Megan Skiendel: David, hey — I need to tell you what happened to me yesterday before we start, because it's basically the whole episode.
David Sterling: Go ahead.
Megan Skiendel: I'm on a call with someone who has actual institutional money moving into crypto, and they keep saying 'blockchain is immutable, it's immutable' — and I finally ask them what that means, mechanically, and they go quiet.
David Sterling: Because it's not a definition they've tested.
Megan Skiendel: Exactly. And the honest answer — the thing I couldn't get them to say — is that blockchain history isn't locked mathematically. It's protected by the cost of attacking it. Those are different things.
David Sterling: Well, think about it this way. A café owner in Buenos Aires accepts a Bitcoin payment — Bitcoin, Satoshi Nakamoto, 2009, proof-of-work. She confirms it. What's actually happened? The ledger has recorded a transaction, and reversing it would require an attacker to redo the cryptographic work for that block and every block since, and then outrun the entire honest network. The cost of that attack is what makes the payment stick. Not an equation.
Megan Skiendel: Right — but 'conditional immutability' is nowhere on the product page.
David Sterling: That's the tension. The research is explicit: it's probabilistic. Each additional block makes a rewrite more expensive, never impossible. That's a cost-benefit ratio, not a padlock.
Megan Skiendel: And then Ethereum shifts the whole model in 2022 with the Merge — replaces energy burn with locked capital — and suddenly you're asking a different question about who's actually paying for that guarantee.
David Sterling: Which is where I want to spend most of our time today. The what does immutability cost — and whether the answer changed when proof-of-stake entered the picture.
Megan Skiendel: But that cost question only makes sense once you understand what you're actually paying to protect — and I think most people stop one layer too early. They hear 'hash chaining' and nod. They don't ask what the chain is actually doing.
David Sterling: Walk me through it.
Megan Skiendel: Each block contains a cryptographic hash of the previous block's header. So if you alter any block — any one — every subsequent block's hash is now wrong. The tampering is immediately detectable. That's the detection system. But detection isn't security.
David Sterling: Right — because detection without cost of attack is just an alarm with no lock on the door.
Megan Skiendel: Exactly. The actual security — what Satoshi Nakamoto embedded in the original 2009 Bitcoin design — is the asymmetry. Anyone can verify the full ledger history with almost no resources. Rewriting it costs resources proportional to the entire network's cumulative security investment. That gap is the whole game.
David Sterling: Cheap to verify, expensive to alter. The wider that gap, the more durable the ledger.
Megan Skiendel: And here's where I think people miss it — the hash chaining isn't doing the heavy lifting on security. It's just making the fraud legible. The cost asymmetry is doing the heavy lifting. Those are two separate mechanisms and they get collapsed into one.
David Sterling: The same logic resolves the Sybil problem. I mean — whether you're in proof-of-work or proof-of-stake, the question is how do you stop someone from spinning up a thousand fake identities and just outvoting the honest network. PoW says: each identity costs computational resources. PoS — Ethereum post-Merge — says each validator costs staked capital. Different currencies, same mechanism. Cheap identity multiplication collapses.
Megan Skiendel: Wait, so Sybil resistance is actually just the asymmetric cost principle applied to identity instead of history rewriting.
David Sterling: That's it. One principle. Two applications.
Megan Skiendel: Which means when people argue PoW versus PoS — honestly, that's a debate about which currency you use to price the asymmetry, not whether the asymmetry exists. Proof-of-work prices it in energy flow. Proof-of-stake prices it in locked capital stock and the threat of slashing. The attacker math changes. The load-bearing principle doesn't.
David Sterling: Frankly, that's the cleanest way I've heard it framed. And the thing it implies — the part that should make people nervous — is that the guarantee degrades automatically if the network shrinks. No code change required. The asymmetry narrows, and suddenly the cost of rewriting history on something like Litecoin looks very different than on Bitcoin at 600 exahashes.
Megan Skiendel: And Litecoin is exactly where that gets uncomfortable — because if the asymmetry narrows enough, the cost-of-attack question stops being theoretical. But okay, walk me through the actual currencies. Bitcoin's is what — energy, ongoing, every block?
David Sterling: Flow cost. You have to re-execute proof-of-work for every block from the target forward, and then outpace the honest network in real time. The network is still mining. You have to beat it. That's the 51% attack — and the deterrent is that the energy expenditure never stops. You can't just pay once and hold the position.
Megan Skiendel: It's a race you have to keep winning.
David Sterling: Exactly. Ethereum post-Merge flips that. Validators stake capital — that capital sits locked on-chain — and the threat is slashing. You submit conflicting attestations, the protocol automatically destroys a portion of your bond. One-time stock cost, not an ongoing flow.
Megan Skiendel: And the Gui-Hortacsu-Tudon memo — the analysis they did specifically for Ethereum's Casper upgrade — their argument is that slashing actually wins on double-spend and sabotage, precisely because the attacker is identifiable. Their capital is on-chain. In PoW, the mining hardware is repurposable. You can just redirect it.
David Sterling: The attacker leaves a signature.
Megan Skiendel: Which is — honestly, that's a different kind of security. It's not just economic, it's almost socio-legal. Someone can be held liable in a way they can't in proof-of-work.
David Sterling: Well — and here's where I think the memo is doing something careful. It's saying PoS wins on those specific threat vectors. Double-spend, sabotage. But there's an attack surface PoW doesn't have at all. Long-range attacks.
Megan Skiendel: Wait — old keys?
David Sterling: Old validator keys. From a period when you held significant stake. That stake is gone — you've already sold it — so slashing can't touch you. But the keys still work. You can use them to rewrite a long segment of chain history at minimal marginal cost. The protocol can't punish you for it. The original stake isn't at risk anymore.
Megan Skiendel: So the thing that makes PoS attackers identifiable — the on-chain capital — is exactly what they've already exited before they run the attack. The tractability disappears at the moment it matters most.
David Sterling: And the patch is checkpointing, or social consensus to just reject the false chain. Which means — I mean, that's not a structural guarantee anymore. That's a governance call. A systematic review of 26 research articles actually lands here: PoW with the longest-chain rule still provides stronger formal security guarantees than PoS alternatives, even though PoS wins on energy. They're measuring different things. You can't put them on the same axis.
Megan Skiendel: Two separate report cards. And — actually, who makes that social consensus call is what strikes me. Because that's the layer where it gets genuinely strange — and it connects to something we haven't gotten to yet, about whether immutability is even a protocol property at all, or just a story communities tell themselves until a hard fork says otherwise.
David Sterling: That's the next layer. And frankly, the answer is not comfortable for anyone who's used the word 'trustless' in a pitch deck.
Megan Skiendel: And 'trustless' is exactly where the story breaks — because here's something most people never hear about: redactable blockchains. They exist. You can design a chain where designated parties are allowed to alter history under specific governance conditions. Which means standard immutability isn't a physical law. It's a design choice. Someone made it.
David Sterling: Wait — you can just choose to build in mutability.
Megan Skiendel: You can. And once you know redactable blockchains exist, the whole framing flips. Bitcoin's immutability isn't something the protocol physically enforces. The community chose to make alteration economically prohibitive instead of technically prevented. Those are different decisions.
David Sterling: So immutability is — well, it's a governance commitment enforced by economics. Not a mathematical fact. The chain could be built otherwise.
Megan Skiendel: And we've already seen communities override that commitment when it got inconvenient. Hard forks. Social consensus stepping in and saying — actually, no, this version of history is the real one. That's not theoretical.
David Sterling: The Ethereum DAO fork. The community voted, essentially, to roll back a hack.
Megan Skiendel: Right — but what strikes me about the Merge specifically is that the public story and the actual structural story were running on completely different tracks. Ethereum's message in 2022 was environmental — we're cutting energy use, we're saving the planet. The actual shift was who controls the validator set. Miners — hardware capital — gone. Stakers — financial capital — in. That's a complete redistribution of who pays for security and who holds the keys.
David Sterling: And those are different stakeholders with different interests. Hardware miners have physical skin in the game. Stakers are — I mean, they're capital allocators. The incentive structure isn't identical.
Megan Skiendel: Litecoin is the case I keep thinking about as a stress test. Rollback security questions surfaced publicly — and the point isn't whether an attack happened. It's that on a smaller network, the asymmetric cost that makes Bitcoin's history untouchable starts to compress. The deterrent is proportional to network size.
David Sterling: That's the variable no one prices in. The guarantee degrades with the network. Litecoin's hash rate is a fraction of Bitcoin's. The cost-of-attack math looks genuinely different.
Megan Skiendel: And in Ethereum's PoS model, that stress case is the long-range attack — which the Gui-Hortacsu-Tudon memo analyzes, and the answer they land on is basically: you patch it with checkpointing, or social consensus rejects the false chain. That's governance doing load-bearing structural work. The Casper slashing mechanism — all of it — assumes punishment actually coordinates. That assumption isn't the same thing as coordination happening.
David Sterling: The security property becomes political the moment it depends on humans agreeing which chain is real.
Megan Skiendel: Which is — honestly, that's the counterintuitive core of all of this. Immutability isn't something Bitcoin or Ethereum can guarantee at the protocol level. It's a commitment the community enforces by making the alternative expensive enough that nobody tries. Redactable blockchains prove the alternative is possible. Hard forks prove communities will choose it when the cost feels right.
David Sterling: The load-bearing variable isn't the code. It's whether the community holds the line — and whether the attacker thinks they will.
Megan Skiendel: And I think that's actually where I keep getting stuck. Not on the technical side anymore — on the liability side. If immutability is always a ratio, not a guarantee, and that ratio shifts — because the network shrinks, because hardware gets cheaper, because some large validator exits before running a long-range attack — who made the promise that broke?
David Sterling: That's the question I can't cleanly answer. The asymmetric cost structure is the promise. Bitcoin's held it since 2009 because the network kept growing. But the promise was never written in the marketing. Nobody printed 'immutability valid while hash rate exceeds attack budget' on the product page.
Megan Skiendel: No. It was just — 'immutable ledger.' Full stop.
David Sterling: And frankly, even Stanford EE374 — foundational treatment of both PoW and PoS mechanisms — doesn't settle the comparison on a single axis. The academic consensus hasn't landed. So the people writing the marketing weren't simplifying a resolved debate. They were simplifying an open one.
Megan Skiendel: Which means — I mean, the liability question is genuinely unresolved. Not just practically. Structurally. In Bitcoin's model you'd go after — who, exactly? Satoshi Nakamoto is pseudonymous and gone. In Ethereum's PoS model, the attacker is identifiable, the slashing mechanism names them — but if it's a long-range attack using old keys, they've already exited the stake. The mechanism that was supposed to hold them accountable has no grip left.
David Sterling: The ledger looks closed. It isn't. It's a live negotiation between cost and consensus — and the terms keep shifting.
Megan Skiendel: That's honestly where I have to sit. I don't have an answer for who pays. I'm not sure anyone does yet.
David Sterling: Neither do I. Good talk.
