Make a replacement history costly.

First, check the payment rules

A miner gathers payments into a proposed block. Other computers must check it before accepting it. A full validating node does this with the rules in its own software.

The node checks the required signatures and the earlier amounts the payments are trying to spend. Those earlier amounts are called inputs. They must still be available, the new payment amounts must obey the rules, and the miner’s reward must stay within the allowed amount.

Suppose a miner does a huge amount of computing work but includes extra bitcoin that the rules do not allow. A node using the unchanged rules still rejects the block. Work does not turn a forbidden payment into an allowed one.

Only after these checks can the node compare the work behind competing histories. A history that follows the rules is called valid. More work helps choose between valid histories; it does not excuse an invalid one.

Many attempts, one result to check

How does a miner show work? First it prepares a proposed block. A short part of that block, called the header, contains information used in the search.

The miner runs the header through a calculation that produces a fixed-size code. That code is called a hash. For mining, the code is read as a number and checked against a target. The miner changes data it is allowed to change and tries again, looking for a result that meets the target.

This may take many attempts. Once a result meets the target, another computer can check that result without repeating every failed attempt. This is the difference between searching and checking.

The proof does not reveal exactly how many attempts that miner made. A lucky miner could find a result sooner. It also does not prove that every payment in the block is allowed. The payment checks from the previous section are still needed.

Add the work across the history

Two valid blocks can arrive close together. For a while, some nodes may be following one and some the other. These competing paths are called branches. Bitcoin follows the valid branch with the greatest total proof of work.

Use made-up work scores to see why block count alone is not enough. Branch A has four blocks, each worth 2 work units. Add them: 2 + 2 + 2 + 2 = 8. That is the same as 4 × 2.

Branch B has three blocks, each worth 3 units. Its total is 3 + 3 + 3 = 9. B has fewer blocks but more work. The comparison uses work added across the whole branch, often called accumulated work.

Real Bitcoin calculates this work from the targets the blocks had to meet. It does not read a miner’s electricity meter or count the miner’s actual failed attempts. Our small scores explain the comparison; they are not real energy measurements.

The history keeps growing while an attacker works

Suppose a payment has been added to a valid block. An attacker wants the network to follow a different history that replaces the payment. The attacker must build a competing history that passes the rules and has enough work to overtake the accepted branch.

Meanwhile, other miners can keep adding blocks to the accepted history. Every added block contributes more work above the payment. The attacker has more history to replace while the rest of the network keeps moving.

These added blocks give the payment more confirmations. They can reduce the risk of replacement under the network’s assumptions. They do not guarantee that every attack will fail, hold the market price steady, or prove a seller delivered an order.