Why proof of stake? Trading electricity for skin in the game

The night the power plants switched off

On 15 September 2022, Ethereum did something no major blockchain had done before: it stopped mining. In a single planned event nicknamed the Merge, the network swapped its consensus engine from proof of work to proof of stake — and its electricity consumption fell by roughly 99.95%, from the appetite of a small country to that of a few thousand homes. The chain kept producing a block every twelve seconds. Balances did not change. Contracts kept running. The lights, in effect, went off and nobody noticed.

That raises an honest, almost suspicious question. For a decade we were told that the whole point of mining was to burn real energy so that attacking the chain would cost real money. If you can turn off the power plants and the chain is still hard to rewrite, what was the electricity buying — and what replaced it? Answering that is the job of this rung. This first guide is the why: what problem consensus actually solves, how proof of work and proof of stake each solve it, and what it means to say one chain is 'more secure' than another.

The real job of consensus: Sybil resistance

A blockchain is a peer-to-peer network with no boss. Thousands of anonymous machines must agree on one history of transactions, even though some of them may lie, go offline, or actively try to cheat. The naïve fix — 'let everyone vote, majority wins' — fails instantly, because identity on the internet is free. I can spin up a million fake nodes from one laptop and outvote the entire honest network. This is the Sybil attack, and defeating it is the central trick of every blockchain.

The cure is Sybil resistance: instead of one-identity-one-vote, you tie voting power to something scarce and costly that you cannot fake by copying yourself. Proof of work ties it to computation — to vote you must burn electricity. Proof of stake ties it to capital — to vote you must lock up money. Both are answers to the exact same question; they just choose a different scarce resource to anchor honesty to.

Proof of work, in one loop and one number

In proof of work, the scarce resource is hashing. To propose a block, a miner repeatedly hashes the block header while varying a nonce, searching for a hash below a tiny target set by the network's difficulty. There is no shortcut and no insight that helps — you simply try, and try, and try. The first miner to get lucky publishes the block and collects the reward.

# Proof of work: keep hashing until the block's hash clears the target
target = 2**256 // difficulty          # smaller target = harder to hit
nonce  = 0
while True:
    header = block_header(prev_hash, merkle_root, timestamp, nonce)
    h = sha256(sha256(header))          # Bitcoin uses double SHA-256
    if int(h) < target:
        broadcast(header)               # found it -> this is the new block
        break
    nonce += 1                          # otherwise, try the next nonce

# One pass of the loop is one "hash". The whole Bitcoin network runs
# this loop hundreds of quintillions of times *per second*.

This gives a beautifully simple security argument. To rewrite history — say, to erase a payment you already made — you must re-mine the block it sits in and every block after it, faster than the honest network extends the real chain. That requires controlling more than half of all mining power: the famous 51% attack. Honest miners' combined hashing — measured as the network hash rate — is the wall an attacker must climb. The taller that wall, the safer the chain.

Now the number. Honest Bitcoin miners collectively earn the block subsidy plus fees — on the order of tens of millions of US dollars per day — and to earn it they spend roughly that much on electricity and hardware. That ongoing spend is the chain's security budget, and it is enormous: Bitcoin consumes very roughly 100–170 terawatt-hours a year, comparable to a country like Argentina or Poland. Proof-of-work advocates argue this is a feature, not a bug: the security is anchored in a physical, external cost that no amount of clever software can fake.

Proof of stake: skin in the game instead of fuel

Proof of stake makes one substitution: the scarce resource is no longer energy but capital that is locked inside the protocol. To take part, you become a validator by staking — depositing the chain's own token as a bond. The protocol then picks who proposes and who votes on each block in proportion to how much each validator has staked. Stake one unit and you get one unit of influence; stake a thousand and you get a thousand. Forging a fake identity buys you nothing, because influence comes from money posted, not from how many machines you claim to run.

Here is the conceptual leap that gives the rung its name. In proof of work the deterrent is cost: attacking is expensive, but if you can afford it, nothing is taken from you. In proof of stake the deterrent is also punishment: because your bond lives inside the protocol, the protocol can destroy it if you break the rules. Signing two conflicting blocks, or voting two contradictory ways, is provable misbehaviour — and triggers slashing, which burns a chunk of your stake and ejects you. (The exact slashing conditions are the subject of a later guide in this rung.) That is the literal meaning of skin in the game: you are not renting security to the network, you are posting a hostage.

Security budget: a flow versus a stock

A chain's security budget is, loosely, how much an attacker must outspend or put at risk to overpower the honest majority. The deep difference between the two models is that proof of work's budget is a flow (money spent per hour, forever) while proof of stake's is a stock (capital locked and at risk of destruction). Walking the same attack through both makes this concrete.

1. PoW honest cost is a flow. Bitcoin's miners spend on the order of tens of millions of dollars a day on power and rigs. To 51%-attack, you must out-hash all of them — roughly match that spend continuously, for every hour you want to keep rewriting blocks, on top of acquiring the machines.
2. A PoW attack is recoverable for the attacker. When the attack ends, your ASICs and your electricity contract still have value — the protocol cannot reach out and confiscate them. The defence is pure cost; there is no in-protocol punishment.
3. PoS honest cost is a stock at risk. On Ethereum, more than 30 million ETH — over a quarter of the entire supply, worth tens of billions of dollars — sits staked. Your share of voting power equals your share of that locked capital.
4. A PoS attack burns the attacker's own money. To force two conflicting outcomes you need to control a large fraction of the stake (a third to stall, two-thirds to finalize a lie — the territory of the finality guide). Pull it off and the protocol slashes the offending stake: a technically successful attack still destroys the very capital you bought to mount it, and likely craters the token's price along with it.
5. So the two questions differ. Proof of work asks 'how much must I out-spend, per hour?' Proof of stake asks 'how much capital must I put at risk of destruction?' Both budgets scale with the coin's market value, and neither is free — but only one lets the protocol punish the attacker.

Be honest about the caveats in both directions. Proof of work's budget quietly shrinks: Bitcoin's block subsidy halves every four years, so unless transaction fees grow to fill the gap, the wall an attacker must climb gets shorter over time. Proof of stake's budget is not static either — an attacker trying to buy up a third of the supply would drive the price up sharply on the way in, then crash it on the way out. Both numbers are real, both are large, and both are entirely contingent on the market price of a volatile asset.

Who gets to play — and the honest trade-offs

Switching the scarce resource also changes who can participate, which feeds straight into decentralization. Proof of work rewards whoever has the cheapest electricity and the best ASIC chips, so mining concentrates into industrial farms in a handful of regions, and small miners band into mining pools to smooth their income — pools that can themselves grow worryingly large. The hardware barrier is high, and it is physical.

Proof of stake flips the barrier from hardware to capital. You can validate on Ethereum from a modest laptop and a home internet connection — but you need 32 ETH to run a solo validator, on the order of US$50,000–100,000 at recent prices. That is out of reach for most people, so they delegate to staking services and liquid staking pools. The result is a different centralization worry: the single largest liquid-staking pool has at times held close to a third of all staked ETH, concentrating influence in a way the protocol never intended.

And proof of stake brought genuinely new theoretical problems that proof of work never had. Because voting costs nothing physical, a validator could in principle vote on every competing fork at once — the nothing-at-stake problem — which is exactly what slashing exists to make suicidal. An attacker who buys old, abandoned keys might try to rewrite history from far in the past — the long-range attack — which is why proof-of-stake chains lean on weak subjectivity: a freshly syncing node trusts a recent, socially-agreed checkpoint rather than rebuilding from the genesis block by raw work alone. These are real costs of the design, and the rest of this rung is largely the story of how they are defused.