// learn · episode 03
Consensus & proof of work
Episode 2 made history tamper-evident — you can always tell two histories apart. But which one is real? This episode: how millions of strangers agree, with no referee. You've done the hashing already, so today we simulate the statistics instead — that's where consensus actually lives.
01 · the problem
Two versions of history
Digital money's oldest nightmare is the double-spend: copy the coin, spend it twice. Banks solve it with a ledger they control. Remove the bank, and you get this:
Ali has 5 coins — and quietly signs two payments with them: one to Siti, one to Raju. Two versions of history now exist. Both are internally valid: correctly hashed, properly mined, chained without a flaw. Click the one you believe.
02 · the race
The longest-chain race
Everyone follows one rule: the chain with the most work wins. So rewriting a payment that's already buried isn't just re-mining a few blocks like episode 2 — it's outpacing every honest miner, indefinitely. Try it. You're the attacker; pick your hashpower and the attacker's known starting deficit, and race.
“theory says” is Nakamoto's catch-up probability from the Bitcoin whitepaper — (q/p)z for q < p, or 1 otherwise, from a known deficit over an unlimited race. This simulation stops at a 12-block deficit and counts a tie as a win. Its finite-run rate can differ from the unlimited theory, especially near 50%.
Below 50% hashpower, every block you fall behind roughly multiplies your odds down — you lose exponentially. Above 50%, given enough time you always win. That cliff is why “a 51% attack” is the number everyone quotes, under this model. Network conditions and independent validation of consensus rules also matter to Bitcoin's security.
03 · buried alive
Why the starting deficit matters
Confirmations increase confidence, but they do not reveal an attacker's hidden chain. This panel starts from a known deficit and calculates the chance of ever reaching a tie. In section 11 of the Bitcoin whitepaper, the separate waiting-payment model gives 0.0002428 (about 0.02428%) for q = 0.1 and z = 6; the known-deficit calculation here gives 1 in 531,441. Neither is a universal risk estimate.
probability of ever catching up from this known deficit: 1 in 531,441
This is (q / (1 − q))^z: constant hashpower, independent block arrivals, an unlimited race, and a known deficit of z blocks. Reaching a tie counts as catching up; at zero deficit the attacker is already tied. The bars use a log scale. This is not payment-reversal risk after z confirmations: that separate model must account for progress the attacker made while you waited.
04 · the fine print
Three things worth knowing
Difficulty breathes
Every 2,016 blocks (~2 weeks), Bitcoin retunes the target so blocks keep arriving every ~10 minutes — whether a thousand miners join or quit.
Don't trust, verify
Full nodes check consensus rules independently. These browser lessons demonstrate selected ideas; they do not implement a Bitcoin node.
Not the only ballot
Proof of work is the original consensus, not the only one — Ethereum switched to proof of stake in 2022. Same goal, different way of making votes expensive.
next up
Episode 04 — Wallets, keys & signatures play now →The network agrees on history. Next: what it actually means to own something on it.