Proof of work vs. proof of stake: a blockchain research guide

Proof of work and proof of stake are two methods a public blockchain can use to agree on which transactions are valid and in what order. In proof of work, participants called miners spend computing power and electricity to earn the right to add the next block. In proof of stake, participants called validators lock up units of the network’s own token as a deposit, and the protocol selects among them to propose and confirm blocks. Both methods answer the same question: how can thousands of strangers keep one shared ledger without a central bookkeeper?

This guide walks through how each method works, who takes part, the terms readers meet most often, and where the two designs differ in practice. It is written for readers doing blockchain research who want a plain-language base before reading protocol documentation.

In brief

• A consensus mechanism is the rule set that decides which version of the ledger the network accepts.
• Proof of work ties security to the cost of computation. Proof of stake ties security to capital that can be forfeited.
• Bitcoin uses proof of work. Many newer networks, and Ethereum since its move away from mining, use proof of stake.
• Neither design is free of trade-offs. Energy use, hardware, concentration of control and the cost of an attack all differ.

Why a blockchain needs a consensus mechanism

A bank keeps a ledger and decides which entries are valid. A public blockchain has no such owner. Anyone can run software, copy the ledger and submit transactions. Without a shared rule for settling disputes, two participants could each claim a different version of history, and the same coin could be spent twice.

A consensus mechanism solves this by making it expensive or risky to cheat and rewarding those who follow the rules. The 2008 Bitcoin paper presented proof of work as the mechanism that lets a peer-to-peer network order transactions without a trusted third party. Proof of stake, developed later, keeps the same goal but changes what the participant puts at risk.

How proof of work works

In the Bitcoin paper, miners collect pending transactions into a block and then search for a number, called a nonce, that makes the block’s cryptographic hash begin with a required number of zero bits. There is no shortcut for finding such a number, so miners try enormous numbers of guesses. Checking a winning answer, by contrast, takes a single hash.

Three features follow from that design:

• Changing an old block would require redoing its work and the work of every block built on top of it. The deeper a transaction sits in the chain, the more work an attacker would have to repeat.
• The network adjusts difficulty using a moving average so that blocks keep arriving near a target rate, even as more computing power joins or leaves.
• The longest chain, meaning the one with the most accumulated work, is treated as the valid one. The paper summarizes this as one CPU, one vote.

The security assumption is that honest participants control most of the computing power. If they do, the honest chain grows fastest, and the chance that an attacker catches up falls sharply with each added block.

Miners are paid in two ways. The first transaction in each block creates new coins for the block’s creator, which also distributes coins without a central issuer. Transactions can also carry fees that go to the block creator. The paper notes that once the planned supply of coins has been issued, rewards can come entirely from fees.

How proof of stake works

In proof of stake, a validator deposits a stake of the network’s token. The protocol then selects validators to propose blocks and attest to the blocks that others propose. The BIS describes the general pattern: validators lock up crypto assets for a chance to create blocks, the odds of selection generally rise with the size of the stake, and misbehavior can be penalized through slashing, which destroys part of the deposit.

The IMF’s Finance & Development magazine summarizes the contrast in similar terms. In proof of work, faster and more efficient miners earn more, which pushes up computing and electricity demand. In proof of stake, validators are chosen at random in proportion to their stake, and attesting falsely can cost them that stake.

Security therefore rests on economics instead of computation. An attacker who wanted to push through a false history would need to control a large share of the stake, and the protocol can punish provable misconduct by destroying some of it. The BIS appendix describes the security of proof of stake as relying on economic incentives and an honest-majority assumption.

Most proof-of-stake networks also let ordinary token holders take part without running their own equipment, for example by delegating or pooling. The SEC’s Division of Corporation Finance has published staff statements on different forms of protocol staking, including liquid staking, where a depositor receives a receipt token while the underlying assets stay staked. Those statements are staff views, carry no legal force, and turn on specific facts, so readers should read the full text before assuming a given arrangement is covered.

Key terms

• Block: a batch of transactions added to the ledger together.
• Hash: a fixed-length fingerprint of data produced by a cryptographic function.
• Nonce: the number miners vary while searching for a hash that meets the difficulty target.
• Validator: a participant that proposes or validates blocks. The BIS glossary notes that permissionless systems allow open participation, while permissioned systems restrict membership.
• Slashing: a penalty that destroys part of a validator’s stake for provable misbehavior.
• Finality: the point at which a confirmed transaction can no longer be reversed. The BIS distinguishes deterministic finality, where the validator set cannot revert a confirmed transaction, from probabilistic finality, where the chance of reversal falls as more blocks are added.
• Honest-majority assumption: the premise that most of the relevant resource, whether hash power or stake, is controlled by participants following the rules.

Where the two designs differ

The BIS appendix frames the comparison around the blockchain trilemma, the idea that it is hard to maximize decentralization, security and scalability at once. In its rough ratings, proof of work scores high on decentralization and security but low on scalability, with blocks arriving about every ten minutes on Bitcoin. Proof of stake scores moderate to high on decentralization, high on security and moderate on the base layer. These are qualitative judgments, not measurements, and other analysts weigh the factors differently.

Energy and hardware

Proof of work converts electricity into security, so energy demand follows the economics of mining. The IMF article quotes researcher Alex de Vries as saying a switch from proof of work to proof of stake could reduce a network’s energy consumption by around 99.95 percent, and cites the Cambridge Bitcoin Electricity Consumption Index for an estimate of Bitcoin mining’s annual use at the time of writing in 2021. Because these figures are estimates tied to a date, readers should check current numbers from the Cambridge index rather than rely on a 2021 snapshot.

Proof of stake does not require specialized mining machines, and a validator can run on far more modest equipment. The BIS notes, however, that mining hardware and capital requirements can limit effective decentralization in proof of work, and that stake concentration is a noted risk in proof of stake.

Concentration of control

Both systems can drift toward concentration. In proof of work, mining pools combine the hash power of many machines, and access to cheap power and efficient hardware favors large operators. In proof of stake, a validator with more stake is selected more often, and fixed operating costs favor larger players. A BIS article on decentralization made the same point about proof of stake, arguing that its features tend to concentrate decision-making among large holders. Researchers sometimes check concentration by looking at how much of the validator set or hash rate the largest few entities control.

Cost and form of an attack

An attack on a proof-of-work chain requires acquiring or renting a majority of computing power, and the attacker’s hardware and electricity are spent whether or not the attack succeeds. An attack on a proof-of-stake chain requires acquiring a large share of the token, and detected misbehavior can lead to slashing of that stake. Neither is impossible in theory. Both depend on the assumption that attacking is more costly than the attacker could gain.

A worked comparison

Consider two hypothetical networks, one of each type, and a reader who wants to judge how settled a payment is.

On the proof-of-work network, a payment included in the latest block could still be displaced if a competing chain with more accumulated work appears. Each new block built on top makes that less likely, so recipients commonly wait for several confirmations before treating a large payment as final. This is probabilistic finality.

On the proof-of-stake network, validators attest to blocks, and the protocol can mark a block as finalized once enough of the stake has attested to it. Reversing a finalized block would require provable misconduct by a large share of validators, which would put that stake at risk. Some designs offer deterministic finality of this kind, and others rely on probabilistic finality. The details depend on the specific protocol, so a reader should check its documentation.

Common misconceptions

Proof of stake is not simply proof of work without the work. It changes what secures the network, which changes the failure modes: the main risks become stake concentration, validator misbehavior and the design of slashing rules.

Proof of work is not wasteful by definition from the protocol’s point of view. The computation is the mechanism that makes rewriting history costly. Whether the energy cost is worthwhile is a policy and economic judgment, and reasonable analysts disagree.

Staking rewards are not guaranteed interest. They depend on protocol rules, network participation and, where relevant, fees charged by a staking provider. The SEC staff statement on liquid staking describes how rewards can be reflected in receipt tokens and how slashing losses can reduce what each token represents.

Finally, a larger network is not automatically more decentralized. Counting nodes or wallets says little unless readers also look at who controls the hash power or stake.

What to check when you read about a network

• Which mechanism it uses, and whether it has changed mechanisms.
• Who can participate as a miner or validator, and what it costs to start.
• How concentrated hash power or stake is among the largest entities.
• What the protocol says about slashing, finality and recovery from failures.
• How rewards are paid and how the token supply changes over time.

This guide explains general concepts and is not investment advice. Official regulatory pages such as the SEC’s Investor.gov site explain the risks of crypto assets in more detail.

FAQ

Which is more secure, proof of work or proof of stake?

Neither is secure in an absolute sense. Each is secure under assumptions: that honest participants control most of the computing power, in proof of work, or most of the stake, in proof of stake. The BIS rates both as high on security in its qualitative comparison, and the practical level of security depends on the specific network’s size, distribution and design.

Why did some networks move away from mining?

Public statements by project teams and commentary such as the IMF article point to energy use as a main reason, along with the aim of lowering hardware barriers. A move also changes the security model, so it involves trade-offs that each community weighed for itself.

What is slashing?

Slashing is a protocol penalty that destroys part of a validator’s stake when it provably breaks the rules, for example by signing conflicting blocks. It is the mechanism that gives a stake real weight as a deposit.

Can I take part without running a validator?

Many networks allow delegation, pooling or staking through third-party providers. Each arrangement carries its own custody, fee and slashing risks, and the legal treatment can vary. The SEC staff statements are fact-specific, so read them and the provider’s terms before relying on them.

Does proof of stake mean the rich control the network?

Selection odds generally rise with stake, so large holders have more influence, and the BIS lists stake concentration as a risk. Protocol design choices, such as caps, rotation or delegation limits, can reduce the effect, but they do not remove it.