What the Protocol Remembers
A single hash trial forgets everything. The Nakamoto protocol forgets nothing — and a forthcoming paper proves that the most influential economic account of blockchain security has been resting on ...
What the Protocol Remembers
A single hash trial forgets everything. The Nakamoto protocol forgets nothing — and a forthcoming paper proves that the most influential economic account of blockchain security has been resting on the difference.
Based on “Why Hash-Trial Memorylessness Does Not Extend to the Nakamoto Protocol,” by Craig S. Wright, forthcoming in the International Journal of Cryptocurrency Research, Vol. 6, Issue 1 (June 2026).
Every security model is a confession. It tells you, by what it chooses to leave out, which facts its author found inconvenient. The economics of blockchain trust is no exception, and its most consequential confession is a single word: memoryless. When a model forgets what the protocol actually remembers, it overstates the cost of trust and understates how long that trust can last. My forthcoming paper is about exactly that forgetting — where it came from, what it conceals, and what it costs to put right.
The claim is narrow and precise, and I want to state it without ornament before dressing it up. A single hash trial — one roll of the SHA-256 dice — is memoryless. The Nakamoto protocol is not. The first is a theorem. The second is also a theorem, and it is the one the field has been quietly ignoring.
Memoryless is a theorem, not an adjective
Begin with what the word means, because the entire argument turns on taking it literally.
A random waiting time is memoryless if its future is independent of its past. Put plainly: the probability that you wait at least a little longer, given that you have already waited a while, is exactly the same as the probability of waiting at least that little from a cold start. The clock has no recollection of how long it has already been running. A process that has kept you waiting an hour is, if it is memoryless, no more and no less likely to deliver in the next minute than one you just switched on.
This is not a figure of speech, and it is not a vague gesture at “randomness.” It is one of the most tightly characterised facts in all of probability theory. Among every continuous distribution that exists, exactly one is memoryless: the exponential. Among every distribution on the whole numbers, exactly one: the geometric. Feller proved it; every probability textbook since has repeated it. Memorylessness is a property with a single solution, not a label you may pin on any process that happens to involve chance. If a process is memoryless, it is exponential or geometric. If it is not exponential or geometric, it is not memoryless. There is no third option, and no room for “approximately, if you don’t look too hard.”
That precision is what makes the word so dangerous when it is used loosely — and in the economics of proof of work, it has been used very loosely indeed.
The assumption the whole field is built on
The most influential recent economic treatment of Bitcoin’s security is Eric Budish’s. He states, flatly, that Nakamoto trust is memoryless — that the system is as secure at any given instant as the quantity of mining effort supporting it at that instant, no more and no less — and he leans on precisely this property to draw a sharp line between proof of work and proof of stake, arguing that computational work is more memoryless than stake. The instantaneous flow of mining expenditure becomes, in his hands, a single sufficient statistic for security. One number tells you everything.
He is far from alone. The selfish-mining literature that began with Eyal and Sirer models block creation as a Poisson process and says outright that all block-creation events are driven by memoryless processes. That assumption is not decorative; it is load-bearing. It is the only reason a problem unfolding in continuous time can be collapsed into a tractable discrete Markov decision process, where the only thing that can change the attacker’s calculation is the arrival of a new block, and the mere passage of time changes nothing. The queueing models of confirmation time, the double-spend random walks, the Markov chains catalogued in the field’s own surveys — all of them rest on the same Poisson foundation.
And here is the awkward part: it had already been shown, empirically, not to hold. Bowden and colleagues demonstrated that a homogeneous Poisson process simply does not fit the observed pattern of block arrivals once difficulty is allowed to move, with a statistical test that rejects the assumption at better than one chance in a thousand. The reason they identified is the reason this paper formalises. The field has been building on sand and calling it bedrock.
There is nothing wrong with using an exponential model for the gaps between blocks within a single stretch of fixed difficulty. That is a local approximation, and for many purposes it is an excellent one. The error is in elevating that local convenience — without qualification — into a characterisation of the entire Nakamoto protocol as a probabilistic and economic system. The protocol is not the hash trial. It is the hash trial wrapped in feedback machinery, and the machinery has a memory.
Four levels, and where memory creeps in
The paper’s first contribution is to stop the equivocation by naming the thing precisely. “Mining is memoryless” is a sentence with no clear subject. Memoryless about what? The paper distinguishes four levels, from narrowest to broadest.
The first level is the individual hash trial: how many tries until you find a winning hash, at fixed difficulty. This is genuinely memoryless — a geometric random variable, the discrete twin of the exponential. The second level is the gap between blocks within a single difficulty epoch, with the rate held constant. This is memoryless too, but trivially so: it holds because difficulty is fixed by definition for the duration of the epoch. It is a tautology, not a discovery — and, crucially, it holds only because of the very assumption that the next level destroys.
The third level is the protocol’s full state as it moves across epochs — difficulty, block height, chain structure, the contents of the mempool. The fourth is the miner’s realised economic payoff over time — whether the blocks he found stay canonical, whether his rewards have matured, what his fees are worth. These last two are where the money lives, and these last two are where memorylessness dies.
The decisive mechanism: difficulty adjustment
Every 2,016 blocks — roughly a fortnight — the Bitcoin protocol stops and looks backward. It measures how long those blocks actually took to mine, and it resets the difficulty to drag the average block time back toward ten minutes. A fortnight that ran fast raises the difficulty; a fortnight that ran slow lowers it. The new difficulty is a deterministic function of the realised block times of the epoch that just ended.
That single feedback loop is fatal to the memoryless claim at the level that matters. The rate at which blocks arrive after a retarget depends, by construction and with certainty, on the history of arrivals before it. A memoryless process requires that the distribution of what comes next be independent of everything that came before. Difficulty adjustment guarantees the precise opposite. The protocol writes the recent past into the present, on a fixed schedule, by design.
So the cross-epoch process is not exponential at all. It is what the time-series literature, after Hamilton, calls a regime-switching process: a sequence of exponential regimes whose rates are reset, at known boundaries, as a function of what has already happened. The protocol does not forget the last fortnight. It remembers it exactly, and it prices it in at the next retarget. This is the paper’s central theorem, and once it is stated it is almost obvious — which is the usual fate of the things a field has trained itself not to see.
There is a complementary result here from recent work by Noda and colleagues, and the paper folds it in. Bitcoin’s difficulty algorithm is stable only when hash rate does not respond too elastically to changes in reward. Past a threshold, the same feedback loop that destroys memorylessness produces the oscillating boom-and-bust pattern economists call a cobweb. Difficulty and non-memorylessness, instability and history-dependence, all come from the same retargeting mechanism.
Three more kinds of memory
Difficulty adjustment is the decisive mechanism, but it is not the only one, and the paper is careful to show that any one of three further features would break the memoryless claim on its own.
The first is coinbase maturity. The reward in a freshly mined block cannot be spent for 100 blocks. Whether that reward is ever actually realised depends on whether the block survives the next sixteen-odd hours of competition — which depends entirely on what happens after it is found. The payoff carries a memory because it serves a probation.
The second is fees. A single hash is worth the same no matter when it lands, but a block is not. The longer it has been since the previous block, the more fee-paying transactions have accumulated in the mempool waiting to be included, and the more a new block is worth. Block value is an increasing function of elapsed time: the prize the miner is competing for literally grows while he waits. That is the exact opposite of memorylessness, and it becomes more important every year as the subsidy shrinks and fees become the main event.
The third is the heaviest-chain rule. Whether a block counts as part of the real history depends on every block found after it. A transaction buried under fifty confirmations is far safer than one buried under five, and that depth — the accumulated weight of work stacked on top, which is nothing but the protocol’s memory of effort — is precisely what determines the probability that anyone could still rewrite it.
Difficulty adjustment, coinbase maturity, fee accumulation, the heaviest chain: the Nakamoto protocol is a machine built almost entirely out of memory. Calling it memoryless was never a description of the protocol. It was a description of the one piece of it simple enough to be convenient.
The scalar becomes a vector
What does this do to the economics? It changes the object you have to track.
Budish’s model compresses the security of the entire system into a single number — the flow of mining expenditure at a given instant. Security equals current trust support, full stop. The correction this paper forces is that the honest scalar must become a vector. To know whether a double-spend attack will succeed, you cannot watch one quantity; you must watch several at once: the work gap between the attacker’s hidden chain and the public one, the current difficulty on each chain, how far each chain sits from its next retarget, how many confirmations the target transaction has accumulated, and how many fees are sitting on the table. Set difficulty to a constant, delete the retargets, and zero out the fees, and this vector collapses cleanly back to Budish’s single number — which is exactly why his result is not wrong, only local.
The mining decision stops being a static, one-shot, zero-profit comparison and becomes a dynamic investment problem of the kind Ericson and Pakes formalised three decades ago: a question about the entire future path of difficulty, rewards, and competition, not a snapshot of this instant. Budish wrote down the snapshot. This paper supplies the film.
The free attack was always local
Budish’s most arresting result — his Theorem 2 — is that the net cost of a majority attack is zero. The attacker simply mines, collects the same block rewards an honest miner would have, pays the same costs, and so the attack is, in expectation, free. It is a genuinely uncomfortable claim, and within its proper domain it is correct. That domain, this paper shows, is a single fee-free epoch. Step one inch outside it and the zero evaporates.
It evaporates for two reasons, and the second is the more elegant.
The first reason is fees. An attacker, by definition, mines faster than the honest network — that is how he overtakes it. Mining faster means shorter gaps between his blocks, which means fewer accumulated fees per block, which means he collects strictly less than the steady-state reward against which his costs were calibrated. He pays for a full reward and receives a diminished one. The shortfall is modest per block, but it is positive, and it compounds across the attack.
The second reason is the difficulty adjustment turning on him. The attacker’s extra hash power makes the epoch run fast. At the next retarget — automatic, deterministic, and unstoppable unless he abandons the attack entirely — the protocol punishes that speed by raising the difficulty. Now every hash he throws earns less than it costs him. He is mining at a guaranteed per-hash loss, and he cannot opt out without surrendering the chain he has spent so much to build. This is the crucial difference from the external costs Budish does acknowledge — depreciating hardware, a collapsing coin price, legal exposure. Those are contingent, and an attacker might dodge them. This one is written directly into the consensus rules. It is the protocol’s own memory, weaponised against the attacker, and it cannot be bargained with.
And here is the finding that ought to give the lawless-attack literature genuine pause: honest miners leaving does not help the attacker. The naive intuition says that if everyone else quits, the attacker simply inherits the network. The arithmetic says the reverse. The fewer honest miners remain, the longer the attacker’s epoch runs, the higher the protocol sets the next difficulty, and the deeper his per-hash loss becomes. The paper proves the attack cost rises monotonically as honest participation falls. Every honest miner who walks away makes the attack more expensive, not less. Capitulation is a weapon that fires backward.
There is a further, sharper twist. Because a large attack depresses honest miners’ revenue and pushes the marginal ones toward shutting down, it can itself tip the difficulty algorithm past the elasticity threshold into Noda’s oscillating cobweb regime — making the difficulty environment swing violently and raising the attacker’s costs further still. The attack destabilises the protocol, and the destabilised protocol punishes the attack. It is a self-reinforcing trap of the attacker’s own making.
Zero dollars, or a billion
The paper does not leave this as algebra. It runs the two models head to head — ten thousand simulated attack paths each, on identical random draws, for an attacker controlling a bare majority of the network and sustaining the attack across five fortnightly epochs.
Under Budish’s constant-difficulty assumption, the simulation reproduces his theorem exactly: the mean net cost of the attack is essentially zero — minus four hundred thousand dollars, statistically indistinguishable from free — with 49.1 percent of paths showing a profit and the rest a loss. A coin flip.
Under the corrected model, with the retargets simply switched on and nothing else changed, the mean net cost is $1.275 billion, and every single one of the ten thousand paths costs the attacker more than $1.2 billion. The difficulty adjustment installs a deterministic floor beneath the cost that no run of luck can dig under. The same randomness, the same attacker, one missing mechanism — and the difference between free and a billion dollars.
The size of the gap scales with how long the attack runs and how fee-heavy the system is. For an attack that completes inside a single epoch at today’s fee levels, the understatement is modest — about $1.6 million — which is precisely why Budish’s short-horizon arithmetic remains a perfectly good local approximation, and the paper says so without grudging. But for the sustained attacks Budish himself identifies as the real threat to a payment system, the gap runs from hundreds of millions to, in a fee-dominated future, tens of billions of dollars a year. The benchmark is not demolished. It is confined to the short run and the fee-free corner, and told plainly where its writ ends.
The Poisson approximation has a shelf life
All of that concerns the protocol and the payoff. The paper’s final movement returns to the hash trial itself — the one level where memorylessness genuinely holds — and shows that even that is living on borrowed time.
The reason is a detail almost every model waves away: the search space is finite. A miner varies a few fields in the block header — a four-byte nonce and an eight-byte field in the coinbase — which yields roughly two-to-the-ninety-sixth distinct inputs to try. As long as the network samples a vanishing fraction of that space before someone finds a block, drawing without replacement is indistinguishable from drawing with replacement, and the geometric, memoryless model is exact for all practical purposes. Today the global network explores about six ten-thousandths of one percent of that space per block. The approximation is pristine.
But hash rate grows, and the explored fraction grows with it. Parra-Moyano and colleagues first pointed this out; this paper puts dates on it. On a long-run historical growth rate — hash rate doubling every eighteen months — the network explores about one percent of the space per block by around 2041, at which point the departure from memorylessness becomes detectable inside a single block’s contest. By about 2045 it reaches the five-percent mark, the standard statistical threshold past which sampling without replacement can no longer be passed off as sampling with replacement. By about 2050 it is exploring more than half the space per block, and the memoryless model fails outright — at the hash-trial level, the one floor everyone assumed was solid. The whole building gives way at once.
Throughput is a design choice, and it sets the expiry date
Here the paper turns a probability result into an economic argument, and the argument is the most important thing in it.
That two-to-the-ninety-sixth search space is the space for a fixed block template. But the template is not fixed. Every time the set of transactions in the candidate block changes, the Merkle root changes, the header changes, and the miner is suddenly searching a completely fresh region of the hash function — a brand-new urn of two-to-the-ninety-sixth balls. And what changes the transaction set? Incoming transactions. Every transaction that arrives refreshes the template.
So the effective search space is not the fixed domain. It is that domain multiplied by the number of distinct templates a miner cycles through while mining a single block — and that number is governed by transaction throughput. A protocol that processes four transactions per second refreshes the template a few thousand times per block. A protocol that processes a billion transactions per second refreshes it six hundred billion times per block: the urn is swapped out faster than any miner could sample a measurable sliver of it.
This is the hinge of the whole paper. Throughput is not a market outcome handed to the protocol by the world. It is a design parameter, fixed by the block-size policy and the engineering of the node software. And it determines when the entire stochastic foundation of blockchain security economics expires.
The numbers are stark. A throughput-constrained protocol running at four transactions per second — and the paper labels this case BTC — reaches the memoryless breakdown around 2061. A high-throughput protocol running at a billion transactions per second pushes that horizon past 2103; at ten billion, past 2108. The relationship is logarithmic, but the effect is enormous: more than four decades of additional model validity, bought purely by the decision to let the protocol scale. The constrained protocol and the unconstrained one face exactly the same physics of hardware growth. They differ only in whether their designers allowed throughput to rise. One design ages out within the operational lifetime of mining hardware bought today. The other does not.
And these are not thought-experiment throughputs. The paper notes that a UTXO transaction processor of this kind decomposes into independent services that scale horizontally — add machines, add throughput — and reports that independent security verification has confirmed sustained throughput above seventy thousand transactions per second on a single production node, with internal engineering measurements running above a billion per second per node and into the tens of billions across a modest cluster. The demand to fill that capacity is the demand of machines paying machines: micropayments, sensor networks, supply-chain settlement, high-frequency data integrity — oceans of individually trivial transactions. High throughput, on this account, is not a luxury or an ideological preference. It is the condition under which proof-of-work security remains mathematically coherent into the next century.
The security budget after the subsidy dies
Throughput does a second job, and this one bites long before 2061.
Bitcoin’s block subsidy halves every four years, marching steadily toward zero. By 2050 it will be worth a few thousand dollars a block, and the security of the system will have to be paid for almost entirely out of transaction fees. Budish’s equilibrium condition — that the reward per block must stay large relative to the value an attacker could steal — has to hold continuously, subsidy or no subsidy. The question is whether it can.
The answer, once again, is set by throughput. To keep today’s level of security funded in 2050, a four-transaction-per-second protocol would need to charge roughly $130 per transaction. That is not a payment network; it is a toll booth that prices out everyone it was built to serve, drives users away, and in driving them away strips out the very fees and hash rate that were holding the system up. A protocol processing a million transactions per second funds the identical security budget at five hundredths of a cent per transaction; at a billion per second, a rounding error. Same security, same equilibrium condition — but one design can pay for it through sheer volume, and the other cannot pay for it at all without strangling itself.
The paper calls the constrained protocol’s predicament a compounding trap, and the description is exact. Low throughput limits template refresh, which hastens the memoryless breakdown. Low throughput caps fee volume, which starves the security budget as the subsidy fades. And the high per-transaction fees that low throughput forces drive users out, which lowers hash rate, which hastens the breakdown again. Each problem feeds the others. A high-throughput protocol escapes the entire spiral: volume refreshes the templates, volume funds the security budget, and low per-transaction cost keeps users — and therefore the hash rate that secures them — inside the system.
What survives, and what does not
It is worth being exact about what this paper does and does not do to Budish, because precision is the whole point, and an argument that overreaches deserves to be dismissed.
It does not refute him. His central equilibrium logic — that permissionless, anonymous, free-entry proof of work requires a flow of honest expenditure large relative to the value of an attack — does not depend on any Poisson machinery at all, and it survives the correction completely intact. His short-horizon attack formulas remain good local approximations. What the paper removes is narrow and surgical: the unqualified claim that the protocol-level environment is memoryless, and the specific corollary that a majority attack is free. The first is replaced by a regime-switching process. The second is demoted from a universal truth to a local one — valid in a single fee-free epoch and nowhere else. The right summary statistic for the security of the system was never a scalar. It was always a state vector.
Why it matters
The deepest claim in the paper is the one in its final line: the stochastic foundations of proof-of-work security are themselves functions of protocol design. This is not a small thing to say. It means the probability theory underneath every economic model of Bitcoin — the selfish-mining analyses, the confirmation-time queues, the double-spend random walks, Budish’s own equilibrium — is not a fixed law of nature handed down by the mathematics. It has a shelf life, and the length of that shelf life is a choice.
A protocol that refuses to scale is not merely making a throughput decision. It is dating the expiry of its own security model, and, as the subsidy fades, signing up for a security budget it cannot fund. A protocol that scales is buying decades of model validity and a fee base that actually works. The economics and the engineering are not separable questions, and the paper’s contribution is to prove, rather than assert, that they are the same question.
The individual hash trial forgets everything. That much is true, and it is a theorem. But the Nakamoto protocol was never the hash trial. It is the hash trial wrapped in difficulty adjustment, coinbase maturity, fee accumulation, and the heaviest-chain rule — a machine assembled almost entirely out of memory. The models that called it memoryless were not describing the protocol. They were describing the one part of it simple enough to be convenient, and then mistaking the convenience for the thing. The protocol remembers the last fortnight, remembers every confirmation stacked upon a block, remembers every fee waiting in the mempool, and prices all of it. Good economics will have to remember too.