After reading a little bit about different consensus algorithms, I am just trying to understand why Bitcoin still uses proof-of-work. This consensus algorithm being exponentially expensive, and resource intensive, doesn't it make more sense for Bitcoin --the most expensive cryptocurrency out there-- to migrate to proof-of-stake?

Currently, Bitcoin transactions are so expensive that day-to-day transactions, like buying a cup of coffee, can be more expensive than the good/service itself in some parts of the world, which fails to deliver one of the original goals of Bitcoin. That is to be the common person's every-day money.

Why does Bitcoin stick to the proof-of-work consensus algorithm?

  • 3
    Was everyday use ever really a goal of Bitcoin? The number of transactions it can process per hour is hard-limited by its design. Either Satoshi Nakamoto didn't understand the order of magnitude of the world financial system or replacing it was never the intention.
    – Philipp
    Commented Apr 20, 2020 at 12:13
  • 9
    According to the whtepaper, everyday use was the goal. At the time when the limit was introduced the number of transactions was order of magnitudes lower; and the code was basically in the alpha/prototype stages. I'm sure replacing the limit was the intention, but Satoshi didn't know of a viable solution.
    – csiz
    Commented Apr 20, 2020 at 15:04
  • @Philipp Scaling to everyday use is clearly a difficult task, but its worth noting that on-chain transactions per second =/= payments per second. Finding nuanced ways to create bitcoin transactions which allow us to pack a huge number of payments into a single on-chain transaction is an interesting approach that may be viable. The lightning network is an example of this.
    – chytrik
    Commented Apr 20, 2020 at 21:41
  • Oh, I thought micro transactions are the most important application of Bitcoin. Commented Apr 23, 2020 at 6:35
  • 1
    @VolkerSiegel: In the past few years, the store of value use case has been emerging as the dominant application. Small payments are in the process of moving to second layer systems.
    – Murch
    Commented May 19, 2021 at 11:40

6 Answers 6


Proof of Stake is basically a case of having your cake and eating it, too.

PoW is a simple work-around to a coordination problem that was previously thought to be unsolvable. It sort of "cheats" by providing an economic solution to a distributed systems challenge, by introducing a real cost as a disincentive to unwanted behavior as well as using a reward system both to bootstrap itself and to incentivize security. The advantages of Bitcoin's PoW system include that the group of block authors is truly open to anyone with computational resources, that the system converges on one ground-truth because there is a real cost in producing a competing chaintip, and that it is simple enough for its security model to be well understood.

PoS is more similar to the approaches that were pursued before the publication of Bitcoin. PoS is naturally divergent as there is no real cost in staking. The "Nothing at Stake problem" allows stakers to work on multiple chaintips and only publish the next block from the chain most favorable to them. There are different ways of approaching the vastly different security model of PoS.

"Casper summany: FIx stuff with Staking. FIx the problems in that with bonding and checkpoints. Fix problems with that with being fuzzily forgiving about slashing. Make it all 'rigorous' by doing real proofs of something somewhere" – Bram Cohen
Source: Bram Cohen describing ETH's PoS research

For example, ETH's effort to switch to PoS has been in research since at least 2015. The latest I've read, ETH's current PoS proposal piles multiple layers of complexity on top of the staking to achieve convergence. Stakers have to register as "Validators" of which there are a limited number, put up a sizeable collateral that can be slashed in retaliation for misbehavior, and additionally maintain frozen capital to stake in the first place. More mitigations are in place to punish validator malfunction and recover the system from such breakdowns.

Other approaches to and issues with PoS include:

  • Some systems introduce a central party that rubberstamps the latest block (e.g. Peercoin). A central coordinating party costs the system its censorship resistance.
  • It's difficult to fairly launch a PoS system since stakers have to hold funds in the system to author blocks. Many PoS systems get either started as airdrops, Initial Coin Offerings (ICOs), or a proof of burn auction.
  • Staking requires some representation of the private key to be online at all times, which may mean that it is easier to redirect some of the staking power (in early PoS systems it had to be the actual private key, so not only staking power but actual funds could get stolen). Not participating in staking means that your share in the monetary supply is being inflated away.
  • Some systems require coins to have a certain amount of confirmations before being allowed to be used for staking, so spending funds interrupts your staking revenue.
  • Some people expect that staking revenue will be taxed differently than mining revenue.
  • Some PoS systems can be gamed for profit by trying a vast number of block candidates to cause the staker to get blocks more often than their stake should qualify them for. Such an incentive may turn such PoS systems just into PoW schemes under the hood.
  • Some researchers argue that "by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value".

So, while the Ethereum Foundation keeps giving (and missing) new delivery dates for an incomplete research project, there seems to be less interest among Bitcoin contributors to discuss Rube Goldberg contraptions.

And then, beyond the general skepsis for PoS, it wouldn't be feasible to just switch to it:

"Even if there somehow was a workable solution that had desirable properties and security proofs, it would be working under a vastly different security model than PoW… and nobody can just decide to make such a change without enormous community consensus for such an invasive change." –Pieter Wuille

  • 4
    Thanks a lot for the great explanation! So, for what I can conclude from your post, PoS is interesting in theory, but very hard to implement into practice because of its divergent nature, which leads to the need of extra layers on the protocol, which also means more complex mechanism and therefore less secure/efficient? Commented Apr 20, 2020 at 8:08
  • 5
    @OscarSerna to reply to your second comment. Proof of stake doesn't solve high transaction costs; that is controlled by the transaction limit and desire of people to have their transactions finalised soon. To fix that you need to get logarithmic scaling with transactions. Ethereum's solution to that is sharding, which is a different beast than POS; but equally complex.
    – csiz
    Commented Apr 20, 2020 at 15:17
  • 2
    OscarSerna: The transaction cost is not closely related to the consensus mechanism as csiz explained.
    – Murch
    Commented Apr 20, 2020 at 22:45
  • 3
    The lightning network allows you to send payments to any other participant it can find a route to. It does work better for small payments, though. See for example bitcoin.stackexchange.com/q/43700/5406
    – Murch
    Commented Apr 21, 2020 at 14:12
  • 2
    @OscarSerna .. there's nothing that says you need to open the lightning network when you want to do the payment and close the lightning network once you've done the payment. You can open it as long as you like. You can spend bitcoins on the lightning network for as long as you haven't closed the network but those bitcoins cannot be spent on the main bitcoin blockchain. Once you close the network you can no longer spend those bitcoins on the lightning network but you can now spend it on the bitcoin blockchain. Think of it like a prepaid card for bitcoin
    – slebetman
    Commented Apr 21, 2020 at 20:02

I think there are at least four reasons:

  1. The miners are stakeholders in the bitcoin ecosystem. Mining solves a problem for them. Taking away PoW mining would make bitcoin no longer work for one of its most important group of stakeholders.

  2. Non-miners are in bitcoin because they like what bitcoin is. If they want some other consensus scheme, they know where to find it. There is certainly room in the market for at least one PoW chain and that's what bitcoin is.

  3. Major changes impose costs on every participant in the ecosystem. Every implementation has to implement the new rules. Everyone has to test that the new stuff doesn't break anything they're relying on.

  4. There isn't a consensus in the community that PoS can provide the same level of security as PoW at lower cost. That's the claim PoS advocates make, but it's far from an accepted truth.


I think there are some very convincing theoretical arguments to be made, but there is also just a very practical consideration:

Right now, a very large portion of BTC is being held in the cold wallets of popular exchange platforms. Hardcore bitcoiners will shake their heads and declare "Not your keys, not your coins!", but this apparently has not stopped traders and normal users alike from keeping their coins stored with a custodial third party. Looking at the 'bitcoin rich list', we can confirm the huge number of coins held by exchanges.

This fact would put exchange operators in an undue position of power over the network: by staking coins owned by their users, the exchange operators can obtain a large, centralized point of control over the network's consensus operations.

There are already risks present when allowing a third party custodian to manage your coins/private keys, but switching to a POS system adds an entirely new and very serious type of risk! This is a very serious risk because it is existential in nature: if an exchange operator were to abuse their control of this huge number of coins somehow (by staking maliciously in some way or another), it would affect every user of the system, not just the users of that exchange.

This problem is only amplified by the fact that you have to not only trust the exchange operators to not act maliciously, you also have to trust them to secure their system against theft and intrusion. It is bad enough when hackers steal funds, giving hackers the ability to attack the network consensus as well is, in my opinion, an untenable addition of risk.

In case you aren't convinced: This risk is not theoretical, an attack like this recently happened on an altcoin network (Steem, mid-late Feb 2020). It appears that exchanges colluded to stake the coins they held custody of, in an effort to disrupt network consensus. A quick websearch brings this article about it up.

  • 6
    I do not think that the Steem scenario is very realistic for BTC; it started with a single exchange being dominant, and the Steem story highlights that this would ultimately kill the entire ecosystem of the coin in question. BTC had a similar problem in the past, where a majority of miners would in located in China; after some discussion, the Chinese miners agrees to stay well below 50% because they knew that BTC could break down anytime if they continued to grow, losing more than they could gain from growing.
    – toolforger
    Commented Apr 20, 2020 at 3:21
  • 1
    This is a really interesting theory. I also think that toolforger is right about ecosystem regulating itself. Some good game theory applied here. Thanks for enriching the thread. Commented Apr 20, 2020 at 8:16
  • @toolforger right, it is a different situation, but I think this is still a foundational problem that is slightly different than miner centralization: With PoW, every effort is made to ensure the protocol does not favour or promote miner centralization. With PoS, centralization of coins seems unavoidable (exchanges hold a huge portion, and the fact that 'the rich get richer' under PoS only exacerbates this). Additionally, a hacker that steals coins could attack and incur almost no cost (other than lost value of the stolen coins), the same cannot happen in PoW.
    – chytrik
    Commented Apr 20, 2020 at 21:48
  • I am not so sure about that "the rich get richer" aspect of PoS. If it's proportional to the amount held, the minting reward will be distributed accordint to the current money distribution and relative wealth remains unchanged. This changes if you have to allocate your money for PoS - the poor won't be able to allocate anything, and the rich will want to keep their money in cold wallets; I don't know how this plays out in practice.
    – toolforger
    Commented Apr 21, 2020 at 6:24

Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition. Most people that don't like PoS are thinking in "vanilla" or "chain based" PoS protocols which are certainly more insecure than PoW.

Ethereum 2.0 is using Casper currently in the Beacon Chain, and other coins are also using BFT PoS protocols. I will try to resume BFT PoS in a few lines:

  • Each block must be signed by 2/3 of validators based on staking power. That provides absolute finality in just one block.
  • There is a penalty system that punish evil behavior or validator inactivity which makes it MUCH MORE secure than PoW. If you sign 2 blocks with the same height, that's evil behavior and your staking deposit is burned automatically. If 1/3 of validators are inactive and the network halts, the penalty system start to burn slowly the deposits until the network can restart.
  • Even if you have 99,9% of staking power you can't censor transactions for free because as far there is a single honest validator in the network he will include the transaction you want to censor in his block. If the attacker doesn't want to sign the block of the honest validator, his staking deposit receives a small percent of penalty, but a small percent of millions of dollars is too much money. The honest validator receives also a penalty, but his deposit is small so it's not a problem.
  • If somehow the attacker has ALL staking power and start to censor for free and don't allow other validators register their staking deposits to create blocks, the community as a whole would agree to burn all staking deposits and restart the network, which makes every coin holder much richer than before.


  • 2
    re: "Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition." - that is a bold claim, for example see this review of the CBC Casper protocols: medium.com/@muneeb/peer-review-cbc-casper-30840a98c89a. Quote from their conclusion: "Importantly, it remains unclear if the definition of the Casper protocol family provides any meaningful safety guarantees for blockchains, or if this approach is applicable to scaling blockchains at all."
    – chytrik
    Commented May 13, 2021 at 19:31
  • Casper is a mix of of 2 protocols: a BFT PoS protocol (Casper FFG) and a "chain based" PoS protocol (Casper CBC). It looks this paper ignores completely Casper FFG, which is the most important part of the protocol as it provides absolute finality. The protocol could be even simpler: a classic BFT consensus (2/3 of validators must sign each block), with the typical penalty system for inactivity (light penalty) or evil behaviour like double-signing blocks with the same height (burn the deposit of the attacker). If the network gets halted due to many nodes being unavailable the network can ...
    – Tux
    Commented May 13, 2021 at 20:11
  • ... automatically revert to PoW consensus after a timeout. This is very simple and could be implemented in Bitcoin without any risk. There are variations about this concept like using commitees of validators, but the simplest version could work very well with Bitcoin.
    – Tux
    Commented May 13, 2021 at 20:12
  • Note also that Bitcoin has 10 minutes blocks, so the bandwidth overhead of using so many signatures per block is not important. Using a protocol like this we could have 1 minute blocks, and absolute finality in 1 block. It's too good to be ignored, I hope Bitcoin developers finally implement it.
    – Tux
    Commented May 13, 2021 at 20:19
  • 2
    re: ”...if the network gets halted due to too many nodes being unavailable the network can automatically revert to proof of work” - it is perhaps quite telling that PoW is the proposed solution to the shortcomings of PoS.
    – chytrik
    Commented May 13, 2021 at 20:30

In addition to other answers, Bitcoin investors would also like to have a very conservative approach to updating bitcoin. Messing with the core idea will increase the perceived risk for something wanting to be a store of value.


Proof of stake just doesn't work the same as mining from an economic incentive standpoint.

Miners make real-world investments, in advance, in equipment that becomes less valuable as difficulty increases.

Miners have no guarantee that their investment will pay off, they merely have a probability of finding a good proof of work.

Staking chains are vulnerable to new attacks, like "long range" attacks, "fake stake" attacks, etc. Staking is just as easy to pool and manipulate as mining.

Proof of stake systems have some good solutions, but they aren't all solved. Until they are solved, Bitcoin definitely won't transition.

A more realistic transition would be to a proof-of-burn, where a p2sh burn is locked to a height, and gets you a decaying probability of being able to mine some future block.

Not the answer you're looking for? Browse other questions tagged or ask your own question.