Bitcoin mining, in detail

In Understanding Bitcoin , we said miners “solve a mathematical problem”. That’s true, and it’s misleading. There is no problem to solve in the usual sense: no equation, no trick, no cleverness. There is a lottery draw, repeated at a pace beyond comprehension, where every ticket costs electricity.

This article looks at that draw up close. We start from a real block, 973,976, mined by AntPool on 31 October 2026 at 12:17 UTC, and take apart its 80-byte header, its coinbase transaction and its proof of work. Then we zoom out: how the network sets the difficulty, why hardware went from processors to dedicated chips, what a terahash earns, and who — concretely — decides what goes into a block.

What a miner literally does

A miner doesn’t handle “a block”. It handles 80 bytes: the header. It is the only object the proof of work touches. The block’s thousands of transactions don’t appear in it — they are summed up by a single 32-byte fingerprint, the Merkle root, which is the subject of the next article.

Here is the header of block 973,976, as it travels across the network:

00c003205614f0eeabd053627b41d36522a25dcc967d3290117b000000000000000000005177a532
1586c152baea8a11c2abe7013a42b9207df923bab5a2dd4de29c6dae65dce56aace5011749a7d2bf

Six fields, all little-endian as in a transaction:

• The version (4 bytes) — 0x2003c000. It mostly signals support for protocol upgrades, but some of its bits also serve mining itself; more on that below.
• The previous block hash (32 bytes) — this is what makes the blockchain a chain. Altering an old block changes its hash, which invalidates the next block’s field, and so on up to the tip.
• The Merkle root (32 bytes) — the fingerprint of the block’s 6,017 transactions. Changing a single transaction changes this root, hence the header, hence the hash.
• The timestamp (4 bytes) — 2026-10-31 12:17:41 UTC. It is declared by the miner, and the protocol only accepts it within a certain range.
• The bits (4 bytes) — the current difficulty, in compact encoding. We decode them in the next section.
• The nonce (4 bytes) — the only field with no meaning at all. It’s a counter the miner keeps turning.

The miner’s job is one loop: take those 80 bytes, compute SHA-256(SHA-256(header)), check whether the result, read as a 256-bit number, is below the target. If not, change the nonce and start again. If so, the block is valid, it gets broadcast, and the reward is collected.

For block 973,976, the recomputed hash is:

000000000000000000014c12cb7b43d3c608ea844d20712ba1d2897d4fed2e1d

Nineteen leading hexadecimal zeros, i.e. 79 zero bits. The probability that a random hash falls below that day’s target is one in 6.4 × 10²³. That’s why it takes so many attempts — and that’s why anyone can check the result in no perceptible time: a single double SHA-256 is enough to confirm the winning ticket really wins. Costly to produce, free to verify: the whole of proof of work lies in that asymmetry.

Coinbase, nonce, extraNonce

The nonce is 32 bits, roughly 4.3 billion possible values. That sounds like a lot. It isn’t: a single modern machine, the Antminer S21 XP Hyd and its 473 TH/s, runs through those 4.3 billion values in 9 microseconds. The whole network, in 4 picoseconds. If the nonce were the only variable, a miner would spend most of its time… with nothing left to try.

So more dials are needed. There are two.

The first is in the coinbase. Every block starts with a special transaction, the coinbase, which creates the new bitcoins and collects the fees. It has no real input — it spends no UTXO — and its scriptSig, instead of holding a signature, is an almost free-form space. Here is block 973,976’s, 86 bytes long:

03 98dc0e                       → block height: 973,976 (mandatory since BIP34)
19 "Mined by AntPool "          → the pool's tag
   b8004501fd6c3569 …           → pool-specific bytes, including the extraNonce
   fabe6d6d …                   → merge-mining commitment for other chains

The first bytes are mandatory: since block 227,931 (March 2013), BIP34 requires the coinbase to start with the block height. The rest is up to the miner, who puts a tag there and, above all, an extraNonce: an extra counter. Changing the extraNonce changes the coinbase, hence its txid, hence the Merkle root, hence the header — and reopens 4.3 billion nonces to try.

The second is in the version. Since BIP320 , sixteen bits of the version field (bits 13 to 28) are reserved for general use: miners use them as a spare nonce, a practice called version rolling. That’s why block 973,976’s version is 0x2003c000 rather than a round number: those middle bits moved during the search.

The coinbase also carries the pay. Block 973,976’s pays 3.13350594 BTC to the pool: 3.125 BTC of subsidy — the amount set by the protocol since the April 2024 Halving — plus 0.00850594 BTC of fees, taken from the 6,016 other transactions. Fees therefore weigh 0.27% of the reward that day: for now, it is the subsidy that pays for the network’s security. We’ll come back to that in the economics section.

Finally, it carries several OP_RETURN outputs worth 0 satoshis. The first is the witness commitment required by SegWit — the fingerprint of the block’s wtxids, those identifiers we met in The anatomy of a transaction . The others (CORE, EXSAT, sys, RSKBLOCK:) are commitments for other networks that lean on Bitcoin’s computing power — through merge-mining for RSK or Syscoin, for instance, where the same computation secures several chains at once.

Target and difficulty

The target is a 256-bit number. The header only stores a 4-byte compressed version of it, the bits field, in a form close to scientific notation: the first byte gives an exponent, the next three a mantissa. For block 973,976, bits = 0x1701e5ac decodes as:

target = 0x01e5ac × 256^(0x17 − 3)
       = 00000000000000000001e5ac0000000000000000000000000000000000000000

Since a 64-digit hexadecimal number says little, we express the difficulty instead: the ratio between the easiest allowed target (the genesis block’s, in January 2009) and the current one. That day it stands at 148,364,561,003,867 — finding a block is about 148 trillion times harder than on day one.

Why does difficulty move? Because the protocol targets one block every ten minutes on average, whatever computing power is engaged. Every 2,016 blocks — about two weeks — each node performs the same computation, defined in Bitcoin Core’s src/pow.cpp :

new target = old target × (actual time elapsed / 2 weeks)

If the last 2,016 blocks came too fast, the elapsed time is under two weeks, the target drops, and finding a block gets harder. If they came too slowly, the reverse. Two safeguards: the adjustment is capped at a factor of 4 either way, and it is automatic — no committee, no vote; each node recomputes it alone and rejects any block that breaks it. The latest adjustment, at block 973,728 on 29 October 2026, raised difficulty by 5.54%; the next one is due at block 975,744.

This mechanism works thanks to the law of large numbers, which we set out in the math side-quest . A single block may arrive in ten seconds or in an hour: mining is a draw, and draws vary. But over 2,016 draws, the observed average sticks very closely to the expectation — closely enough to estimate the network’s power without ever measuring it directly. That’s in fact how we get the hashrate: nobody declares it, it is inferred from the difficulty and the pace of blocks.

In late October 2026 the network runs at around 1.06 × 10²¹ hashes per second — a little over one zettahash. Multiplied by 600 seconds, that’s about 6.4 × 10²³ attempts per ten-minute window: exactly the order of magnitude of the “one in 6.4 × 10²³” from earlier. On average, the network makes just the number of attempts needed to find one block every ten minutes. Difficulty is what keeps that equation balanced.

From CPU to ASIC

Double SHA-256 is a simple computation, repeated identically, with no dependency between two attempts: what’s called an embarrassingly parallel problem. The whole history of mining hardware is about exploiting that ever better, giving up a little more versatility at each step.

In 2009, people mine with their computer’s processor; that’s what Satoshi does. In late 2010, miners discover that graphics cards, designed to run thousands of small computations in parallel, do much better. In 2011 come FPGAs, reprogrammable circuits, leaner than graphics cards but expensive. Then, at the end of January 2013, Canaan ships the Avalon, the first commercial ASIC miner: a chip etched to do one single thing, double SHA-256.

The ASIC changed everything, irreversibly. A dedicated chip can do nothing else: it is unbeatable at mining Bitcoin, and useless for anything else. The upshot: on this network, a miner without a recent ASIC earns nothing. A processor or graphics card can still compute hashes, but the share of rewards it could hope for wouldn’t even pay for the monitor’s electricity.

Today the industrial market is dominated by Bitmain (Antminer range), MicroBT (Whatsminer) and Canaan (Avalon). The unit that matters is efficiency, in joules per terahash: the Antminer S21, released in 2023, is rated at 17.5 J/TH; its liquid-cooled version, the S21 XP Hyd, at 12 J/TH for 473 TH/s — close to 6 kW per machine, which has to be carried away by a water circuit.

Two families of machines target a very different audience. In March 2025, Canaan launched the Avalon Q, an ASIC designed for the home: 90 TH/s, 1,674 W, i.e. 18.6 J/TH, and an announced noise level between 45 and 65 dB, adjustable by lowering the power. At the other end, open-source devices like the Bitaxe: a single chip, 15 to 50 W, small enough to sit on a desk. We’ll see in the next section what each can hope to earn.

Geographically, the landscape flipped in 2021, when China banned mining. According to Hashrate Index’s estimate for April 2026, the United States hosts about 37.4% of global hashrate, ahead of Russia (16.9%) and China (12.0%) — which is therefore still present despite the ban.¹ These figures are estimates: no miner is required to declare where it operates.

Mining economics

A miner earns two things per block found: the subsidy (3.125 BTC since April 2024, halved every 210,000 blocks) and the fees of the included transactions. It mainly spends one thing: electricity. Between the two, the sector’s whole economics boils down to one indicator, the hashprice: what one petahash per second earns over one day, in dollars.

You can compute it yourself from three public data points: the difficulty (which gives how many blocks one PH/s finds per day on average), the average reward per block, and the bitcoin price.

hashprice = (10^15 × 86,400) / (difficulty × 2^32) × reward per block (BTC) × price (USD)

Over the past two years, hashprice has more than halved, from $62.92 in December 2024 to $28.30 at its low in June 2026. In late October 2026, it hovers around $35 per PH/s per day. The reason is structural: difficulty keeps climbing while the subsidy stays put until the next halving.

What a miner can withstand then depends on a single question: what does it pay for electricity? The electricity break-even price is the hashprice divided by the daily energy use of one PH/s:

Assumptions: hashprice of $35.17/PH/day (31 October 2026), machine running 24/7 at rated power. Not counted: the machine’s purchase price, cooling, pool fees, breakdowns. These break-evens are therefore ceilings, not margins.

The table says it all. An industrial farm paying 5 or 6 cents per kWh runs its S21 XP Hyds with a margin. A household paying several times that rate will not make an Avalon Q pay for itself by selling the bitcoins it mines: its 40 kWh a day cost more than the $3.17 they bring in. The strongest case for such a machine at home lies elsewhere: all of its 1,674 W ends up as heat, and in winter that’s heat you would have paid for anyway.

A network that regulates itself

When hashprice falls, the least efficient machines drop below their break-even, and their owners switch them off. Hashrate recedes, blocks slow down, and at the next adjustment difficulty falls, which lifts the hashprice of the machines still running. The 2026 data shows it almost live: hashprice hits its two-year low on 11 June; the following adjustment, on 14 June, cuts difficulty by 10.09%. Nobody decided anything: the loop is mechanical. That’s what makes the network homeostatic — it absorbs price shocks without ever ceasing to produce blocks.

What about the solo miner?

Every attempt remains a perfectly fair draw: the probability of winning is proportional to hashrate, no more, no less. On 7 April 2026, block 944,078 was found through Noderunners, a solo pool — a service where the miner doesn’t share: if it finds a block, the reward is all its own; otherwise it gets nothing. That block’s coinbase pays its 3.13206403 BTC to a single address. Resellers of the NerdQAxe++, a small open-source ASIC derived from the Bitaxe, attribute the block to a single one of their machines, on the order of 5 TH/s; the chain itself cannot tell which hardware produced the winning hash.

Let’s grant it. At 4.8 TH/s against a network of about 995 EH/s, the average wait before finding a block is roughly 3,900 years. So this block is neither a feat nor proof that solo mining pays: it’s a winning lottery ticket. For a few dozen watts, it’s a ticket anyone can buy, which is probably the best argument for these small machines. But if you want a steady income, you have to pool the luck.

Mining pools

A mining pool does exactly that: thousands of miners combine their power, and the pool splits each reward in proportion to the work supplied. The first one, created in late 2010 by Czech developer Marek Palatinus (“Slush”), still exists today as Braiins Pool.

How does a pool measure everyone’s work, when only the winning hash counts? With shares: the pool gives each miner a target far easier than the network’s. Every hash that falls below that easy target is a share, proof that the miner is genuinely working on the right block. The number of shares sent measures the power supplied; now and then, one of them also falls below the real target, and the pool finds a block.

Two questions remain: how to pay, and who decides what goes into the block.

How to pay. Three main families coexist. With PPS (Pay Per Share), the pool pays each share at a fixed price, whether it finds blocks or not: it absorbs the variance and charges for it with a higher fee. FPPS (Full Pay Per Share) does the same while including an estimate of transaction fees. With PPLNS (Pay Per Last N Shares), the pool only pays when it finds a block, splitting it among the last shares received: the miner bears the variance, but the fee is lower and loyalty is rewarded.

Who decides. Here is the share of blocks over the past month, up to 31 October 2026:²

The top two pools find 46.6% of blocks, the top three 63.4%. That’s not the same as controlling 63% of the hashrate: the machines belong to thousands of miners, who can switch pools in minutes. But it is the pool that decides which transactions go into the block.

Stratum v1, or the blind miner

Since 2012, miners have talked to their pool through Stratum v1. The pool builds the candidate block — it picks the transactions — and sends each machine a ready-made job: a header to vary. The machine never sees the block’s contents. It hashes blind.

That’s efficient, and it’s a major point of centralisation: a handful of operators decide the contents of the vast majority of blocks. Should a regulator require them to leave out certain transactions, they can. That’s one of the topics of Privacy on Bitcoin (BTC-A-07, coming in this series).

Stratum v2 and DATUM, or handing the choice back to miners

Stratum v2 fixes that. Besides encrypting the traffic, it adds an extension, Job Declaration, which lets the miner — or its own node — build its block and declare it to the pool, which then only coordinates and pays. The choice of transactions flows back down to thousands of operators.

On 11 May 2026, seven pools totalling about 75% of hashrate — including Foundry, AntPool, F2Pool, MARA and SpiderPool — joined the Stratum V2 working group.³ Joining isn’t deploying: the first block from a pool running natively on Stratum V2, DMND, was only mined on 25 June 2026 (block 955,318), and that usage remains a minority.

OCEAN, the most radical experiment

OCEAN tackled the problem from the other end. Launched in November 2023 by a team including Luke Dashjr, a long-time Bitcoin Core developer and maintainer of Bitcoin Knots, with a $6.2 million funding round led by Jack Dorsey,⁴ the pool rests on two ideas.

It doesn’t hold the money. At most pools, the coinbase pays the pool, which then redistributes. At OCEAN, the coinbase pays the miners directly. You can check it on-chain: in block 973,981, mined by OCEAN on 31 October 2026, the coinbase has nine paying outputs, one per rewarded miner. The AntPool block we just took apart has only one, to the pool’s address. OCEAN therefore pays only when it finds a block, under its own scheme called TIDES: as with PPLNS, the miner bears the variance — in exchange for which the pool never takes custody of the funds.

It hands back the choice of transactions. Shortly after its launch, OCEAN offered several block templates, including a default one built with Bitcoin Knots, which leaves out inscriptions and other non-financial data, and an unfiltered Bitcoin Core template for those who preferred it. In September 2024, the pool released DATUM, its own protocol for each miner to build its blocks with its own node — the same bet as Stratum v2 Job Declaration, by another route. This question of filtering data is exactly the one at stake in BIP-110 , of which OCEAN was the main backer: over the last period before the deadline, its 51 signaling blocks were the only ones on the network. After the failure of 8 August 2026, the pool stopped supporting the BIP-110 branch, and Luke Dashjr left it at the end of August.

At 3.1% of blocks, OCEAN weighs little. But it shows that a pool can run without holding its miners’ funds or deciding block contents on their behalf — precisely the direction part of the industry is now taking.

What to take away

• Mining is a lottery draw: varying an 80-byte header until its double SHA-256 falls below a target. Costly to produce, instant to verify.
• The nonce is no longer enough: miners also vary the coinbase extraNonce and 16 bits of the version to multiply the search space.
• Difficulty adjusts itself every 2,016 blocks to keep ten minutes per block, within a factor of 4. It has grown about 148 trillion-fold since 2009.
• The ASIC made mining irreversibly specialised: without a recent dedicated chip, you earn nothing.
• Hashprice and the price of electricity decide everything. When the former falls, the least efficient machines switch off, difficulty drops, and the network rebalances itself.
• Pools pool the luck, but concentrate the choice of transactions. Stratum v2, DATUM and pools like OCEAN seek to hand that choice back to miners.

What’s next

The header holds a single 32-byte fingerprint for block 973,976’s 6,017 transactions: the Merkle root. How can such a short fingerprint prove that a specific transaction is in the block, without downloading the block? That’s the subject of Merkle trees and light clients : how the tree is built, inclusion proofs, and what they make possible for mobile wallets.

This article is not investment advice.