1. Introduction

Bitcoin is a digital currency launched in by an anonymous inventor or group of inventors under the alias of Satoshi Nakamoto (Nakamoto, ). It is the largest cryptocurrency in market capitalization with over billion dollars (Chan et al., ; Grobys and Sapkota, ; conwaytransport.com.au, ). As a decentralized currency, Bitcoin differs from government regulated fiat currencies in that there exists no central authority within the network to verify transactions and prevent frauds and attacks (Sin and Wang, ). Instead, Bitcoin relies on a highly replicated public ledger, secured by means of a hash chain and validated through community consensus (Akcora et al., ). All users can announce a new transaction but such a transaction will be considered valid and included in the ledger only once it is verified by a majority of the network nodes. Transactions are written into blocks that are interlocked into a chain by hashes. Hashing is a one-way function that maps an input of arbitrary length into a string of a fixed number of digits. The hash function must guarantee that the output string is (quasi-)uniquely related to the given input (deterministic) and that small changes in the input should cause arbitrarily large changes in the output so that reconstructing the input based on the output is infeasible. In the case of Bitcoin, the transactions in the new proposed block and the header of the most recent block is inputted into the SHA hash algorithm, making therefore a chain with unique direction. Such a chain is at the heart of the Bitcoin security because it makes it difficult to alter the content of a block once subsequent blocks are added to the chain. In Bitcoin, this cryptographic sealing process through a hash chain is intentionally designed to be computationally intensive by accepting hashes only if the randomly generated hash number is smaller than a given target. Therefore the community performs a large number of hashing by modifying a random component of the block content until, by chance, someone finds a valid hash that is smaller than the threshold. This is called proof of work (PoW) and serves the purpose to determine majority consensus. Indeed, in an anonymous distributed system, participants can arbitrarily generate new identities so consensus cannot be accounted in terms of individuals. Rather, it must be accounted in terms of some participation cost demonstrating the commitment of computational power. In the words of Satoshi Nakamoto, one CPU one vote (Nakamoto, ). Bitcoin mining hardware has moved from CPU first to GPU (McNally et al., ) and later FPGA and ASIC but the principle behind the proof of work remains the same.

The network incentivizes users to participate in the block validation process by assigning newly mined Bitcoins to the first user who randomly finds a hash with a value smaller than the threshold. Presently, after the latest Bitcoin halving, this remuneration is Bitcoins or around USD 60, at the current exchange rate (see Table 1). For this reason, the hashing process is called mining and miners often join to form large mining pools to have a more stable source of income (Gervais et al., ).

Table 1. Bitcoin reward per block mined.

Sometimes forks occur in the blockchain when two blocks containing different transactions are attached to the same block. Eventually other blocks are mined and attached to them, forming two branching chains after the fork. In this case, the longer chain, the one with more cumulative proof of work or hash computations, would be considered as the main chain upon which future blocks are built on. Normally a block is considered finally valid after six blocks are attached to its chain, which takes 1 h.

The Bitcoin proof of work is very costly economically (Thum, ) and environmentally (Stoll et al., ). Technological improvements over the years have made hashing a very efficient operation, consuming at little as joules per billion hashes (with specifically-designed Application-Specific Integrated Circuit, ASIC, machines. See Table 2). This has reduced energy cost per hash by about thirty thousand times during the last 10 years. However, the miners in the Bitcoin network are presently (May ) computing nearly 10²⁵ hashes per day, up over 10 orders of magnitude from the levels. We estimate in this paper that this hashing activity currently corresponds to an energy cost of around 1 million USD per day and around a billion USD over the past year. In turn, this corresponds a per transaction costs as high as 13 USD in January This cost is not borne by either the sender nor the receiver in a transaction but rather by the miners. While a billion a year burned in hashing is definitely a large amount of money that could be seen as a waste of resources, the Bitcoin proof of work is a necessary process for such an anonymous permission-less network to function. It is indeed required to validate transactions and obtain community consensus to secure the system from attacks.

Table 2. Mining hardware with optimal energy efficiency and their dates of release.

One question arises: is this cost fair or could it be lowered? In Aste () made the argument that, at equilibrium, the cost of Bitcoin proof of work should be such to make a double spending attack too expensive to be profitably carried out. From this principle, it is relatively straightforward to estimate the fair cost of the proof of work under an ideal equilibrium assumption. Let us consider an attacker that owns some amount of Bitcoin and wants to artificially multiply it by spending the same Bitcoin with several different users. This is known as a double spend attack. The attacker will try to double spend the largest amount of Bitcoin possible, but this is limited to the amount normally exchanged within a block (which, we estimate in this paper, is currently around &#x;10 million). Indeed, a transaction involving a substantially larger sum than the usual will capture unwanted attention from the network. Of course, the duplication can be repeated several times both in parallel or serially but, as we shall see shortly, this does not affect the outcomes of the present argument. To be successful the attacker must make sure that both the duplicated transactions are validated and this requires the generation of a fork with two blocks containing the double spent transaction attached to the previous block. If the attacker has sufficient computing power, she can generate two valid hashes to seal the two blocks giving the false impression that both transactions have been verified and validated. However, for a final settlement of the transaction, it is presently considered that one should wait six new blocks to be attached to the chain to make the transaction statistically unlikely to be reverted. The attacker should therefore use her computing power to generate six valid hashes before the double spent transaction might be considered settled. Note that only one of the two forks (the shortest) must be artificially validated by the attacker since the other will be considered valid by the system and can be let to propagate by the other miners. Of course, it is quite unrealistic to assume that nobody notices the propagating fork for such a long time, but let&#x;s keep this as a working hypothesis. The artificial propagation of the fork has a cost that is the cost of the proof of work per block times six. The attacker will make profits if this cost is inferior to the gain made from duplicated spending. In the previous unpublished note by Aste () the following formula is reported:

We can re-write this formula to formally express the cost of proof of work per day, C_t, as

where:

p is the duplicated proportion of block transaction volume;

V_t is the average transaction volume on day t;

N is the number of blocks required for settlement.

In Equation (2) N is roughly equal to 6 and the current average volume of transaction is about V_t  1 billion USD a day but it was only a few thousands dollars a day in The value of p must be considerably smaller than one because an attacker will be spotted immediately by the community if she tries to fork with a large double-spent value with operations that involve a significant portion of the entire network activity. We must note that this formula is an upper bound for the cost of the proof of work. It greatly underestimates the costs of an attack and largely overestimates the attacker&#x;s gains. It indeed considers a system that has no other protections or security system than the proof of work. Further, it does not consider that after a successful attack, the Bitcoin value is likely to plunge making it therefore unlikely for the attacker to spend her gain at current market value. Finally, we should take into account that the attacker must have control over more than 50% of the hashing power. This requires either huge investments in mining equipment (not taken into account in the formula) or other methods to control the mining farms, such as through a cyber or a conventional physical attack, which will also cost considerable amount of money. Therefore, we expect the parameter p to be of the order of 1% or less.

Independently on the estimate of a realistic value for the parameter p, the principle that the cost of the proof of work must be a sizable fraction of the value transferred by the network to avoid double spending attacks should rest valid (Aste, ; Aste et al., ). Specifically, according to this principle, we expect that, for a given system, the ratio between the cost of the proof of work and the value transferred by the network should oscillate around some constant value which reflects the fair balance between the possible gains in an attack and the cost to perform it. In this paper, we test if this is indeed the case for the Bitcoin proof of work. For this purpose we are looking across the entire period of existence of Bitcoin, estimating the mining costs and comparing them with the value transferred through the network. This is an amazing period during which the value transferred through the Bitcoin network has increased several million times and the hashing activity has increased by 10 orders of magnitude. Let us note that ten orders of magnitude is an immense change. To put it into perspective this is the ratio between the diameter of the sun and the diameter of a one-cent coin. These are formidable changes to a scale never observed in financial systems or in human activity in general. We show in this paper that, despite these underlying formidable changes in the Bitcoin mining and trading activities, the ratio between the estimated mining cost and the transaction volume rests oscillating within a relatively narrow band supporting therefore the argument about the fair cost of the proof of work by Aste ().

2. Methodology

Estimation of the Lower Bound for the Cost of Bitcoin Mining

The cost of Bitcoin mining is composed of three key elements:

1. The energy cost of mining

2. The overheads for the maintenance of the mining farm, such as infrastructure costs and cooling facilities

3. The cost of purchasing and renewing the mining hardware

For the purpose of this study, we focus only on the first element, the energy cost of running the Bitcoin mining hardware which is likely to be the key driver and is the only cost that can be estimated with some precision. The maintenance costs for running a Bitcoin mining farm varies widely depending on the location, design and scale of the facility and since such information are usually not disclosed to the public, it is infeasible to estimate it accurately. The sales price of mining hardware is publicly available but incorporating it into cost calculations is arduous because of the rapid rate of evolution in the industry and the information opacity regarding the market share of each hardware and the rate at which obsolete mining hardware are replaced. Newer mining hardware may achieve faster hash rates and higher energy efficiency but the renewing costs makes it unlikely that all Bitcoin miners immediately replace all their existing mining hardware with the latest versions as they are released. Certainly a combination of both old and new mining hardware should coexist in the Bitcoin network as long as each machine continue to generate a profit. However, the market share of each hardware and its evolution over time is an unknown. With respect to the purpose of the present estimate of the lower bound of the mining cost, we must stress that the maintenance and the hardware costs must be anyway proportional to the energy consumption costs. By ignoring them we are under-estimating the total mining cost by some factor but, beside this factor, the estimation of the overall behavior of the mining cost should not be significantly affected.

Data

Historic data on Bitcoin prices, the average hash rate, and the number of daily blocks per day can be found on conwaytransport.com.au and the estimated total value of all transactions on the Bitcoin network on conwaytransport.com.au Hash efficiency and other information regarding Bitcoin mining hardware were aggregated from manufacturer data and previous studies (Küfeolu and Özkuran, ) and independently verified.

Most prior works have priced energy usage according to global average electricity prices (see for instance Vranken, ; Derks et al., ; Küfeolu and Özkuran, ). In this paper, we introduce a different approach, by converting the energy consumed during Bitcoin mining into barrels of oil equivalent and priced according to the Brent Crude spot price. Historical Brent Crude oil spot prices were collected from the EIA¹ with the conversion rate between joules and barrels of oil equivalent set at 1 barrel = gigajoules based on the figures released by the BEIS². Our rationale is that the Brent Crude oil price is a publicly available daily value standardized around the world whereas electricity prices varies widely across different countries and suppliers. Note that there is a premium that electricity producers and distributors charge on the electricity price with respect to the oil cost and there can be also taxes. These extra charges depends on countries and situations but they will add a certain percentage to our estimate of the mining cost based on oil prices.

As another point of comparison, regional electricity prices were also used as a proxy for the energy cost. The average global electricity price used for mining was calculated based on the geographic distribution of hash rate on the Bitcoin network and the local industrial electricity price. Based on the figures released by the CCAF at conwaytransport.com.au, China, USA and Russia are responsible for over 80% of global hash rates. An overwhelming proportion of Bitcoins are mined in China so the data there is further stratified based on provinces. They are shown in Table 3. The three nations also publish government statistics regarding industrial electricity prices on a regular basis (China: NEA, USA: EIA, Russia: Petroelectrosbyt) which allowed for the annual weighted average electricity price for Bitcoin mining, E_t, to be calculated as

where:

i is the set of regions in Table 3;

w_i is the share of global hash rate accounted for by region i;

p_i is the industrial electricity price in region i, converted to USD/kWh based on the average exchange rate.

Table 3. Geographic distribution of the share of hash rate on the Bitcoin network, &#x;

A disproportionately large percentage of mining activity within China was based in provinces with lower than average electricity prices so where provincial data were not available, a multiplier based on empirical data from to was applied on national Chinese electricity prices to calculate E_China. Regional share of hash rate and electricity prices were not available for USA or Russia so similar adjustments weren&#x;t possible. Another limitation of electricity prices is that a growing proportion of Bitcoin mining uses low-cost stranded renewables (Andoni et al., ), such as the use of associated gas that would otherwise be flared (Loris, ) which could further lower the energy cost of Bitcoin mining below the national averages. Due to these other factors and the lack of historic data on electricity prices in several other countries around the world, the majority of this paper will focus on energy pricing using the Brent Crude oil index. A comparison of ratio between the cost of mining and Bitcoin transaction volume is presented in Figure 6 to show the standardized oil prices as a measure of energy cost yield similar results to using regional electricity prices.

Estimation of the Energy Costs of Bitcoin Mining

A mining hardware has an energy consumption that can be measured in joules per terahash (J/Th), and has a hashing speed that can be measured in terahashes per second (Th/s). For the purpose of estimating a lower bound to the energy costs of Bitcoin mining, we considered at any point in time that the entire network is adopting the most energy efficient machine available at that time. In situations where a mining hardware has different power setting options in which the user may choose to increase or decrease the hashing speed of the machine along with energy consumption, the most efficient power setting is used for calculation.

The lower bound of the energy costs of Bitcoin mining is estimated from total number of hashes times the energy cost of hashing by the most energy efficient Bitcoin mining hardware available on the market at any give time, divided by the conversion factor between energy and barrel of oil and multiplied by the cost of the oil. Specifically, the lower bound for daily mining cost, C_t, is:

where:

e_t is the energy efficiency of the most efficient mining hardware available on day t in (J/Th);

H_t is the daily number of hashing operations in (Th) on day t;

b is the joule of energy equivalent per barrels of oil &#x; × 10⁹ (J/barrel);

P_t is the Brent crude oil spot price (USD/barrel) on day t.

3. Results

Hardware Efficiency Variations

Table 2 reports a list of the Bitcoin mining hardware which consumed the least energy per hash operations at the time of their release to the market. The improvement in energy efficiency for Bitcoin mining over time is reported in Figure 1 where each symbol represents the most energy efficiency hardware at the respective time and the red dotted line displays a best-fit with an exponential curve: Energy Consumption cexp(&#x;»t). The best fit parameter is » = , which means that hardware efficiency has been doubling every 10 months in average. In a previous work a power-law model was proposed by Kristoufek (). However, the exponential model is more consistent with what is commonly expected for the rate of technology growth, according to the Moore&#x;s Law (Moore, ).

Figure 1. Estimate of the lower bound for the energy consumption of the most efficient Bitcoin mining hardware, measured in J/Th.

Hash Computations Variations

Figure 2 displays the total number of hashing operations per day. We note that the number of daily hashes have increased from 10¹⁵ to 10²⁵ in the period between September to May when this paper was written. Daily hashes have been growing at exponential rates (linear trends in semi-log scale), which is in agreement with previous observations (O&#x;Dwyer and Malone, ). However, we can see from the figure that there are four, very distinct, periods with different grow rates. Specifically: (i) mid to mid ; (ii) mid to early ; (iii) early to early ; (iv) early to early The estimated best-fit doubling times in these periods are respectively: (1) 33 days; (ii) days; (iii) 38 days; (iv) days.

Figure 2. Daily hashes computed by the Bitcoin network. The lines are best-fits with exponential growth laws in the corresponding sub-periods. Doubling times are respectively (i) 33 days, during mid to mid ; (ii) days, during mid to early ; (iii) 38 days during early to early ; (iv) days, during early to early

Energy Price Variations

Figure 3 shows the variations of the energy price per gigajoule in the period &#x; computed from the Brent Crude spot prices. One can notice that the cost of one gigajoule of energy has two distinct levels&#x;around 20 USD from to mid and around 10 USD from late to early Oil prices has since collapsed under the coronavirus pandemic, dropping to below 3 USD per gigajoule of energy. However, while large, the rate of change in energy price is several orders of magnitude smaller than the rate of change in the number of hashes.

Figure 3. Energy cost per gigajoule, measured in USD and converted from Brent Crude spot prices.

Lower Bound Mining Cost Estimate

The lower bound of the total energy costs of Bitcoin mining is estimated as the minimum energy cost of each hash multiplied by the total number of hashes computed over a given period of time (a day in our case). Figure 4 reports the total mining daily cost in USD estimated by using Equation (4), it varies from around 3 USD a day in to over 4 million USD a day in early Note that this is the lower bound estimate and the actual cost is presumably much larger. The growth in mining costs is affected by both the changes in energy cost (see Figure 3) and by the increase in the hashing rate in the Bitcoin network (see Figure 2). We note that the variations in energy cost oscillates in a much narrow band with respect to the changes in the daily number of hashes and therefore, the minimum Bitcoin mining costs (Figure 4) mostly mirrors the growth in the total number of hashes.

Figure 4. Total daily mining cost C_t, reported in USD, estimated by using Equation (4).

Transaction Volume Variations

During the last 10 years the Bitcoin network activity has also increased with increasingly larger amount of money transferred daily through the network. Figure 5 reports the total transferred value per day in the Bitcoin network specified in USD. One can see that the total daily volume of transactions has grown from about one thousand USD in to nearly one billion USD in for an increase by six orders of magnitude.

Figure 5. Daily transaction volume V_t reported in USD.

Ratio Between Mining Cost and Transaction Volume

Figure 6 reports the ratio between the daily mining cost C_t and daily transaction volume V_t. We observe that the ratio C_t/V_t does not have any increasing or decreasing trend but rather is oscillating within a certain band over most of the period from to The largest variations occurred in the first few years then, after , the ratio value has stabilized into a plateau with then a jump to a higher plateau at the end of presumably due to the large decrease in Bitcoin price from over 19, USD in December to just a little over 3, USD in December Despite the change in this relation between mining costs and transaction volume in &#x;18 and the change in Bitcoin prices in the same period, we note that in general this ratio is not correlated with the price of Bitcoin. There is actually a small negative correlation between the two for the daily variations. Over the entire period, the mean value of C_t/V_t is % with the first decile being % and tenth decile being %. Using regional electricity prices to calculate the mining costs shows a similar pattern over time, though on a slightly higher level after with the mean ratio being %. Note that this band of oscillation is within one order of magnitude whereas the underlying quantities C_t and V_t vary of six orders of magnitude during the same period. If we limit our analysis to the last period after the end of , we obtain a mean ratio of % and D1, D10 deciles with values equal to and %.

Figure 6. Ratio between the cost of mining and the total transaction volume C_t/V_t on daily basis. The band is the region between the first and tenth decile and the center line is the mean value, which is % for oil and %.

4. Discussion and Conclusions

The proof of work allows a network of anonymous and untrustful parties to operate together without central authority control. It is a powerful instrument to keep a distributed system secure from malicious attacks. However, it has a high cost. We estimate that presently at least a billion USD per year is burned by the Bitcoin network for the proof of work. This amount corresponds to a one million times increase with respect to the costs in However, although large, this amount is % of the transaction volume over the network during the same period.

Using data from to , this paper quantifies the lower bound for the energy costs of Bitcoin mining and examines the relationship between this bound to the total value of transactions over time. We reveal that the ratio between mining cost and total transaction volume has not increased nor decreased over the last 10 years despite Bitcoin mining activity having increased by ten billion times during the same period. Such an overall constant ratio is consistent with an argument, introduced by Aste (), suggesting that such a ratio must be a sizable fraction of the transaction volume and it corresponds to the minimum fraction that an attacker must double spend to make a profit (the quantity p in Equation 2). Assuming the default block depth of N = 6 in Equation (2), and using the last 3 years mean value for the fraction C_t/V_t at %, we obtain that Bitcoin proof of work protects from a double spend attack at least a fraction around p  % of the global transaction volume. This result indicates that attacks that duplicate more than % of the transaction volume could be profitable for the attacker because the cost of energy spent for the attack will be lower than the gain from the attack. This being a lower bound estimate that realistically could be an order of magnitude larger if all extra costs, beside the oil equivalent cost of mining energy, are included.

We could therefore conclude that in the Bitcoin network the cost of proof of work is not at all too high. On the contrary it is actually too low to protect against double spending attacks. However, the proof of work is not the sole mechanism that provides protection of the Bitcoin network. The system also depends upon the high entry barriers in terms of mining hardware and facilities costs. Further, Bitcoin value is built upon community trust so once a majority attack has been detected, the Bitcoin value is likely to collapse together with the potential attacker gains. This means that to launch a majority attack on Bitcoin, the attacker would thus not only need to invest substantial amounts of energy resources to gain over 50% of the hashing power, they would also have to accept that many of the hardware costs incurred are unlikely to be recovered due to the inability of specialized ASICs to be repurposed for uses other than cryptocurrency mining and that even if the attack was successful, the value of Bitcoin would collapse so rapidly that there would be little economic gain. Finally, an attack involving a large fraction of the Bitcoin volume would be most likely detected by the network before its completion.

Distributed systems and Blockchains can be secured through several other mechanisms that do not require computationally intensive proof of work. Indeed the proof of work is a mechanism introduced to produce qualified voters in a system of anonymous untrustful parties. Any mechanism that can verify identity of the voters&#x; or that can in any other way avoid uncontrolled duplications of the voters can reduce or eliminate completely the cost and even the need of a proof of work. However, these other mechanisms must relax also some other properties, such as anonymity, openness, or equalitarian distributed verification.

Data Availability Statement

The raw data supporting the conclusions of this article will be made available by the authors, without undue reservation.

Author Contributions

TA proposed the research, supervised and contributed to the data collection, performed the data analytics, and co-drafted the paper. Y-DS collected, processed and analyzed the data, and co-drafted the paper. Both authors gave final approval for publication and agree to be held accountable for the content of the work.

Conflict of Interest

The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.

Acknowledgments

TA acknowledges support from ESRC (ES/K/1), EPSRC (EP/P/1), and EC (HICT ). This article has been released as a pre-print to arXiv as Song and Aste ().

Footnotes

References

Keywords: bitcoin, proof of work, cryptocurrency, blockchain, mining cost

Citation: Song Y-D and Aste T () The Cost of Bitcoin Mining Has Never Really Increased. Front. Blockchain doi: /fbloc

Received: 25 May ; Accepted: 31 August ;
Published: 22 October

Copyright © Song and Aste. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.

Correspondence: Tomaso Aste, conwaytransport.com.au&#x;conwaytransport.com.au