An exhibition on Bitcoin and proof of work
Proof instead of trust.
How thousands of computers agree on one ledger with nobody in charge. Thirteen rooms. In the installations, your own device does the maths.
A block starts as 80 bytes.
Six fields: the version, the hash of the previous block, the merkle root of all transactions, the time, the target in compact form and a nonce. Each cube is one byte of the real first block from 2009. Its height is the value.
The nonce spins.
A miner changes the nonce and runs the header through SHA-256 twice. Every attempt gives a completely different hash, and nobody can predict which. The only thing that helps is more attempts per second.
Until the hash falls below the target.
Then the block is valid. This hash, the one of the first block, starts with 43 zero bits; the 2009 target asked for 32. Across the whole network, a find like this takes ten minutes on average.
Then every block builds on it.
Block 1 carries the hash of this first block, block 2 that of block 1. Change an old block and its hash changes, which breaks every link after it.
And every node checks it.
The block travels from node to node, and each one verifies it on its own. This first block took about 4 billion attempts on average, a block today around 6 × 10²³ (as of 13/10/2026). Checking takes one, plus a pass over the transactions.
The problem
Rooms 01 to 03
Room 01 · Double spending
Money you can copy is not money.
A digital coin is a string of bytes, and copying bytes costs nothing. So what stops you from spending the same coin twice?
Until 2009 the answer was always the same: a middleman. A bank keeps the books, sees that your coin is gone and refuses the second payment. It works. But then everyone has to trust that one party, and that party can also refuse, reverse or freeze.
On 31 October 2008, someone using the name Satoshi Nakamoto sent a white paper to a cryptography mailing list. The question it asked: can a network of strangers, with no central party, agree on which payment came first?
We propose a solution to the double-spending problem using a peer-to-peer network.The same coin, twice
Room 02 · The ledger
Everyone holds a copy of the same ledger.
Bitcoin has no accounts. The state of the ledger is a list of coins that have not been spent yet, and every node keeps its own copy.
Such a coin is called a UTXO, an unspent transaction output. A transaction consumes one or more of them and creates new ones. Try to spend a coin that is not on the list and you are refused.
A shared list alone does not solve the problem. Messages take time to cross a network, so two nodes can see two conflicting payments in a different order. Without agreement on the order there is no truth. The white paper calls the fix a timestamp server: a chain of blocks in which every block confirms all the ones before it.
Who came first?
Two payments with the same coin leave from two sides of the network at the same moment.
Room 03 · Signatures
Only the key holder can spend.
Every coin is locked with a condition. Usually it reads: show a valid signature for this public key.
A private key is a 256-bit number you keep secret. The public key follows from it, but not the other way round. With the private key you sign the transaction, and anyone can use the public key to check the signature without ever seeing the private key.
Change one character of the transaction and the signature no longer fits. Bitcoin uses the secp256k1 curve, with ECDSA and, since Taproot (block 709,632, 14 November 2021), Schnorr signatures as defined in BIP340.
This site never asks for a real private key or recovery phrase. No honest service does. The key in the installation is a fixed demo key.
Sign, then change something
Sign a payment with the demo key. Then change the amount and check again.
The mechanism
Rooms 04 to 08
Room 04 · The mempool
The waiting room.
A new transaction first lands in the mempool: the set of valid transactions that are not in a block yet. Every node keeps its own.
Space in a block is limited, so miners choose. They take the transactions that pay the most per vbyte, because that fee goes to them. Since Bitcoin Core 31 the mempool works in chunks: a transaction that pays a lot can pull its cheap parent along, and the two go into a block at their combined fee per vbyte.
When it is busy, the fee needed to get in quickly goes up. When it is quiet, almost nothing will do.
Pick your fee
Room 05 · Block and hash
Eighty bytes and a fingerprint.
A block is a header of exactly 80 bytes plus a list of transactions. The block hash is the double SHA-256 of that header alone.
SHA-256 turns any input into 32 bytes that look random. The same input always gives the same result, a single changed bit gives a completely different one, and there is no way to work backwards.
The transactions are not in the header themselves. They are hashed in pairs into a single 32-byte merkle root, and that root goes into the header. Change one transaction and the root changes, and so does the block hash. To prove a transaction is in a block, a handful of hashes is enough: that is the simplified payment verification of section 8 of the white paper.
The header of the first block
Tap a field, hash the 80 bytes in your own browser, then flip a single bit.
Build a merkle tree
Edit a transaction and watch the change climb to the root. Tap a leaf for the proof.
Room 06 · Proof of work
Proof-of-work is essentially one-CPU-one-vote.Work anyone can verify.
A block is only valid if its hash is at or below a target. There is no clever way to find such a hash. You try nonces until one works.
That is why a valid block is a proof. Whoever found it made a known number of attempts on average, and that cost electricity and hardware. Checking it costs one double hash.
Votes are not counted per person or per address, but per unit of work. Setting up thousands of fake nodes gets you nowhere.
Real miners use chips that do nothing but SHA-256. They use the same trick as the installation below: the first 64 bytes of the header do not change when only the nonce does, so that intermediate state is computed once.
Mine a block yourself
Your device does real work: an 80-byte header, double SHA-256, across several workers at once. Every find is then checked with your browser's own SHA-256.
Room 07 · Difficulty
Ten minutes, whatever happens.
Add hash rate and blocks come faster. That is why every node adjusts the target every 2016 blocks.
2016 blocks of ten minutes take two weeks. If the last period was shorter, the target shrinks and the work gets harder. If it was longer, the work gets easier. Each adjustment is capped at a factor of four.
No clock or committee decides this. Every node works it out from the timestamps in the blocks and rejects a block whose target is wrong (bad-diffbits).
A quirk from the original code: the measurement runs from the first to the last block of the period, so it covers 2015 intervals, not 2016.
Turn the hash rate up or down
Double or halve the hash rate and watch the block time get pulled back to ten minutes each time.
Room 08 · Most work
The chain with the most work wins.
Now and then two miners find a block at almost the same moment. For a while there are two versions of the chain. Every node follows the branch with the most work and switches as soon as another branch has more.
Usually such a split is settled after one block: whoever finds the next block decides which branch gets more work. Transactions from the orphaned block that are not in the other branch go back to the mempool.
Rewriting the past means redoing all the work from the block you want to change, and then outpacing the rest of the network. Every confirmation on top makes that more expensive.
The white paper calls it the longest chain. In the code, since version 0.3.3 (July 2010), it is the chain with the most accumulated work, not the most blocks.
Break the chain
Change a transaction in an old block. Then you get to mine everything again.
The race for most work
An attacker secretly builds a branch of their own. Choose their hash rate and how long the recipient waits.
The consequences
Rooms 09 to 12
Room 09 · 51% attack
What does an attack cost?
Anyone with more hash rate than everyone else combined can build a secret branch that overtakes the honest chain. With less, you can still try. Satoshi worked out in 2008 how fast your chance then shrinks.
Below half, the chance drops exponentially with every block the recipient waits. By the white paper's estimate, with 10% of the hash rate it is under 0.1% after 5 confirmations. An exact calculation gives about 0.18%, and only drops under 0.1% after 6. From half on, the attacker always wins. Even then they cannot spend other people's coins or change the rules.
The real barrier is physical. More hash rate than the whole network takes machines that have to be built first, and electricity that has to be paid for every hour.
Run the numbers
The formula from section 11 of the white paper, and the power bill for one hour of majority.
Room 10 · Issuance
20,097,612.5BTC issued on schedule, up to and including block 971,235 · as of 13/10/2026
Just under 21 million, never more.
New bitcoin only comes into existence in the first transaction of a block, as a subsidy for the miner. That subsidy halves every 210,000 blocks, roughly every four years.
It started at 50 BTC per block in 2009. Since block 840,000 (20 April 2024) it has been 3.125 BTC. The next halving falls on block 1,050,000, expected around April 2028.
The subsidy is halved in satoshis and rounded down. That is why the series ends at 20,999,999.9769 BTC. The last block with a subsidy is block 6,929,999, around 2140. After that, miners live on fees alone.
Every node checks this too: a block that pays the miner more than the subsidy plus the fees is rejected (bad-cb-amount).
Drag through time
Room 11 · Nodes
Don't trust. Verify.
A node is a computer that applies every rule of Bitcoin itself. It does not accept a block because a miner sent it, but because it checked the block on its own.
Miners propose blocks, nodes decide what is valid. A miner who breaks a rule wastes their work: nobody builds on that block. Some of what Bitcoin Core checks for every new block, with the reason it gives when it says no:
The hash is at or below the target.
high-hashThe target matches the last adjustment.
bad-diffbitsThe merkle root matches the transactions.
bad-txnmrklrootEvery coin being spent exists and has not been spent.
bad-txns-inputs-missingorspentEvery signature is valid.
block-script-verify-flag-failedThe miner takes no more than the subsidy plus the fees.
bad-cb-amountThe block weighs at most 4,000,000 units.
bad-blk-weightThe time is after the median of the previous 11 blocks, and at most two hours ahead of the node's clock.
time-too-old · time-too-new
By default, Bitcoin Core 31 opens 8 full-relay and 2 block-relay-only outbound connections, and accepts up to 125 connections in total.
Release a block
Tap a node: it finds a block and the rest check it. Or try a fake one.
Room 12 · Energy
How much power, and what for?
Proof of work uses electricity, and that is not a side effect. The cost is what makes the past expensive to rewrite. How much it is depends on the hash rate and on the machines.
Cambridge estimates the consumption with a simple sum: hash rate times the efficiency of the machines. On 13 October 2026 its best guess was about 163 TWh a year, within a wide range of 84 to 314 TWh. Cambridge's report of April 2025 put it at about 138 TWh in June 2024, roughly 0.54% of the world's electricity.
Estimates of the sources differ. A Cambridge survey of 49 mining companies, together about half the hash rate and mostly in the United States, found 52.4% renewables and nuclear, with natural gas as the largest single source. Another Cambridge model, based on locations from 2022, found a dirtier mix.
The same report puts emissions at about 39.8 megatonnes of CO₂ equivalent a year, around 0.08% of global emissions. By the same survey, 11.1% of the hash rate was due to be retired by the end of 2024; 86.9% of those machines are to be reused or recycled, leaving about 2.3 kilotonnes of electronic waste. The companies reported these figures themselves.
Do the sum
Hash rate times efficiency. Move the efficiency of the machines.
Reference
Room 13
Room 13 · Glossary
Glossary.
From block to UTXO
Magnetite Lab
About this concept
Difficulty One does not exist. It is a concept by Magnetite, built to show what an educational site can do: maths that actually runs in your browser, a 3D scene without a single 3D file, and two languages written side by side. Every statement has been checked against the white paper, the BIPs, the Bitcoin Core source code and Cambridge's figures. The slogan comes from section 1 of the white paper: "cryptographic proof instead of trust".
On an older phone the installations run slower; in room 06 you can see that in your own hash rate. Your browser fetches the live figures directly from mempool.space, without cookies; that service does see your IP address. If it does not answer, you see the figures from 13 October 2026.
Educational concept, not financial advice. This site shows no prices and sells nothing.
Sources
- Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
- Bitcoin Core, broncode v31.1
- Bitcoin Improvement Proposals (BIP141, BIP152, BIP340, BIP341)
- Bitcoin developer documentation
- mempool.space (live blokhoogte, moeilijkheid, vergoedingen)
- Cambridge Bitcoin Electricity Consumption Index
- Bitmain, specificaties Antminer S21 XP en S23 XP Hyd. (efficiëntie in J/TH, 13/10/2026)
- Cambridge Digital Mining Industry Report (april 2025)