The Trust Machine
From one desktop computer to a power plant — and the halving written into the code. An ideal is not enough; the thing has to actually run. This hall takes apart the machine: miners compete with raw computation for the right to write, thousands of nodes worldwide independently check the same set of rules, and the record grows harder to alter the further back you go. With no center at all, strangers end up sharing one ledger nobody can renege on.
Real hardware from every generation (CPU→GPU→FPGA→ASIC) · the history of network hashrate and difficulty · primary reports and on-chain records from three real consensus events.
This ledger is hard to rewrite because the whole network maintains it through hashpower competition and consensus rules — no single party is in charge, and the cost of rewriting rises with total network hashpower. The argument has known limits; see "What remains contested" in the 51% Attack exhibit of this hall.
How the Machine Runs
five parts, none optionalThe Trust Machine · Overview
See the forest before the trees. Picture the system as interlocking gears — five parts, none optional, that together make "trustless" work. Grasp the whole, then dig into one part in the exhibits below.
Public Ledger
A ledger anyone can inspect and everyone keeps a copy of.
Cryptographic Links
Blocks chain together — change one and all after it break.
Proof-of-Work
To keep accounts, first spend real hashpower and electricity.
Longest-Chain Consensus
The network defaults to the chain with the most accumulated work.
Incentive Design
Honest bookkeeping is rewarded; cheating costs far more than it earns.
Human Hash Challenge
A hash boils any data down to a fixed-length "fingerprint" that cannot be reversed. Mining means changing a number and re-hashing until the result is small enough: no shortcut, only trial after trial. Click as fast as you can.
Proof-of-Work & Difficulty Adjustment
Hashpower has grown more than a hundred-trillion-fold, yet a block still arrives roughly every ten minutes — because the rules correct themselves. Every 2,016 blocks (about two weeks) the network automatically retunes difficulty against how long the last round actually took: too fast, and it gets harder; too slow, and it eases. No committee meets and nobody issues an order.
Halving Clock
Time until the next Bitcoin halving —
The block reward, the new coins a miner earns for each block and the only source of new bitcoin, halves every 210,000 blocks: 50 → 25 → 12.5 → 6.25 → 3.125 BTC. The 21-million cap rests on no institution’s promise; it is the arithmetic consequence of that halving rule.
How One Transaction Gets Confirmed Without Trusting Anyone
Follow one real transaction end to end. At each step, ask just one thing: who would you have had to trust here — and what mechanism replaced them?
Initiate
You sign with your private key — proving "it’s really me".
Broadcast
The transaction spreads to nodes, into the mempool.
Mine
Miners race; the winner packs it into a block.
Confirm
The network syncs; the deeper it goes, the more irreversible.
| Who you’d normally trust | What replaces it | |
|---|---|---|
| Trust a bank to check your balance | → | Public network-wide ledger + cryptographic signatures |
| Trust someone to keep honest accounts | → | PoW hashpower race + longest-chain rule |
| Trust everyone not to cheat | → | Incentive design: cost of cheating > reward |
Why This Ledger Is So Hard to Rewrite
Starting from the double-spend problemSolving the Double-Spend
Digital information can be copied at will, so why can’t a digital coin be copied and spent twice? Traditionally a bookkeeper, such as a bank, checked balances. What happens without one? This is the double-spend problem.
Satoshi’s answer was not "find a more trustworthy person" but "make chronological order itself expensive". Every transaction is broadcast publicly and packed into blocks in order, and writing a block costs real computation. To spend the same coin twice you must overturn an order already written — redo all the work that came after it, and outrun every other machine on Earth while doing so. Double-spending was never forbidden; it was simply made economically infeasible.
Immutability
Every block header contains the hash of the block before it. Change a single byte and that hash changes, which invalidates the pointer held by the next block — and the break cascades all the way to the tip. So to rewrite block N you must redo the work of every block after N while also keeping pace with a network still racing ahead. It is not that changes are forbidden; it is that they cannot be afforded.
Hash pointers
Each header carries the previous block’s hash, so tampering is immediately visible.
Cumulative work
Altering one block means redoing all proof-of-work after it — the work piles up with every block.
Older means harder
The deeper a block is buried, the closer rewriting it comes to impossible.
Consensus Rules · What Nodes Actually Check
This is the most widely misunderstood point in the museum: miners do not decide the rules — nodes do. Miners only propose, by packing transactions into a block. Every full node on Earth then independently checks that block line by line: are the signatures valid, is anything double-spent, do the amounts balance, is the reward within the allowed issuance, is the block within size limits? Fail any one check and the block is discarded, no matter how much hashpower proposed it. "Don’t trust, verify" is not a slogan; it is what every node does every ten minutes.
- Signature validity
- No double-spend
- Issuance conserved
- Work threshold met
Signature validity
Whether each input was legitimately signed by the corresponding private key.
No double-spend
Whether the UTXOs being spent are genuinely unspent.
Issuance conserved
Whether the block reward matches what the current halving epoch permits.
Work threshold met
Whether the block hash satisfies the current difficulty target.
Miners propose; nodes adjudicate. This is why "more hashpower" does not mean "the final say". In the 2017 block size dispute the outcome was not decided by miners alone, and how much each side contributed is still disputed; for the full story, see the Block Size War exhibit in Triumphs & Disasters.
The Longest Chain & Fork Convergence
When two miners find a block at almost the same moment, the network briefly holds two chains — not a fault, but a condition the design anticipates. Each node provisionally accepts whichever it saw first and keeps mining. Wherever the next block lands, that side is longer; the other is abandoned and its blocks become "orphans". Disagreement converges automatically, by hashpower, with no arbiter. This also explains confirmations: the more blocks stacked above your transaction, the more absurd the hashpower needed to reverse it.
Orphaned · its transactions return to the mempool
The chain grows as usual
Temporary forks
Simultaneous blocks produce two candidate chains — entirely normal.
Orphan blocks
Blocks on the losing chain are discarded and their transactions return to the mempool.
Why wait for six confirmations
Each additional confirmation exponentially lowers a minority attacker’s chance of catching up — waiting is security.
The Ledger Heist · 51% Attack
Rewriting the ledger does not come from “running more nodes”; it comes from hashpower. Drag the slider to play the attacker — see what that share of hashpower costs, and what odds it actually buys under the formula in section 11 of the whitepaper.
It’s hashpower, not running nodes
Running a node is cheap — it only validates transactions by the rules. What can actually rewrite the ledger is "who has the most hashpower/work." A reliable attack requires controlling >50% of total hashpower; with less, success is still possible, but the odds fall rapidly with each confirmation.
Total hashpower is vast; its distribution changes over time
Network hashpower comes from thousands of miners and pools worldwide. To pass half you would need to buy and run more ASICs than every other participant combined, on the order of tens of billions of dollars in hardware and power. But concentration is not constant: for the history of pool share, see "Pools & the Concentration Problem" in this hall.
Even if you did, there is little to steal
At most you can double-spend your own recent transactions or temporarily censor some; you cannot mint coins from nothing, steal others' coins, or rewrite ancient history.
The economics of attacking
Section 6 of the whitepaper argues that even with majority hashpower, mining new coins by the rules pays better than undermining the system, because a broken system devalues the attacker’s own coins. Later work such as Budish 2018 adds that an attack would also devalue mining hardware that is good for nothing else. For the conditions under which this holds, see "What remains contested" below.
Older entries get harder to change
Overturning an earlier block means redoing all the work after it — the work piles up with depth, and a minority attacker’s odds fall exponentially; and the community can detect the anomaly and push back.
What remains contested
The five points above are the mainstream argument for this design, but they are not settled. (1) “A majority is required” is disputed: the selfish-mining result of Eyal and Sirer (2013) argues that under certain conditions less than 50% can earn an outsized return. (2) An attacker need not build mines: hashpower rental markets make short-term hire possible, and reorganizations of this kind have occurred on Ethereum Classic and Bitcoin Gold. (3) The economics in point 4 assume the attacker holds the hardware; if the attacker also holds a short position, that calculation does not hold (Budish 2018). The museum exhibits these arguments and makes no finding on which holds.
The Hashpower Race
from one computer to a power plantMining Rig Wall
From one desktop computer to a power plant — the evolution of mining hardware. CPU→GPU→FPGA→ASIC: each generation retired by the next one’s higher hashrate and efficiency.
Generation-by-Generation Catalog · Specifications & Sources
Every machine is listed with the source of its specifications and its image.
General-purpose x86 CPU · e.g. Intel Core i7-920
The one exhibit on this wall that is not mining hardware at all — an ordinary desktop processor. Satoshi mined the genesis block on a CPU. Its significance lies not in performance but in the absence of any barrier to entry: anyone with a computer could take part, and hashpower was as evenly spread as it would ever be. This is the only period in Bitcoin history when mining required no special equipment, and it has never returned.
AMD/ATI Radeon HD 5870
The workhorse mining card of the GPU era. Its parallel architecture hashed SHA-256 dozens of times faster than a CPU, rendering CPU mining pointless overnight. Miners of this generation bought almost nothing but AMD: the VLIW architecture carried the BFI_INT / bitalign instruction, doing the bit-rotation SHA-256 needs in a single instruction where NVIDIA needed three, and with more ALUs besides, AMD cards mined 3–5× faster overall. From here on mining was tied to specific hardware — buy the wrong brand and you could not compete. The dual-GPU flagship of the same year, the HD 5970, reached about 700 MH/s.
Multi-GPU mining rig (open-frame rack)
The only exhibit of this generation that was not a product but a shape miners improvised for themselves. Once one card was no longer enough, several GPUs were bolted onto open frames, linked to a single motherboard through PCIe risers, fed by oversized power supplies and cooled with industrial fans. Mining went from "a computer" to "a row of graphics cards" — and electricity, heat and floor space became core costs for the first time. Every principle of a modern mining farm is already visible on this desk.
Icarus
An open-source FPGA miner, and the starting point of the road to ASICs. In 2011 ngzhang released Icarus on the Bitcointalk forum: two Spartan-6 LX150 chips on one board, about 380 MH/s at roughly 19.2W — the hashrate of a GPU-era HD 5870 (400 MH/s at about 190W) for about a tenth of the power. Its schematics and project files were all published under the GPL, so anyone could build one. FPGAs were a bridge not because they were faster, but because they proved that burning SHA-256 directly into circuitry yielded an order-of-magnitude leap in efficiency. ngzhang then walked that road to its end: the Avalon project he launched produced the first commercial ASIC miner, the Avalon Batch 1.
Butterfly Labs BitForce SHA256 Single
One of the first Bitcoin miners you could simply buy. Butterfly Labs was among the first companies to sell mining hardware as a finished product: mining no longer had to be assembled by hand, and an industry was born — the path later followed by Bitmain and Canaan. At 832 MH/s and 80W it delivered only about half the hashrate per watt of the contemporary Icarus, showing how wide the efficiency spread was even within one generation. ⚠ The company was shut down by the FTC in 2014 over pre-orders it never shipped — the other face of industrialization, exhibited here alongside the rest.
ZTEX 1.15y USB-FPGA
Four Spartan-6 LX150 chips delivering about 860 MH/s — the highest hashrate of its generation. What sets it apart is that ZTEX open-sourced its own mining software, BTCMiner: in 2011 it was uncommon for a hardware vendor to release its mining firmware openly, and that thread of open source runs unbroken to the miner-firmware ecosystem of today. Its modular USB design also let miners assemble low-cost clusters from USB hubs and ATX power supplies — a contrast to the self-contained BitForce.
Canaan Avalon Batch 1
Day one of the ASIC era. A chip built to do one thing, SHA-256, and nothing else. It beat every previous generation on efficiency and made FPGAs and graphics cards obsolete within months: 66 GH/s was the equivalent of about 170 Icarus boards — and the man who launched Avalon was ngzhang (Zhang Nangeng), who had released Icarus. Notably, the first commercial ASIC came from Canaan, not Bitmain: Avalon reached mass production and delivery first, and within a few years dominance had shifted to Bitmain. The first batch numbered only about 300 units, and it is now a collector’s item.
ASICMiner Block Erupter USB
A miner the size of a USB stick: plug it in and it mines. It was the last attempt at "anyone can take part" — cheap enough for almost anyone, needing no rack and no special power supply. With the shell removed you can see how simple it is: one chip the size of a fingernail and a USB connector, with almost all the remaining space given over to cooling. But 333 MH/s counted for nothing beside the tens of GH/s machines of the same year. It is exhibited here not because it was powerful, but because it marks the end of retail mining: from this point on, mining became a business of capital and electricity.
Bitmain Antminer S1
Bitmain’s first machine. Not remarkable in itself; its importance lies entirely in being the start of a product line that would run for more than a decade — S1 led to S3, S5, S7, then to the S9, one of the most widely deployed miners ever built, and on to the S21 and today’s S23. A latecomer that entered in 2013 ended up dominating the world’s supply of hashpower.
Bitmain Antminer S9
If only one machine were to get a biography, it would be this one. 13.5 TH/s at 1,323W; after its release in 2016 it carried the bulk of the network’s hashrate for years, making it one of the most widely deployed and longest-serving miners ever built — S9s still run today wherever power is cheap enough. It also defined the shape of the modern miner: a silver tube, a fan at each end, one network cable and one power cable. Most air-cooled miners since have followed this template.
Bitmain Antminer S19 / S19 Pro / S19 XP
The standard fit-out of industrial mining. Three models spanning 95 to 140 TH/s covered different electricity prices and depreciation strategies, and were deployed by the thousand into containers and warehouses. By this generation miners were no longer discussed by the unit but by the megawatt — the decisive variable in choosing hardware had shifted from hashrate to watts per terahash and time to break even.
Bitmain Antminer S21
The 2023 flagship. 200 TH/s — roughly 15× the S9 of 2016, which was itself some 200× the Avalon Batch 1 of 2013. Set those three side by side and you have a three-thousand-fold leap in a decade — and a decade in which difficulty adjustment held the block interval at ten minutes throughout.
MicroBT Whatsminer M60S
Evidence that Bitmain no longer stands alone. MicroBT was founded by a former Bitmain chip engineer and, through the Whatsminer line, became the second pole of the industry, competing with the S series head-on on efficiency. Diversity among hardware suppliers bears directly on decentralization: if every miner on earth came from a single company, that company’s latent influence over the network would itself be a systemic risk.
Canaan Avalon A1566
The machine that closes the circle. It was Canaan that built the world’s first commercial ASIC in 2013, and more than a decade later it is still in the race. Compare the three flagships of the 2023–24 generation side by side and a picture emerges quite unlike the early years — S21 at 17.5, M60S at 18.5 and A1566 at 18.5 J/TH: the gap between the three manufacturers has narrowed to a decimal place, where in 2013 the distance between Avalon and the Antminer S1 was still a four-to-five-fold gap. Competition now comes down to fractions of a joule per terahash, and the barrier in this business has shifted from "can you build the chip" to "how much more can you compute per joule".
Mining Farm
Over seventeen years the physical form of mining went from a desktop computer to industrial campuses measured in megawatts. What drove that change was not hashpower itself but the cost per unit of hashpower: with the block reward fixed by protocol and competitors continually arriving, the only remaining margin lay in converting each kilowatt-hour into as many hashes as possible. That single constraint reshaped the hardware, then the buildings, then the siting — and in the end turned mining into an electricity business.
Domestic hardware
Running on personal computers, drawing power on the order of a hundred watts, indistinguishable from ordinary household use. There were no “farms” at this stage: network hashpower was low enough that a single machine still had a real chance of finding a block, and concentration was unnecessary.
Self-built machine rooms
Once multi-GPU rigs appeared, a single machine drew power on the order of a kilowatt, and domestic wiring and cooling became the binding constraint. Miners moved into garages and warehouses — spaces that could be modified — and for the first time had to deal with electrical upgrades and forced ventilation. This is where the machine-room problem begins.
Siting driven by the price of power
ASICs improved efficiency by orders of magnitude and pushed thermal density to the point where it had to be designed for. Hardware is a one-off cost that can be amortized; electricity recurs every month. From this stage on, siting was no longer a question of convenience but of where power would be cheapest over the long run.
Industrial and financial scale
Campuses are measured in megawatts, and hosting arrangements and publicly listed miners appear. Some operators sign interruptible supply agreements with the grid, powering down during periods of strain in exchange for compensation — turning mining from simply a consumer of electricity into a dispatchable load.
Price of power — the dominant operating cost, and therefore the break-even point. Cooling conditions — ambient temperature and cooling method together determine how much additional electricity is spent on removing heat; air cooling depends on the climate, while water and immersion cooling trade higher up-front cost for a higher ceiling on thermal density and make heat recovery possible. Regulatory stability — once deployed, hardware cannot easily be moved at short notice, so predictability is itself a cost. Since 2021 this variable has carried visibly greater weight in most siting decisions.
When China banned mining outright, hashpower that had accounted for nearly half the network (about 46% in April 2021) was forced to relocate across borders within months. This remains the most direct stress test of the three variables above: hardware can be moved, cheap power and a stable policy environment cannot, so the relocation was not an even dispersal but a re-concentration in North America, Central Asia and elsewhere. The network itself was unaffected — difficulty adjustment returned the block interval to ten minutes automatically. The event is exhibited in Triumphs & Disasters.
What energy mining actually consumes, and how its environmental cost should be weighed, is an open question on which there are several positions. Frequently cited claims include that mining can absorb curtailed and stranded energy, and that the energy cost per transaction is excessive; each rests on its own methodological premises and each has its critics. The museum makes no finding here. Three positions are exhibited side by side, each with a primary source, in “Energy: Is Proof-of-Work Worth It?” in Culture & the Future.
A History of Network Hashrate & Difficulty
From a few million hashes per second in the CPU era to nearly a thousand exahashes per second today — roughly fourteen orders of magnitude since 2009. It is the data history of an arms race, and also the quantitative answer to why this ledger keeps getting harder to alter: hashpower is the ledger’s moat.
Consensus in Action
three real historical eventsThe Value Overflow Incident
August 15, 2010, block 74638: an integer overflow bug (a number too large for the program to represent "wraps around" to a wrong value) let someone conjure about 184.5 billion BTC out of nothing — vastly beyond the 21-million cap. It should have been fatal. Instead, within about five hours a patched release shipped with a soft-fork rule rejecting the overflow transaction; the next day (August 16) the chain without it overtook at block 74691, became the longest chain, and the bad chain was abandoned outright. This is the episode most worth remembering: the ledger corrects itself, and scarcity is guarded by rules and people together.
The 2013 Accidental Fork
March 2013, block 225430: two versions of the Bitcoin software disagreed on whether the same block was valid. This was not the temporary fork caused by simultaneous blocks but a split in how the rules were enforced, and the network divided into two chains by accident. Within hours miners coordinated a downgrade to the older software, moving majority hashpower back to the chain it accepted, and the network reunified. The subsequent BIP 50 post-mortem by Gavin Andresen is an important primary document on how a decentralized network handles disagreement — it records both how coordination happened and how much the system relied on people.
Pools & the Concentration Problem
A solo miner finding a block is like winning the lottery — wildly unstable income. Pools aggregate the hashpower of thousands of miners and split rewards by contribution, trading "a rare jackpot" for steady small payouts.
But pools raise this hall’s sharpest question: if hashpower concentrates too far, does "nobody is in charge" still hold? In June 2014 the pool GHash.io briefly exceeded 50% of network hashpower for roughly 24 hours. No attack occurred — what happened was public pressure from the community and miners voluntarily withdrawing, after which GHash.io committed in July to cap its share at 39.99%. The crisis was resolved by participants correcting themselves, not by any institution. It is also a reminder: decentralization of hashpower needs continuous maintenance. It is not automatic.
A ledger without a bookkeeper
None of this required anyone’s approval: rules, cryptography and incentives did the work. With no bookkeeper, the same coin still cannot be spent twice, and strangers can still agree on one ledger that is extremely hard to rewrite.
Key Facts
- Max supply 21,000,000 — fixed in code, unchangeable.
- The reward halves every 210,000 blocks (~4 years).
- A new block is produced roughly every 10 minutes.
- Tens of thousands of nodes worldwide keep one shared ledger.
- Rewriting the ledger needs majority hashpower — a 51% attack.
- Mining hardware evolved: CPU → GPU → FPGA → ASIC.