SHA-256 in Bitcoin Mining

Bitcoin's proof-of-work consensus mechanism is built entirely on SHA-256. Miners repeatedly hash block headers with SHA-256 to find a value below a target threshold, transactions are identified by their SHA-256 hashes, and the Merkle tree structure uses SHA-256 to efficiently summarize all transactions in a block.

Double SHA-256 (SHA-256d):

Bitcoin uses SHA-256 applied twice: SHA-256(SHA-256(data)). This double hashing was chosen by Satoshi Nakamoto as a defense against length-extension attacks (where knowledge of SHA-256(m) allows computing SHA-256(m || padding || extension) without knowing m). While HMAC would also prevent this, double hashing is simpler and adds negligible overhead to the mining process that already computes trillions of hashes.

Proof-of-work mining:

A Bitcoin block header contains the previous block hash, Merkle root, timestamp, difficulty target, and a 32-bit nonce. Miners compute SHA-256d of this 80-byte header, incrementing the nonce and other fields until the resulting hash, interpreted as a 256-bit number, is less than the current target. As of recent years, the network difficulty requires finding a hash with approximately 75-80 leading zero bits, meaning miners test roughly 2^75 to 2^80 nonces on average per block.

Mining hardware evolution:

The computational intensity of SHA-256 mining drove a hardware arms race: CPUs (2009) yielded to GPUs (2010), then FPGAs (2011), and finally ASICs (2013). Modern Bitcoin ASIC miners like the Antminer S21 compute over 200 terahashes per second (200 x 10^12 SHA-256d per second) while consuming about 3,500 watts. The global Bitcoin network's combined hash rate exceeds 600 exahashes per second.

Other SHA-256 uses in Bitcoin:

Transaction IDs (TXIDs) are the double SHA-256 hash of the serialized transaction. Merkle trees in each block use SHA-256d to hash transaction pairs recursively, enabling Simplified Payment Verification (SPV). Bitcoin addresses involve SHA-256 followed by RIPEMD-160 (Hash160). Script hashes (P2SH) use the same Hash160 construction. The entire integrity and immutability of the blockchain depends on SHA-256's collision resistance.