Iris Holm: You look like someone did math at you this week.
Cyrus Reed: Someone did, yeah — me, at myself. I was reading through the Cambridge Bitcoin Electricity Consumption Index framing and I — wait, actually, I want to just read the number cold. $1.69 million. Per hour. That's the modeled cost of a successful attack on Bitcoin right now. And I read that and then I read that zero percent of the hash power backing that cost is available to rent anywhere on the open market, and I just — I had to sit there for a second.
Iris Holm: The number is priced. The attack is not purchasable. Those don't have to coexist, but they do.
Cyrus Reed: No way — so what does that actually mean for the security argument?
Iris Holm: It means the energy isn't a proxy for security. It might just be the security — the physical anchor that makes the system's history irreversible. And that's what I want to work through today.
Cyrus Reed: Proof-of-Work — miners competing to solve cryptographic hash puzzles, the chain with the most accumulated work wins — and most coverage I see treats the energy bill as the flaw with a security asterisk attached. But what if we've been reading it backwards?
Iris Holm: When Bitcoin launched, it was the first demonstration that mutually distrusting participants could agree on a shared ledger without any trusted third party — no bank, no court. The mechanism for that agreement was: burn energy, prove the work happened, build the canonical chain. The energy isn't the cost of the thing. It's how the thing exists.
Cyrus Reed: And the question we're actually chasing is — what does that mean for trust? Like, what is it about expending electricity that replaces centuries of institutional design?
Iris Holm: Trust minimization — eliminating reliance on any single institution — and the claim is that verifiable energy expenditure is what fills that gap. Whether that claim survives is the whole thread.
Cyrus Reed: Okay. Yeah. That's — I mean, that's the question I actually want answered.
Iris Holm: Then let's pull it.
Cyrus Reed: But what does 'prove the work happened' actually mean to someone who's never thought about it? Like, is there an analogy that doesn't involve explaining cryptography?
Iris Holm: Imagine a lock whose combination can only be discovered by physically turning the dial through millions of possible numbers. Every block on Bitcoin's chain is proof someone turned the dial. You cannot fake the turning.
Cyrus Reed: The dial-turning is the electricity.
Iris Holm: Exactly that. And the solution to the hash puzzle — solving it proves real energy was spent. You cannot counterfeit it. You cannot produce it cheaply after the fact.
Cyrus Reed: So the chain isn't just a ledger — wait, no, say it this way — it's a ledger wrapped in a physical receipt. You can actually look at a block and see how much work it cost to build it. That's — huh. That's genuinely different from any other record-keeping system I can think of.
Iris Holm: Ten miners or ten thousand miners — blocks still arrive every ten minutes. That's the Difficulty Target Adjustment. The protocol self-regulates. More hash rate, harder puzzle. Less hash rate, easier puzzle.
Cyrus Reed: Hold on — so the energy-security relationship stays stable even through hardware booms? Like, even when mining rigs get ten times more efficient?
Iris Holm: The adjustment absorbs it. That's the point. The protocol doesn't care about your hardware generation. It recalibrates. Which is what keeps this working across, what, fifteen years of Moore's Law pressure.
Cyrus Reed: And miners can't just — I mean, they can't cheat this, because cheating means forfeiting the block reward, the newly minted Bitcoin plus the transaction fees, and they already spent the electricity. So the energy is gone whether they behaved or not.
Iris Holm: Dishonest behavior forfeits the reward and wastes all expended energy. That's not a slap on the wrist. That's the whole incentive structure collapsing on you.
Cyrus Reed: Which is — okay, this is where Sergei Tikhomirov's framing clicks for me. Trust minimization isn't a bonus you get from PoW. It's the actual design goal. And the way PoW achieves it is by making the ledger's integrity a product of thermodynamics — not of anyone's promise.
Iris Holm: Not a policy. Not a reputation. Physics. And that's also why the energy isn't a flaw to apologize for — it's the mechanism. The question is whether that mechanism is actually irreplaceable, or whether there's a cheaper path to the same end. Which is exactly where proof-of-stake enters.
Cyrus Reed: But cheaper path — that's actually where I want to push, because before we get there, I don't think we've said what a 51% attack actually demands of you. Like, not 'more than half the hash rate.' The sustained version. You don't just need to touch fifty percent — you have to outspend every honest miner, continuously, for as long as it takes to build a longer alternative chain. Which could be hours.
Iris Holm: Continuously. That's the word people drop.
Cyrus Reed: Right — because the honest miners don't pause. They're building forward the whole time you're trying to rewrite backward. So your attack cost isn't a one-time entry fee, it's — wait, it's more like a race where the track keeps extending while you run.
Iris Holm: Which means attack cost scales directly with honest-network energy consumption. No shortcut. The attacker faces the same input cost curve as everyone else.
Cyrus Reed: Actually, here's the concrete version of this I keep wanting to say out loud. Imagine a mining cooperative in Iceland. Major exchange gets robbed. The cooperative has the capital. They call around trying to buy hash power to reverse the theft. And — what happens?
Iris Holm: Nothing. Not because the price is too high. Because there's nothing to rent. The sellers' own future block rewards depend on the integrity of the chain they'd be selling you the power to destroy.
Cyrus Reed: They'd be torching their own revenue stream.
Iris Holm: Block reward and miner incentive alignment — that's not a policy. It's structural. The market won't clear because the sellers are on the honest chain.
Cyrus Reed: Now — I want to complicate the $1.69 million figure though, because that number comes from the Cambridge Bitcoin Electricity Consumption Index, which the Cambridge Centre for Alternative Finance is very upfront about: it's a model. It's estimating power demand from hash rate and assumed hardware mix and electricity prices. It is not a meter reading.
Iris Holm: And there's a botnet wrinkle. Some hash power comes from compromised machines — near-zero electricity cost for the operator. Which means not all hash rate is economically equivalent. The CBECI can't see that heterogeneity cleanly.
Cyrus Reed: So the real number could be — huh. Lower? Higher? It's fuzzy in both directions.
Iris Holm: The dollar figure doesn't survive scrutiny. The mechanism does. Attack cost scales with honest spend — that holds whether the number is $900k or $2 million an hour. And the part that comes later makes this harder, not easier — because when you pull out the energy expenditure entirely, like Ethereum did with the Merge, the vulnerabilities that replace it don't have a clean number at all.
Cyrus Reed: Wait — so the imprecision of the dollar figure is almost beside the point. The structural argument is what's doing the actual load-bearing work.
Iris Holm: Right — and that structural argument is exactly what breaks when you pull the energy out. Because the ratio stays constant in PoW for a reason: both sides of the attack ledger face the same input cost simultaneously. Energy prices double — attacker pays double, honest miners pay double. New ASIC generation ships — everyone upgrades in parallel. The ratio never moves. That's structural invariance. It's not a market condition, it's a geometric property.
Cyrus Reed: Wait — so it's not that Bitcoin is expensive to attack. It's that it's *proportionally* expensive to attack no matter what the environment looks like?
Iris Holm: Independent of any specific energy price or hash rate. Those are the exact terms. The ratio is locked.
Cyrus Reed: Okay but then Ethereum does the Merge — eliminates that expenditure entirely — and is now settling hundreds of billions in value on proof-of-stake. So either the theory is wrong, or we're all just... watching a really large bet that a specific attack hasn't been tried yet.
Iris Holm: That's the precise question. And Ertem Nusret Tas, David Tse and their collaborators answered it — not with a preference, with impossibility results.
Cyrus Reed: Impossibility — like, provably can't be fixed?
Iris Holm: Inherent to any PoS chain without an external trusted source. Three categories: non-slashable long-range safety attacks — an attacker acquires old keys and rewrites history from a checkpoint the slashing mechanism can't reach. Liveness failures under certain network conditions. And bootstrapping — if the token starts low-value, the cost to corrupt the validator set is low. These aren't implementation bugs. They're not fixable with better code.
Cyrus Reed: Hold on — non-slashable. So the punishment mechanism, the thing that's supposed to make attacking expensive in PoS, just... doesn't reach?
Iris Holm: For long-range attacks, no. Which is the tell. The Babylon protocol exists specifically because of this — it checkpoints a PoS chain onto Bitcoin's PoW chain. You're borrowing Bitcoin's accumulated work to backstop the gaps PoS can't fill on its own. That's not a feature. That's an admission.
Cyrus Reed: Wait — Babylon is basically saying 'our stake-based security has a ceiling, and the ceiling is Bitcoin'?
Iris Holm: It implies PoW security cannot be fully replicated by stake-based mechanisms alone. The designers encoded that assumption into the architecture.
Cyrus Reed: But then — okay, I keep getting stuck here — the Ethereum Merge happened. The chain didn't collapse. Billions in value, sitting there, theoretically vulnerable to a long-range attack that nobody has executed. So how do we hold both of those being true at the same time? Like, is the vulnerability real or is it just... not being cashed in?
Iris Holm: That's the unresolved question. And frankly it's the honest answer — we don't know if large PoS chains have validated that the trust relocation works in practice, or if the vulnerability simply hasn't been exploited yet. The energy expenditure is gone. The trust assumption didn't disappear with it. It moved.
Cyrus Reed: It moved to — what, social consensus? Validator reputation? Some combination of things that don't have a thermodynamic floor?
Iris Holm: That's the uncomfortable answer. The trust moved — and nobody has a clean account of where it landed. No thermodynamic floor. No minimum resource an attacker must exceed that scales symmetrically with honest spend. Just... coordination. Social consensus. Things that have historically required institutions to enforce.
Cyrus Reed: And then — wait, this is the thing I actually cannot get past — quantum computing. Because we talk about PoW like the physical anchor is permanent. But if you get to the point where verifying a hash becomes nearly as expensive as computing one, the asymmetry just... dissolves. The thing that makes PoW PoW is gone.
Iris Holm: Every PoW chain faces the exact migration pressure PoS faces right now. That's not a hypothetical attack vector. That's a structural endpoint.
Cyrus Reed: No way — so we'd have spent, what, over a hundred terawatt-hours cumulatively keeping Bitcoin live, and a quantum shift just... retroactively changes what that bought us?
Iris Holm: It means eliminating PoW's energy cost and quantum-eroding PoW's energy cost arrive at the same place. The trust assumption has to go somewhere. And no consensus mechanism — not Babylon checkpointing onto Bitcoin's chain, not anything Tas and Tse's framework gestures toward — has answered where. The question just keeps getting deferred.
Cyrus Reed: I mean — I sat down thinking I'd figure out whether the energy cost was worth it. And I think what I actually figured out is that that's not even the right question. The question is what you're willing to anchor trust to. And we just... haven't answered that.
Iris Holm: The energy isn't justified by the security. The energy is the security. Remove it, the security doesn't get cheaper — it gets relocated. That's the acknowledgment the debate keeps avoiding.
Cyrus Reed: Yeah. I don't have a resolution. I don't think there is one yet. Thanks for thinking through it with me — genuinely.
