Proof of work or proof of stake: what really changes

A public blockchain has no owner and no central server. Even so, thousands of computers need to agree on which list of transactions is the official one. The set of rules that produces this agreement is called a consensus mechanism.

The two best-known mechanisms are proof of work (PoW), used by Bitcoin, and proof of stake (PoS), adopted by Ethereum since September 15, 2022, the date of the upgrade known as The Merge (ethereum.org, The Merge). This article compares the two on four criteria: security, finality, energy and decentralization. There is no recommendation here about which coin to buy; the goal is to understand the trade-offs of each design.

For context on each network, see what Bitcoin is and what Ethereum is.

The problem both solve

Without an intermediary, someone could try to spend the same coin twice by sending conflicting versions of a transaction to different parts of the network. Consensus decides which version counts.

There is an extra difficulty: in an open network, anyone can create as many identities as they want. If each internet address counted as one vote, it would be enough to create thousands of addresses to dominate the vote. The Bitcoin whitepaper points to exactly this risk (Nakamoto, Bitcoin whitepaper).

The solution shared by both models is to tie the “vote” to something scarce and expensive to obtain:

• in proof of work, computing power, which costs hardware and energy;
• in proof of stake, the network’s own coin, deposited as collateral.

How proof of work works

On Bitcoin, miners compete to find a number that, combined with the block data, produces a hash below a target. Finding it takes billions of attempts; checking it takes a single calculation. The step-by-step process is in how Bitcoin mining works.

The whitepaper sums up the logic as “one-CPU-one-vote”: the valid chain is the one that has accumulated the most work. To alter an old block, an attacker would have to redo the work for that block and all the blocks after it, and still catch up with the honest network.

This intuition was later formally demonstrated. In 2014, Juan Garay, Aggelos Kiayias and Nikos Leonardos proved that the core of the Bitcoin protocol keeps the ledger consistent as long as the adversary has strictly less than half of the computing power, in a well-synchronized network. The same work shows that this margin shrinks when messages take longer to propagate (Garay, Kiayias and Leonardos, IACR ePrint 2014/765).

How proof of stake works

On Ethereum, those who validate blocks are called validators. To activate a validator, you need to deposit 32 ETH into a contract and run three programs: an execution client, a consensus client and a validator client (ethereum.org, proof-of-stake).

Time is divided into slots of 12 seconds, grouped into epochs of 32 slots. In each slot, one validator is randomly selected to propose the block. Committees of other validators vote on it through attestations, signed messages stating which block each one considers correct. Every active validator attests once per epoch.

What makes the system secure is the possibility of punishment. If a validator signs two blocks for the same slot or casts contradictory votes, it is slashed: it loses part of its deposit and is ejected from the network. According to the documentation, a validator slashed on its own tends to lose less than 0.1% of its deposit, but the penalty grows when many are slashed at the same time and can reach the entire amount.

The protocol in use today, called Gasper, combines two pieces described in academic papers: Casper FFG, by Vitalik Buterin and Virgil Griffith (2017), which marks blocks as final, and a fork-choice rule called LMD-GHOST (Buterin and Griffith, arXiv; Buterin et al., “Combining GHOST and Casper”, arXiv).

Ethereum was not the only path. In 2016, Aggelos Kiayias and co-authors presented Ouroboros, which they described as the first proof-of-stake protocol with rigorous security guarantees, comparable to Bitcoin’s (Kiayias et al., IACR ePrint 2016/889).

Security: what it costs to attack each network

Both models start from the same premise: attacking should cost more than the attack would gain. What changes is where that cost comes from.

In proof of work, the cost is a flow

To dominate Bitcoin, an attacker needs more computing power than all honest miners combined. That means buying or renting machines and paying for energy for as long as the attack lasts.

The whitepaper calculates the probability of an attacker catching up with the honest chain. With 10% of the computing power, 5 confirmation blocks are enough to bring that probability below 0.1%. With 30%, 24 blocks are needed. The probability drops exponentially with each additional block.

There are two important caveats in the academic literature:

• A majority may not be needed. Ittay Eyal and Emin Gün Sirer showed in 2013 that a group of miners can earn more than its fair share by withholding blocks it has found, a strategy called selfish mining. According to the authors, the Bitcoin protocol “is not incentive-compatible”, and the fix they proposed would protect against groups with less than 1/4 of the resources, not 1/2 (Eyal and Sirer, arXiv).
• Security has to be paid for continuously. Economist Eric Budish argues that the recurring payment to miners must be large relative to the one-off gain an attack would yield. In his assessment, this is “very expensive” and places limits on the economic importance the system can reach. Budish notes that the constraint is softer when hardware is specialized and has no other use, but points to risks in that scenario as well (Budish, NBER Working Paper 24717, 2018).

In proof of stake, the cost is a stock

On Ethereum, an attacker needs to control a fraction of the ether staked by validators. The documentation describes three thresholds (ethereum.org, proof-of-stake):

• One third: enough to prevent blocks from being finalized.
• 51%: allows control over chain selection. The documentation states that, in this case, the community can ignore the attacker’s chain or remove the attacker and destroy their deposit through social coordination.
• Two thirds: allows blocks to be finalized at will.

The key point is punishment. For two conflicting blocks to both be finalized, each would need two thirds of the votes. Mathematically, this only happens if at least one third of validators vote for both, which is a slashable offense. That is why, according to the Gasper page, reverting a finalized block would require destroying at least one third of all staked ether (ethereum.org, Gasper). The page estimated this cost at about US$ 10 billion in May 2022; the figure varies with the price of ether and the amount staked.

In the editorial team’s assessment, the underlying difference is this: in proof of work, an attacker who fails still has their machines; in proof of stake, a detected attack can cost the very capital used to carry it out.

Finality: when a transaction becomes final

Finality is the moment when a transaction can no longer be reversed.

On Bitcoin, it is probabilistic. There is no instant when a block becomes “official”; the chance of reversal just decreases with each block stacked on top of it. Ethereum.org itself describes the proof of work Ethereum used before 2022 this way (ethereum.org, proof-of-work).

On today’s Ethereum, it is explicit. At the start of each epoch there is a checkpoint block. When validators representing two thirds of the staked ether vote for it, the block becomes “justified”; when the next checkpoint is also justified, the previous one is “finalized”. In practice, this takes about 15 minutes (ethereum.org, single slot finality).

This wait has costs. The same page states that the gap between proposing and finalizing a block allows small chain reorganizations, which can be exploited, and that the multi-step mechanism is complex and has already received several fixes. The proposal to finalize every block within a single slot is in the research phase, with no expectation of arriving for several years.

If finalization stalls for more than four epochs, the inactivity leak kicks in: validators that do not vote with the majority gradually lose part of their deposit until the majority again adds up to two thirds and the chain resumes finalizing (ethereum.org, Gasper).

The hidden cost: weak subjectivity

There is a lesser-known trade-off. On Bitcoin, according to the whitepaper, a node can leave and rejoin the network, accepting the chain with the most work as proof of what happened while it was gone.

In proof of stake, that is not enough. Former validators who have already withdrawn their deposit could, in theory, build an alternative history from long ago with nothing to lose, the so-called long-range attack. To prevent this, a new node, or one that has been offline for a long time, must start from a weak subjectivity checkpoint: a recent state that everyone recognizes as part of the chain, obtained from a trusted source and checked against block explorers or several nodes (ethereum.org, weak subjectivity). It is a small dependence on social information that proof of work does not have.

Energy: the most visible difference

Proof of work consumes energy by design: the expenditure is what makes rewriting history expensive.

• Bitcoin: the Cambridge Centre for Alternative Finance at the University of Cambridge estimated in April 2025 a consumption of 138 TWh per year, about 0.5% of global electricity. The figure is extrapolated from data reported by 49 mining companies covering 48% of global activity (Cambridge Judge Business School).
• Ethereum after the switch: ethereum.org cites a 2022 study by the Crypto Carbon Ratings Institute (CCRI) estimating the network at about 0.0026 TWh per year and a drop of more than 99.988% in electricity consumption with the change (ethereum.org, energy consumption). The page on The Merge mentions about 99.95% (ethereum.org, The Merge).

Estimates vary with the method. Ethereum.org itself cites, on different pages, about 70 TWh per year (Digiconomist, July 2022) and 21 TWh per year for Ethereum before the switch. Whichever figure you use, the reduction spans several orders of magnitude.

Proof-of-work advocates reply that this expenditure is the price of security, not waste; the debate is covered in detail in the article on mining. The editorial team does not take sides: consumption figures are estimates, and the value placed on what they protect is a matter of judgment.

Decentralization: where each model concentrates power

Neither model, on its own, guarantees that power stays distributed.

In proof of work, concentration shows up in mining pools. In the year up to October 8, 2026, the three largest pools produced about 59% of Bitcoin blocks (Foundry USA, 28.3%; AntPool, 18.1%; F2Pool, 12.5%), and the five largest, about 77% (mempool.space, pools over 1 year). Pools do not own their members’ machines, and members can switch pools, but pools are the ones that assemble the blocks. Ethereum.org lists this tendency as one of the drawbacks of proof of work, along with the upfront investment in specialized equipment.

In proof of stake, the barrier to entry is different. Specialized hardware is not needed: according to the documentation, a validator runs on an ordinary laptop. But capital is needed: 32 ETH to validate on your own. Those with less turn to pools, liquid staking providers or exchanges. Ethereum.org acknowledges the risk: large providers that concentrate ether create “a centralized target and point of failure”, and exchanges are the option with the highest trust requirements (ethereum.org, staking).

Summary comparison

Criterion	Proof of work (Bitcoin)	Proof of stake (Ethereum)
Scarce resource	Computing power and energy	Staked ether (32 ETH per validator)
Cost of an attack	Ongoing flow of hardware and energy	Stock of capital, which can be destroyed
Finality	Probabilistic, grows with each block	Explicit, in about 15 minutes
Energy	Estimated at 138 TWh/year (Cambridge, 2025)	Estimated at 0.0026 TWh/year (CCRI, 2022)
Point of concentration	Mining pools	Pools, staking providers and exchanges
Maturity	Older and tested for years, according to ethereum.org	On Ethereum mainnet since September 2022

The risks specific to each design

The Ethereum documentation is frank about the drawbacks of proof of stake: it is newer and less battle-tested, and more complex to implement (ethereum.org, proof-of-stake). Complexity means more places for subtle bugs. Proof of work, in turn, depends on miner rewards remaining high enough to pay for security, a point raised by Budish and discussed in the Bitcoin halving.

For those who participate directly, the risks are also concrete:

• Mining requires equipment that quickly becomes obsolete, energy paid in local currency (in Brazil, reais) and rewards paid in a volatile asset.
• Staking exposes you to slashing and to penalties for being offline. With pools and third-party services, counterparty risk is added, and liquid staking tokens add smart contract risk (ethereum.org, staking). If the service fails or is fraudulent, the loss can be total.

In neither case does the consensus mechanism protect the asset’s price. A technically secure network can see its coin lose value sharply and for a long time.

Key takeaways

• Proof of work and proof of stake solve the same problem, preventing someone from dominating the vote by creating fake identities, by tying the vote to an expensive resource.
• In proof of work, attacking costs an ongoing flow of energy and hardware. In proof of stake, it costs staked capital, which can be destroyed if the fraud is detected.
• Bitcoin offers probabilistic finality; Ethereum finalizes blocks in about 15 minutes, but requires new nodes to start from a trusted checkpoint.
• Proof of stake uses a tiny fraction of the energy, but it is newer and more complex.
• In both models, concentration in a few pools, providers or exchanges is the most practical point of concern for decentralization.