Thousands of computers that have never met, some of them lying, need to agree on one shared history — which transactions happened, in what order — with no referee anyone trusts. That is the real problem money on a blockchain solves; the coins are almost a side effect. Three tabs below let you run the three great answers live: Proof of Work burns electricity to make history expensive to rewrite, Proof of Stake bonds money that gets destroyed if you cheat, and Byzantine Fault Tolerant voting reaches agreement by supermajority even with liars in the room. Every counter is computed by a running simulator — flip a node to dishonest or offline and watch each protocol either route around it or stall.
A cryptographic hash turns any input into a fixed-length number that behaves like a random draw: change the input by one bit and the output scrambles completely, and there is no way to run it backwards. Mining exploits exactly that. A miner assembles a candidate block (the pending transactions plus a link to the previous block) and appends a nonce — a throwaway counter. It hashes the whole thing, and if the result is a number below a target, the block is valid. If not, it bumps the nonce and tries again.
Because the output is effectively random, the only strategy is brute force. If the target admits a fraction 1 / 2^d of all possible hashes, you expect to try about 2^d nonces before you strike gold. That is the "work." The network watches how fast blocks appear and retargets d up or down to hold the average block time constant — Bitcoin aims for ten minutes.
The link to the previous block is what makes history expensive to change. Each block's hash feeds into the next, so tampering with an old block invalidates every block after it — you'd have to re-mine the entire suffix. Meanwhile honest miners keep extending the real chain. The agreed rule is dead simple: follow the chain with the most cumulative work.
An attacker who wants to erase a transaction must secretly build a longer chain than the honest network. With less than half the hashpower, the honest chain grows faster in expectation and the attacker falls further behind every block — the race is lost with overwhelming probability. Cross 50% and the arithmetic flips: the attacker now wins races and can rewrite recent history. Security rests entirely on honest hashpower staying in the majority, and on rewriting being as costly as the original mining.
Proof of Stake replaces "one CPU, one vote" with "one coin, one vote." To take part, a validator locks up a deposit — its stake. For each slot the protocol runs a public, verifiable random draw and picks a proposer with probability equal to its fraction of the total stake. A validator with 20% of the bonded coins proposes roughly 20% of the blocks. No puzzle is solved, so almost no energy is spent; the scarce resource being spent is capital committed and put at risk.
The obvious worry is the nothing-at-stake problem: without the cost of mining, why not sign every competing fork and always end up on the winner? The answer is slashing. Rules define provable misbehaviour — most importantly equivocation (signing two different blocks at the same height, or surround-voting). Anyone who observes both signatures can submit them as cryptographic evidence, and the protocol automatically burns part or all of the offender's stake and ejects it.
That single mechanism realigns incentives. Because a validator's own money is on the line, the rational move is to follow the rules: honest validation earns steady rewards, while a detectable attack costs more than it could ever gain. This is called economic finality — reverting a finalised block would require a supermajority of stakers to get themselves slashed, destroying billions in bonded value.
The trade-offs are real. PoS must guard against long-range attacks (rewriting ancient history with old keys) using checkpoints and weak subjectivity, and against stake centralisation, since wealth compounds influence. But the headline win stands: security no longer depends on out-spending the world in electricity, only on the attacker being unwilling to set fire to their own deposit. Ethereum's move to PoS in 2022 cut its energy use by roughly 99.95%.
The Byzantine Generals Problem (Lamport, Shostak & Pease, 1982) frames it as generals surrounding a city who must agree to attack or retreat, communicating only by messenger — while some generals are traitors sending contradictory orders. The classic result is stark: reliable agreement is possible if and only if fewer than one-third of the participants are faulty. Modern BFT protocols — PBFT, Tendermint, HotStuff — are engineered around that exact bound.
They work by voting in rounds with a supermajority. A rotating proposer suggests a block; validators broadcast a prevote, then a precommit. A validator only commits once it has collected precommits from more than two-thirds of the set — a quorum. Two quorums of size > 2n/3 must overlap in more than n/3 members, so they always share at least one honest validator. That overlap is what makes conflicting commits impossible: you can never assemble two ⅔ quorums for two different blocks.
Write n = 3f + 1. Safety needs the two-quorum overlap to contain an honest node, and liveness needs the honest majority to be able to form a quorum on their own even if all f faulty nodes stay silent: n − f = 2f + 1 > 2n/3 holds exactly at this ratio. Push faults to f + 1 and both guarantees break — honest nodes can no longer reach the threshold, so the protocol halts rather than risk a fork.
That choice — stall instead of split — is deliberate. Unlike Nakamoto consensus, which always makes progress but only gives you probabilistic finality (a deep-enough block is almost irreversible), BFT gives instant, absolute finality: once committed, a block can never be reverted while faults stay under the bound. The price is that BFT needs a known validator set and tends to slow down as that set grows, since every node must hear from a supermajority of the others.