Bitcoin Unlimited President Andrew Clifford joined Danielle Marie of EvolveH3r for a webinar on proof-of-work, where it came from, and what Nexa has done to advance it. After Danielle’s introduction to the fundamentals of blockchain, layer one, UTXOs, decentralization and the blockchain trilemma, Andrew took those concepts and applied them to a functioning cryptocurrency, from the origins of proof-of-work in the early 1990s as an anti-spam mechanism to its role in Bitcoin mining and security, and on to NexaPoW and what users need to know about mining Nexa after its next algorithm upgrade. The full recording is below, and his presentation is recapped in text underneath it.
Early Research by Dwork, Naor and Back
Most people assume proof-of-work was invented by Satoshi Nakamoto, but it wasn’t. This concept has roots going back into the early 1990s, more than a decade before Bitcoin.
In 1992, Cynthia Dwork and Moni Naor published a paper proposing what they called computational pricing functions. The problem they were trying to solve was email spam. At the time email usage was minimal. It was relatively new, but researchers were already worrying about what would happen when sending millions of emails became cheap and easy. The public were already annoyed by junk mail in the letterbox increasing each year. It seemed that digital emails spammed constantly to thousands of people would ruin this new technology. Similarly the internet was also new to the public. The World Wide Web was just a year old. Couldn’t websites and digital services be hit with thousands of information requests? Denial of service was a real risk.
Their insight was elegant. Consider that when accessing a network service, the requester has to first perform a small amount of computation. Nothing too expensive for a legitimate single user, but very costly if anyone wanted many connections. Similarly cheap to send a single email, but expensive to send a million. A spammer would have to pay with CPU usage rather than money, and CPU cycles can’t be faked.
This was a genuinely new concept. They proposed a form of computational effort as a defense against abuse. Their key insight is that computation takes time and resources and that can be used to impose a cost on attackers without requiring a trusted central authority to determine who is legitimate.
Then in 1997 a British cryptographer named Adam Back took this idea further with Hashcash. Back’s idea was to use cryptographic hash functions as the basis of computing work. A hash is a digital fingerprint of usually a much larger chunk of data. For example a million byte document can be reduced to a 20 byte hash, and this is a one-way process. The document can’t be recovered from the hash. Also, by using a hashing formula with the avalanche effect, a single letter change in the document will result in a completely different hash result. This means the document or any data could be hashed many times provided there is a small irrelevant change called a nonce. The resulting hash can be checked against a target.
In Hashcash, to send an email the sending system has to find a hash value below a certain threshold, which is a computationally expensive task to perform but trivially cheap for the recipient to verify. We can describe it like the invention of a single digital postage stamp, so it costs something to create, proving that effort has been expended.
Importantly, Hashcash was not a transferable digital coin. It was a one-time token that proved work had been done. The stamp gets used and discarded, so that distinction matters a lot when we get to Bitcoin, because Satoshi’s breakthrough was in making the proof-of-work the foundation of a consensus mechanism for a transferable, capped digital currency.
For what it’s worth, Hashcash caught enough attention that Microsoft launched a project called Penny Black in 1999. It was an email postage system based on similar ideas, requiring a centralized ticket service, and it was never released publicly, but these ideas were circulating in the research community. What was missing was the full architecture that Satoshi would later provide. Treating a hash like a number gives fine grain control on the difficulty of the computing work required, making it the best form of proof-of-work for future systems like blockchains.
Proofs-of-Work by Jakobsson and Juels, 1999
The term proof-of-work was itself formally coined by Markus Jakobsson and Ari Juels in the 1999 paper, and what they did was take the work described by the others just mentioned and give a rigorous formal structure.
They made an important distinction. In most cryptographic systems a prover demonstrates knowledge of a secret, such as a password or a private key. The verifier checks whether the prover knows the secret without revealing it. Jakobsson and Juels proposed a different model where the prover doesn’t demonstrate knowledge of the secret, they demonstrate they performed a computation that did specific work. The verifier doesn’t check whether the person knows something, they check whether they did something.
This is a simple and profound shift. Knowledge can potentially be stolen, shared or guessed. Computation, in contrast, has to actually happen with real time and real resources. No one can fake a new calculation without actually doing it first, because the nonce changes all the time, every hash calculation is different.
The two-party model they described, a prover and a verifier, is the basic architecture that underlies every proof-of-work system seen today, including Bitcoin and Nexa. When a miner submits a block they’re playing the role of the prover. Every full node on the network plays the role of the verifier, independently checking that work was done correctly without trusting the miner.
The Requirements for Proof-of-Work for a Blockchain
Advancing from Hashcash to blockchain consensus is a complex task. There are a number of important elements that proof-of-work needs to have for it to work within a decentralized blockchain.
The first requirement is that as global computation grows there must always be more work to do. Bitcoin’s difficulty adjustment handles this. As more miners join and the network’s total hash rate increases, the target difficulty increases too, so that blocks are still produced approximately every 10 minutes. If the difficulty didn’t adjust upward, more miners would just mean faster blocks, which would break the security model.
Secondly, the difficulty of the work must be able to vary up and down dynamically. Difficulty can’t only ratchet upward. Sometimes miners leave the network, reducing the hash rate. Difficulty must come down so that blocks continue to be produced averaging the required time interval. This flexibility is essential for a viable network.
Third, miners must compete, not cooperate. This is the opposite of how most scientific distributed computing works. In something like Folding@home, where volunteers donate CPU time to fold proteins, all the computers work together on the same problem. In proof-of-work mining every miner is racing against every other miner, doing different hashing computations. Cooperation would allow collusion, however it is competition that makes the system trustless. Even miners submitting shares to the same pool will compete between each other.
Fourth, there must be an asymmetry between proving and verifying. The miner must expend significant resources finding a hash within target. The node verifying that hash must be able to do so almost instantly. If verification were as hard as mining, the whole network would grind to a halt.
Fifth, miners cannot pre-compute and store solutions. Each proof-of-work challenge is tied to the current block, which has the previous block hash, the timestamp and transaction data. That makes the problem unique every time, so it is not possible to build a library of pre-calculated answers.
And sixth, more hardware should proportionally mean more output. This is what makes proof-of-work fair in the game theoretic sense. A miner’s share of block reward should be proportional to its share of the total hash rate averaged over time, so there should be no shortcut.
Satoshi Nakamoto was the first to achieve all six of these elements simultaneously in Bitcoin. Each one of them had been identified in prior work, but nobody had managed to assemble them into a coherent working system before 2008.
The Key Benefit of Proof-of-Work Over Proof-of-Stake Is Fair Distribution
Why use proof-of-work at all when proof-of-stake exists? Proof-of-stake is far more energy efficient, the argument goes, and major networks have moved to proof-of-stake, such as Ethereum in 2022.
The most important answer is one that’s easy to overlook. Proof-of-work drives fairer distribution, which proof-of-stake fundamentally cannot. When Nexa launched there was no pre-mine or allocation or venture capital funds or founding team carve out. Every single unit of Nexa in circulation today was earned by someone doing computational work on the network, right from the genesis block.
This is what a fair launch means in practice. Bitcoin has the same property. Satoshi famously mined the early blocks alongside anyone else who wanted to run the software. The supply entered circulation through public participation, not through any boardroom or backroom decisions.
Proof-of-stake can’t deliver this by definition. In a proof-of-stake system users earn rewards in proportion to how much of the currency they already hold that they’re staking. This means that founders, investors and early insiders holding coins at launch earn the most from the system, starting at day one. Proof-of-stake can be designed fairly, but it cannot make an initial distribution fair through the protocol mechanisms alone.
Proof-of-stake is best adopted after most of the supply has already been distributed through mining, when the allocation questions are less acute. And the future of Nexa, maybe in 10, 20, 25 years time, it may well be a proof-of-stake system as well, or a hybrid system, so that isn’t ruled out.
The Fixed Supply and Emission Curve
Like Bitcoin, Nexa has a fixed total supply. There will never be more than the predetermined 21 trillion NEXA coins. Like Bitcoin they enter circulation through the block rewards, and after every four years the block reward halves. The rate at which new coins enter circulation slows by half, and then repeatedly afterwards the total supply approaches its cap but never exceeds it.
This creates what can be called a deflationary arc. It’s not in the sense that the currency deflates in purchasing power necessarily, but in the sense that the issuance rate is mathematically guaranteed to decrease. And critically, no central authority manages this. No committee decides whether to print more or less. The schedule is encoded in the protocol and changing it would require consensus across the entire network.
What Halvings Mean for Incentives
Halvings are not just a supply mechanic, they restructure the incentive landscape of the network over time, and the understanding of this is important to those who are thinking about mining.
The killer application for cryptocurrency is money, and successful money requires natural scarcity. Gold is valuable in part because there isn’t very much of it and finding more requires real work. Bitcoin and Nexa reproduce this property in a digital setting, and halvings are the mechanism through which that scarcity increases over time as the protocol matures.
Early holders, whether they’re miners, early buyers or node operators, participate during the period of highest issuance. There are more tokens available but the network is less proven. Over time the supply tightens. If adoption grows, each token represents a larger share of a more established network. That’s the trade-off that halvings encode.
For miners specifically, the early phase of the network is also most profitable in terms of block rewards. They’ve been compensated well for providing security during the period when the network needs it most, when it’s young and still establishing its hash rate and attack resistance. Over time, as block rewards decline, the network must sustain miners through transaction fees. This is a deliberate transition, designed into the economics from the start of the launch of the network.
Energy Consumption
Any talk about proof-of-work must consider the issue of its energy consumption, and it’s the most common criticism about this consensus model for blockchain security.
Bitcoin security relies on real world energy expenditure, and obviously Nexa does as well. Every terahash per second on these networks represents actual electricity being consumed by actual hardware. That’s precisely what makes attacking these networks more costly. For an attacker to rewrite Bitcoin’s transaction history they would need to redo more work than the whole network has done, out-competing the rest of the world’s miners, sustained over a long period, and that takes a huge amount of energy.
Arguably this energy expended is wasteful. Burning electricity to run computations that produce nothing except a number below a target is pure waste. However it is the cost of decentralized monetary security, which the energy expenditure is driving. Digital gold needs attack resistance and that’s worth paying for. Also, the mainstream banking system consumes enormous amounts of energy as well, by running data centers, branches, ATM networks, card processing and infrastructure, and tens of thousands of employees driving to and from work. It’s all more spread out and less visible.
Around 2013-14, as Bitcoin’s energy footprint became more apparent, blockchain engineers began exploring an alternative. What if the proof-of-work computation could itself be useful for solving scientific problems? Could it be put to use on protein folding, or searching for prime numbers, or drive distributed simulations? If that work is being done elsewhere anyway, why not make the proof-of-work on crypto do something more productive at the same time?
The Problem With Useful Proofs-of-Work
It turns out to be much harder than it looks, and all the direct attempts only had partial success, because the central problem is that the blockchain requires very specific properties in this proof-of-work computation. The proof-of-work needs to be unpredictable, random and memoryless, which means that every calculation is independent. If someone does 10,000 failed attempts to get a hash below target, there is no advantage on the ten thousand and first attempt. This is what makes mining fair, the chance of finding the next block is proportional to the current effort and not the accumulated effort beforehand.
Most generally useful computations don’t have that structure. Protein folding, for example, has structure where some search paths are more promising than others and prior computation informs future computation. That structure is what makes the computation useful scientifically, but it would undermine the security of any blockchain trying to use it for consensus. The more structured and useful the computation is, the harder it is to preserve the randomness and uniformity of that consensus mechanism. The two goals pull in opposite directions. Projects that tried to bridge them ended up with compromises that satisfied neither side fully.
Nexa’s Approach
Nexa has taken a different approach to solving the problem, and it’s a genuinely elegant insight made by Andrew Stone, the lead developer at Nexa. Rather than trying to make the proof-of-work computation itself directly useful, NexaPoW version 2 makes the hardware useful for other participants in the ecosystem. This is an indirect useful proof-of-work and it sidesteps the fundamental problems with directly using proof-of-work for another purpose.
The NexaPoW algorithm requires that miners perform Schnorr signature verifications as part of the computation. Importantly, Schnorr signature verification is one of the major computational overheads in the mining and then the running of full blockchain nodes for all users, including the non-miners. Every transaction on the network requires signature verification to validate what was sent to it, so the full nodes do this constantly.
The insight is that FPGA hardware capable of performing Schnorr signature verification efficiently for mining purposes can also be reused by non-miners to accelerate their node operations. The mining ecosystem as it develops produces hardware that has genuine utility to the broader network, not just for the miners themselves, and non-miners will eventually be able to purchase or reuse FPGA hardware that was developed primarily for mining and use it to run faster and cheaper nodes.
This is a novel solution to the useful proof-of-work problem. Instead of making the computation useful, make the hardware outside of mining useful. The computation can retain the random memoryless properties it needs for consensus while the physical hardware investment produces wider value for the whole ecosystem.
The Trilemma
There is the known challenge in blockchain technology, the trilemma, because it requires achieving three opposing objectives. It’s very difficult to simultaneously optimize a blockchain for security, scalability and decentralization. Usually maximizing two of these means making sacrifices on the third.
Bitcoin’s design prioritizes security and decentralization. Running a Bitcoin node is something ordinary people can do, and attacking the Bitcoin network is extremely expensive. The trade-off is scalability, deliberately leaving Bitcoin’s on-chain layer one throughput very limited, about seven transactions a second. The scaling solution Bitcoin has pursued is layer two, the Lightning Network and the side chains. They move transactions off the main chain. This is a reasonable engineering choice but it has a serious drawback, the transaction fees that should flow to miners and replace the decreasing block rewards are diverted to non-mining owners of the secondary layers. This weakens the long-term incentive for miners on the base chain.
Nexa utilizes different protocol level choices. The goal is to pursue all three of the trilemma properties simultaneously. Here the indirect useful proof-of-work actually supports this, because miners develop and deploy the FPGA hardware capable of efficient signature verification, and that hardware can be redeployed by non-mining ordinary user and business nodes. It makes nodes cheaper and faster to run even at high volumes, so this directly supports decentralization. And because the base layer is designed for high throughput and low fees rather than constrained throughput, scalability is a property of layer one itself rather than something bolted on via secondary infrastructure. Whether this fully resolves the trilemma is a fair question, but the key point is that Nexa’s design elements are carefully considered for the long term.
Self-Funding and Transaction Fees
A truly decentralized blockchain system must be self-funding through new coins or user fees. Bitcoin’s fees are variable and become quite high during periods of network congestion, and some people have paid 50 or 100 dollars for transactions when the network’s busy, and at other times five, ten, twenty cents. They’re very variable and this is a deliberate design choice. Satoshi envisaged that as the block rewards decline the high fees would sustain the mining incentive, but he was the one who put in the temporary one megabyte limit which has constrained the capacity, and that has remained in place still today, and therefore what he actually wrote in the paper, it’s not possible to achieve.
Nexa’s design intent is that the base layer itself should be capable of handling high volumes of transactions cheaply. Very low fees and high throughput are layer one properties, not things users access by using secondary infrastructure. The goal is that someone making a small payment, like buying a coffee or sending money to a friend, can do so directly on chain, quickly and cheaply, without needing to understand or interact with any additional layers or secondary apps.
This is a different philosophical position about what a blockchain should be. Bitcoin’s often described as a settlement layer, but many consider it a foundation for high volume transactions and base for secondary layers. But where is the funding for the Bitcoin security going to come from as the block reward keeps declining? However, Nexa is designed to be useful for everyday transactions directly, and as volumes eventually may climb, then there’ll be more fees for the miners to replace the falling block rewards. That’s the long-term plan.
What’s Required to Run a Nexa Full Node
What does it actually mean to run a full node? A node is software that is downloaded from nexa.org and it maintains a full copy of the blockchain and independently validates every transaction in every block against the protocol’s consensus rules. It doesn’t trust anyone else’s copy of the blockchain state, it makes its own conclusion directly from the raw data.
This independence is the core of what decentralization means in practice. If a user trusts someone else’s full node they’re not really participating properly in the decentralized system, they’re trusting a third party. And this is extremely important for a private currency, that the full node networks are as large and broad and as global as possible so that they can’t be co-opted by any third parties.
Running a node means that the software does a full check for itself, and the node won’t accept invalid transactions or a fork that doesn’t follow the rules. And the more nodes there are enforcing the rules independently, the harder it is for anyone to change those rules without broad consensus. And again, that’s what’s happened with Bitcoin, it’s very hard now to change any of the rules, the protocol consensus, even if it’s for the benefit of the network.
The hardware bar is actually quite low. One of Nexa’s deliberate design goals is to keep node operation accessible. Running the node does not require enterprise hardware or specialized equipment. A mid-range Intel N305 mini PC will do it, but even just any old PC is sufficient for a stable, long uptime node operation. A capable laptop with adequate storage can also serve as a node, although desktops and these units are preferable for the consistent uptime that makes a node genuinely useful to the network. The longer the node is on the network the more peers it attracts, effectively the more value it is towards the network the more uptime it has. Some people will bring up their node just to make a payment and then turn it off again, and bring it up to make another payment two days later. That is not helping the full node network.
The main reason that matters is to prevent centralization. If running a full node requires expensive hardware or significant technical expertise, nodes will increasingly be run by corporations or well-resourced institutions rather than individuals, and as that happens the set of users and groups validating the rules of the network will actually shrink in number and the decentralization argument weakens. Nexa’s design philosophy is that low node requirements are not just for convenience, they’re a requirement to preserve decentralization.
Hardware Considerations
Mining and node operation are entirely different problems from a hardware perspective, and it’s important to think of them as separate activities.
Running a node is primarily about storage, memory and uptime. The user needs enough disk space to store the full blockchain, enough RAM to keep the software running, and a stable internet connection with reasonably good bandwidth. CPU performance is a secondary consideration, and non-mining nodes are not racing against anyone, they’re simply validating and propagating data. Any reasonably modern consumer machine handles this comfortably, including the latest Raspberry Pi 5, which you can get a case for separately, and the advantage of this one is the PCIe socket.
When people are mining it also requires a full node, or a full node interface to the outside world. But mining is more about raw computational power, maximizing the number of hash computations performed per second for the proof-of-work consensus. It demands additional specialized hardware, typically multi-core CPUs or GPUs or FPGAs or ASICs. The operational model is also different, because mining is a business with costs, revenues and margins. Node operation is infrastructure and part of the overhead of being an independent user or an ecosystem service provider. These activities involve different equipment, different budgets and different operational mindsets.
NexaPoW Version 2
During the second half of this year NexaPoW version 2 will be released, and it’s significant for anyone thinking about mining Nexa, and it’s worth understanding what it means.
Version 2 of NexaPoW will introduce a cellular automaton as part of the mining algorithm, and the key property of a cellular automaton in this context is that it can change configuration too frequently and too unpredictably for any dedicated ASIC hardware to be profitably designed and manufactured for it. ASIC development takes time and the NexaPoW configuration would change before an ASIC can be deployed, and as we have seen, once ASICs become available they tend to seriously centralize the mining. Our goal with Nexa now is to have the mining limited at FPGA, which still allows a huge competitive mining landscape.
What this means practically is that through the later part of 2026, and until the FPGAs become more common, ordinary hardware can compete, like the situation we had in late 2022. Users don’t need to have bought industrial mining equipment years ago, they can just use multi-core CPUs or GPUs, whatever they’ve got available, until the FPGAs take the majority of the mining. So there’s a window of accessibility before the FPGA mining fully develops, that the CPU and GPU window will be open for a little while. This intent is to try and bootstrap engagement from the mining community once more.
The Economics of Participation
For a miner it’s important to consider the economics of participation in the network. Hardware is only one cost. The ongoing operational cost that determines whether mining is profitable is electricity. The economics of mining are fundamentally a balance between the cost of electricity and the amount of block rewards received at the current market price.
This calculation varies enormously by location. Someone with access to cheap renewable energy, such as hydroelectric, excess natural gas production or solar panels in a sunny location, will operate in a completely different economic environment to someone paying retail electricity rates in a high-cost market. Before investing in mining hardware it’s advisable to model electricity costs honestly, looking at the local rate per kilowatt hour, estimate the computer hardware’s power requirements and calculate a break even Nexa price. And don’t assume the price will move in the current trend, as that becomes a speculative factor.
For node operators the key operational variables are bandwidth and uptime. A node that is frequently offline or has limited bandwidth contributes little to the network. Nodes earn their value through consistent availability, and the more reliably a node is online the more useful it is to the network as a whole. Node operation doesn’t require expensive hardware, but it does require attention to uptime.
The real message is that participation has costs and it’s best to model them before committing as to what you do, and separate out the potential upside of holding Nexa tokens with the economics of actively mining.
How Earning Nexa Works
Miners earn Nexa in two ways. The first is the block rewards, the newly issued tokens that are created with each block, awarded to the miner who found the block hash that met target. This is the primary revenue stream in the early life of the network when issuance is high.
And the second is transaction fees, amounts that are paid by users whose transactions are included in the block, and every transaction on the network carries a fee and the miner will receive that.
In the early phases of a proof-of-work network with a Bitcoin issuance model, the block rewards dominate the revenue picture and the transaction fees are relatively small, and over time, as the halving schedule progressively reduces block rewards, the transaction fees become proportionately more important. This is the intended economic transition, going from a reward system subsidized by new issuance to one sustained by genuine demand from users for block space.
UTXOs
When a miner earns a block reward it doesn’t arrive as a number just added to the balance, it arrives as an unspent transaction output, a specific discrete output locked to the miner’s address. In a wallet this aggregates into a displayed balance, but on chain it’s a specific identified coin.
This matters for a few reasons. Each UTXO is independently spendable and independently lockable. When a user sees a wallet balance of say a million NEXA, that might be a single large UTXO from a block reward with fees, or more likely hundreds of smaller UTXOs from mining pool payouts accumulated over time. The distinction matters when you spend, because spending requires selecting which UTXOs to use. Wallets automatically do that, but it’s controllable for privacy and accounting reasons.
Non-mining full node operators receive no direct protocol payment. Running a node is not compensated by block rewards. The contribution is to the network health, maintaining a decentralized network. The more numerous the full node users, the more value the network has to the long-term holders. In the case of Nexa, like Bitcoin, a more decentralized network is a more credible one.
So there is no direct compensation at the protocol level. If someone’s considering participation and they actually want revenue, then mining is the formal way to proceed.
Infrastructure Participation Versus Speculation
Finally, it’s worth dealing with this distinction. Speculation means acquiring a crypto, or in this case Nexa, in the expectation that the market price will rise. People are making a bet on the price appreciation and their return is based on what someone else is willing to pay at a future date.
But infrastructure participation means running a full node, and it could be mining or non-mining. Miners contribute real computational work to the network and earn tokens, and their rewards come from the protocol. And non-miners strengthen the network and that indirectly benefits holders and ecosystem businesses and users, because they have a more robust network where funds are trusted. So running a non-mining node and holding is basically a speculative activity, but there’s reasons for that speculation, there’s logic to it.
These two activities are not in conflict and some participants do both, but they carry quite different risk profiles and require different commitments. Speculation requires capital, tolerance for volatility. Infrastructure participation requires capital and hardware and electricity and an operational commitment for uptime maintenance, and requires some technical knowledge. The return profile is different as well, because an infrastructure participant earns coins continuously as long as they operate, independent of the market price on a given day. They’re exposed to the price when they eventually convert, but the earning itself is consensus driven, not speculative.
Finally, most importantly, proof-of-work networks only function because enough people choose to do the hard work of providing the infrastructure. The security of the network, its resistance to attack, its decentralization and its censorship resistance are always dependent upon the distributed and committed set of participants doing real computational work. And NexaPoW version 2 is deliberately designed to keep that work accessible long term.