a validator is 32 ether.

• Time is divided into slots and epochs. Each slot is 12 seconds. Thirty-two slots make an epoch, which is 6.4 minutes.
• One proposer per slot. In each slot the protocol pseudo-randomly selects one validator to propose a block, with the chance of selection weighted by stake.
• Everyone else votes. Validators are assigned to committees that attest, or vote, on which block they see as the head of the chain and on checkpoint blocks at epoch boundaries.
• Rewards and penalties. Validators earn rewards for proposing and attesting correctly. Being offline costs them small penalties. Provably dishonest behaviour, such as signing two conflicting blocks for the same slot, is punished by slashing: part of the stake is destroyed and the validator is forced out.

How ordinary holders take part, and the risks involved, are covered in Ethereum staking explained.

The Merge: Ethereum's switch

Ethereum launched in 2015 using proof of work. A separate proof-of-stake chain, the Beacon Chain, was launched in December 2020 and ran alongside it. On 15 September 2022, in an upgrade called the Merge, Ethereum's transaction history and state were joined to the Beacon Chain and mining ended. From that point, validators rather than miners produced Ethereum blocks.

Some points that are often misunderstood:

• Fees did not fall because of the Merge. It changed how blocks are produced, not how much space there is in them. Fee levels depend on demand for block space; see crypto gas fees explained.
• Withdrawals came later. Staked ether could not be withdrawn until the Shapella upgrade on 12 April 2023.
• Issuance fell. Validators are paid far less new ether than miners were, because the network no longer needs to cover miners' electricity costs.
• Energy use dropped sharply. The Ethereum Foundation estimates the Merge reduced Ethereum's energy consumption by about 99.95%.

Side-by-side: the main differences

What is at stake

In proof of work, the cost of producing blocks is external: electricity and hardware bought from the outside world. Once spent, the electricity is gone whether the miner behaved well or not. Honest behaviour is enforced by the reward: a miner who produces an invalid block wastes its spending.

In proof of stake, the cost is internal: the validator's own coins, held inside the system. Good behaviour earns rewards; provable misbehaviour can destroy part of the stake. The network can punish an attacker directly, which proof of work cannot do.

Finality

In proof of work, finality is probabilistic. A transaction is never mathematically final, but each extra block makes reversal more expensive, so after enough blocks reversal becomes impractical. A common convention for larger Bitcoin payments is six confirmations.

Ethereum's proof of stake has economic finality. When validators holding at least two-thirds of the total stake vote for a checkpoint, and the next checkpoint is voted through as well, the earlier one is finalised. Reverting a finalised block would require validators with at least a third of all stake to sign conflicting votes, which the protocol can detect and slash.

Worked example: how long until "final"

Illustrative timings using each network's design targets:

• Bitcoin: six confirmations at an average of 10 minutes per block is about 60 minutes. Because block times are random, the real wait can be noticeably shorter or longer.
• Ethereum: one epoch is 32 slots × 12 seconds = 384 seconds, or 6.4 minutes. Finality under normal conditions takes about two epochs, so roughly 12.8 minutes.

These are protocol properties. A platform crediting your deposit may set its own waiting rules, as explained in how crypto exchanges work.

Energy use

Proof of work's energy use is a direct consequence of its design: security comes from spending, and most of the spending is electricity. Bitcoin's total consumption is large enough that it is often compared with that of whole countries, though estimates vary and depend on assumptions. Supporters argue that miners can use stranded or surplus energy and can switch off quickly when grids are under strain. Critics argue that the consumption is wasteful and, depending on the energy mix, carbon-intensive. Proof of stake uses roughly the energy of running ordinary servers, which is why the Merge cut Ethereum's consumption so dramatically.

Who earns the rewards

In proof of work, rewards go to whoever has the cheapest electricity and most efficient machines, and coins can be earned without owning any beforehand. In proof of stake, rewards go to those who already hold coins, in proportion to what they stake. Critics call this "the rich get richer". Supporters respond that in proof of work, the rich can simply buy more machines, so capital wins either way.

What an attack would take

The classic attack on a blockchain is the 51% attack: gaining enough control of block production to rewrite recent history, for example to spend coins at an exchange, withdraw what was bought, and then replace the chain with a version in which the original payment never happened. This is called a double spend.

Attacking proof of work

An attacker needs more hash power than the rest of the network combined, for long enough to build a longer chain in secret. For Bitcoin, that would mean acquiring and powering an enormous amount of specialised hardware, which is extremely costly and hard to do unnoticed.

Smaller proof-of-work chains are much more exposed, because their total hash power is low and can sometimes be rented. Ethereum Classic, the chain that continued after Ethereum's 2016 hard fork, suffered three chain reorganisations in August 2020, of thousands of blocks each, which were widely reported as 51% attacks with double spends. Exchanges responded by requiring far more confirmations for deposits on that chain. The lesson is that proof of work is only as strong as the hash power behind a particular chain.

One feature works in proof of work's favour after an attack: the honest community can keep using the same hardware, and an attacker's machines are still worth only what mining pays.

Attacking proof of stake

An attacker needs stake rather than machines. On Ethereum:

• Controlling more than a third of staked ether could prevent the chain from finalising. Ethereum has an inactivity leak for this case, which gradually drains the stake of validators that are not participating until finality can resume.
• Finalising a conflicting history would require validators to sign conflicting votes, which can be detected and punished by slashing, destroying a large part of the attacking stake.
• Acquiring that much stake would mean buying a very large share of all ether, which would itself push the price up.

The theoretical weak point is that the attacker's resource is the network's own coin, so the defence relies on the community's ability to recognise and reject an attack socially if needed. Supporters see the ability to slash an attacker as a strength; critics see the reliance on social coordination in extreme cases as a weakness.

Other attacks specific to proof of stake

• Nothing at stake. In early designs, validators could vote on every competing fork at no cost. Slashing for conflicting votes was introduced specifically to remove this.
• Long-range attacks. Someone holding old keys that once controlled a lot of stake could try to build an alternative history from far back. Proof-of-stake chains defend against this with checkpoints, and new nodes need a recent trusted checkpoint to join safely. This is called weak subjectivity, and it is one of the conceptual differences critics point to.

Centralisation pressures in both

Neither design ensures decentralisation.

• Proof of work: a handful of mining pools often produce most blocks. Mining hardware comes from a small number of manufacturers. Cheap energy concentrates mining geographically. Pools do not own their members' machines, and miners can move to another pool, which limits the power a pool actually holds.
• Proof of stake: a large share of staked ether is held through a small number of liquid staking protocols and large exchanges. If one operator controlled a big enough share of stake, it could in principle influence finality or censor transactions. This is a widely discussed concern in the Ethereum community.

When you read that a network is "decentralised", it is worth asking: how many independent parties produce most blocks, and how easily could they coordinate?

What this means for traders and holders

The choice of consensus mechanism affects how a network works, but it is not a reliable guide to price. A few practical points do follow:

• Supply schedules differ. Bitcoin's issuance is fixed by its halving schedule. Ethereum's issuance depends on how much ether is staked and is partly offset by fees that are burned. Tokenomics and token supply explains how to read a coin's supply.
• Staking income is not free. Holding staked ether means taking on the price risk of ether plus the risks of the staking method. Holding an ether CFD earns no staking rewards and usually costs overnight financing; see crypto CFD overnight fees.
• Network events carry risk. Major upgrades, outages and attacks have moved prices and widened spreads. Crypto is already highly volatile, as crypto volatility and risk explains.
• Leverage limits apply. EU retail clients can use at most 2:1 leverage on crypto CFDs, and most retail CFD accounts lose money.

Common mistakes

• Assuming proof of stake is automatically less secure. It has different assumptions, not necessarily weaker ones. Large networks of both kinds have run for years without their core ledger being rewritten.
• Assuming proof of work is automatically secure. Security depends on the hash power behind a specific chain. Small proof-of-work chains have been attacked repeatedly.
• Thinking the Merge would lower fees. It changed energy use and issuance, not block space.
• Treating energy use as the only difference. Finality, attack economics, issuance and who earns rewards all differ too.
• Reading consensus design as a price signal. Neither mechanism tells you anything reliable about where a coin's price will go.

Frequently asked questions

What is the main difference between proof of work and proof of stake?

What is put at risk to produce blocks. Proof of work requires spending on electricity and hardware; proof of stake requires locking up the network's own coins, which can be destroyed for cheating. Both make attacking the network expensive.

Is Bitcoin going to switch to proof of stake?

There is no accepted proposal to do so, and changing Bitcoin's consensus would require broad agreement among the people who run its software. Many Bitcoin users regard proof of work as a core feature.

When did Ethereum move to proof of stake?

On 15 September 2022, in the upgrade known as the Merge. Staked ether became withdrawable after the Shapella upgrade on 12 April 2023.

Which is more secure, proof of work or proof of stake?

There is no agreed answer. Proof of work relies on outside costs and is well tested on Bitcoin, but small chains have been attacked cheaply. Proof of stake can punish attackers directly by slashing their stake, but relies on newer assumptions such as weak subjectivity. Security also depends on how much value protects a particular chain.

What is a 51% attack?

When one party controls most of the block production on a chain and uses that control to rewrite recent history, usually to double spend coins. It has happened on smaller proof-of-work chains, including Ethereum Classic in August 2020.

Does the consensus mechanism affect crypto CFD trading?

Not directly: a CFD tracks the price and never touches the blockchain. Indirectly, events such as upgrades, outages or attacks can cause sharp price moves, and leveraged positions magnify the effect. See crypto CFDs vs buying crypto.