<p>I think there are at least four reasons:</p>

<ol>
<li><p>The miners are stakeholders in the bitcoin ecosystem. Mining solves a problem for them. Taking away PoW mining would make bitcoin no longer work for one of its most important group of stakeholders.</p></li>
<li><p>Non-miners are in bitcoin because they like what bitcoin is. If they want some other consensus scheme, they know where to find it. There is certainly room in the market for at least one PoW chain and that's what bitcoin is.</p></li>
<li><p>Major changes impose costs on every participant in the ecosystem. Every implementation has to implement the new rules. Everyone has to test that the new stuff doesn't break anything they're relying on.</p></li>
<li><p>There isn't a consensus in the community that PoS can provide the same level of security as PoW at lower cost. That's the claim PoS advocates make, but it's far from an accepted truth.</p></li>
</ol>

CC BY-SA 4.0
2020-09-17T16:50:44.340Z
A thing that is not clear still to me is why in PoS, forks occur? I would appreciate any comment or answer to this related question: https://ethereum.stackexchange.com/q/87553/23024 Thanks
Questioner
CC BY-SA 4.0
2020-04-20T02:45:19.820Z
2020-04-20T02:45:19.820Z
David Schwartz
<p>I think there are some very convincing theoretical arguments to be made, but there is also just a very practical consideration:</p>

<p>Right now, a very large portion of BTC is being held in the cold wallets of popular exchange platforms. Hardcore bitcoiners will shake their heads and declare <em>"Not your keys, not your coins!"</em>, but this apparently has not stopped traders and normal users alike from keeping their coins stored with a custodial third party. Looking at the <a href="https://bitcoin.stackexchange.com/questions/91242/bitcoin-rich-list-reliable-or-not/91243#91243">'bitcoin rich list'</a>, we can confirm the huge number of coins held by exchanges. </p>

<p>This fact would put exchange operators in an undue position of power over the network: <strong>by staking coins owned by their users, the exchange operators can obtain a large, centralized point of control over the network's consensus operations.</strong> </p>

<p>There are already risks present when allowing a third party custodian to manage your coins/private keys, <strong>but switching to a POS system adds an entirely new and very serious type of risk!</strong> This is a very serious risk because it is existential in nature: if an exchange operator were to abuse their control of this huge number of coins somehow (by staking maliciously in some way or another), it would affect every user of the system, not just the users of that exchange.  </p>

<p>This problem is only amplified by the fact that you have to not only trust the exchange operators to not act maliciously, you also have to trust them to secure their system against theft and intrusion. It is bad enough when hackers steal funds, giving hackers the ability to attack the network consensus as well is, in my opinion, an untenable addition of risk.</p>

<p>In case you aren't convinced: This risk is not theoretical, an attack like this recently happened on an altcoin network (Steem, mid-late Feb 2020). It appears that exchanges colluded to stake the coins they held custody of, in an effort to disrupt network consensus. A quick websearch <a href="https://cryptocoingrowth.com/2020/03/02/steem-goes-down-after-major-exchanges-hijack-consensus-mechanism/" rel="noreferrer">brings this article about it up</a>.</p>

CC BY-SA 4.0
2020-04-20T03:21:38.580Z
I do not think that the Steem scenario is very realistic for BTC; it started with a single exchange being dominant, and the Steem story highlights that this would ultimately kill the entire ecosystem of the coin in question. BTC had a similar problem in the past, where a majority of miners would in located in China; after some discussion, the Chinese miners agrees to stay well below 50% because they knew that BTC could break down anytime if they continued to grow, losing more than they could gain from growing.
toolforger
CC BY-SA 4.0
2020-04-20T08:16:16.033Z
This is a really interesting theory. I also think that toolforger is right about ecosystem regulating itself. Some good game theory applied here. Thanks for enriching the thread.
Oscar Serna
CC BY-SA 4.0
2020-04-20T21:48:12.967Z
@toolforger right, it is a different situation, but I think this is still a foundational problem that is slightly different than miner centralization: With PoW, every effort is made to ensure the protocol does not favour or promote miner centralization. With PoS, centralization of coins seems unavoidable (exchanges hold a huge portion, and the fact that 'the rich get richer' under PoS only exacerbates this). Additionally, a hacker that steals coins could attack and incur almost no cost (other than lost value of the stolen coins), the same cannot happen in PoW.
chytrik
CC BY-SA 4.0
2020-04-21T06:24:49.547Z
I am not so sure about that "the rich get richer" aspect of PoS. If it's proportional to the amount held, the minting reward will be distributed accordint to the current money distribution and relative wealth remains unchanged. This changes if you have to allocate your money for PoS - the poor won't be able to allocate anything, and the rich will want to keep their money in cold wallets; I don't know how this plays out in practice.
toolforger
CC BY-SA 4.0
2020-04-19T22:40:47.727Z
2020-04-19T22:40:47.727Z
chytrik
<p>Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition. Most people that don't like PoS are thinking in &quot;vanilla&quot; or &quot;chain based&quot; PoS protocols which are certainly more insecure than PoW.</p>
<p>Ethereum 2.0 is using Casper currently in the Beacon Chain, and other coins are also using BFT PoS protocols. I will try to resume BFT PoS in a few lines:</p>
<ul>
<li>Each block must be signed by 2/3 of validators based on staking power. That provides absolute finality in just one block.</li>
<li>There is a penalty system that punish evil behavior or validator inactivity which makes it MUCH MORE secure than PoW. If you sign 2 blocks with the same height, that's evil behavior and your staking deposit is burned automatically. If 1/3 of validators are inactive and the network halts, the penalty system start to burn slowly the deposits until the network can restart.</li>
<li>Even if you have 99,9% of staking power you can't censor transactions for free because as far there is a single honest validator in the network he will include the transaction you want to censor in his block. If the attacker doesn't want to sign the block of the honest validator, his staking deposit receives a small percent of penalty, but a small percent of millions of dollars is too much money. The honest validator receives also a penalty, but his deposit is small so it's not a problem.</li>
<li>If somehow the attacker has ALL staking power and start to censor for free and don't allow other validators register their staking deposits to create blocks, the community as a whole would agree to burn all staking deposits and restart the network, which makes every coin holder much richer than before.</li>
</ul>
<p>Regards</p>

CC BY-SA 4.0
2021-05-13T19:31:54.763Z
re: *"Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition."* - that is a bold claim, for example see this review of the CBC Casper protocols: https://medium.com/@muneeb/peer-review-cbc-casper-30840a98c89a. Quote from their conclusion: *"Importantly, it remains unclear if the definition of the Casper protocol family provides any meaningful safety guarantees for blockchains, or if this approach is applicable to scaling blockchains at all."*
chytrik
CC BY-SA 4.0
2021-05-13T20:11:06.067Z
Casper is a mix of of 2 protocols: a BFT PoS protocol (Casper FFG) and a "chain based" PoS protocol (Casper CBC). It looks this paper ignores completely Casper FFG, which is the most important part of the protocol as it provides absolute finality. The protocol could be even simpler: a classic BFT consensus (2/3 of validators must sign each block), with the typical penalty system for inactivity (light penalty) or evil behaviour like double-signing blocks with the same height (burn the deposit of the attacker). If the network gets halted due to many nodes being unavailable the network can ...
Tux
CC BY-SA 4.0
2021-05-13T20:12:39.093Z
... automatically revert to PoW  consensus after a timeout. This is very simple and could be implemented in Bitcoin without any risk. There are variations about this concept like using commitees of validators, but the simplest version could work very well with Bitcoin.
Tux
CC BY-SA 4.0
2021-05-13T20:19:35.993Z
Note also that Bitcoin has 10 minutes blocks, so the bandwidth overhead of using so many signatures per block is not important. Using a protocol like this we could have 1 minute blocks, and absolute finality in 1 block. It's too good to be ignored, I hope Bitcoin developers finally implement it.
Tux
CC BY-SA 4.0
2021-05-13T20:30:30.357Z
re: *”...if the network gets halted due to too many nodes being unavailable the network can automatically revert to proof of work”* - it is perhaps quite telling that PoW is the proposed solution to the shortcomings of PoS.
chytrik
CC BY-SA 4.0
2021-05-14T10:17:39.627Z
Not at all, this is optional. Whatever "chain based" protocol, no matter if it's  PoS or PoW can be used as a fallback protocol to automatically restart the network in "non-BFT mode" in an extreme situation like that. But this is optional, using committees (a random subset of validators to validate each block) even if 99% of validators go offline the network still can continue in "BFT mode" because at some point there will be a subset of validators in which 2/3 of them are online. Inactivity penalties will drain the deposits of the other validators so the network self-heal automatically.
Tux
CC BY-SA 4.0
2021-03-05T11:29:53.157Z
2021-03-05T11:29:53.157Z
Tux
<p>In addition to other answers, Bitcoin investors would also like to have a very conservative approach to updating bitcoin. Messing with the core idea will increase the perceived risk for something wanting to be a store of value.</p>

CC BY-SA 4.0
2021-01-16T23:10:12.160Z
2021-01-16T23:10:12.160Z
Bitcoingraffiti
<p>Proof of stake just doesn't work the same as mining from an economic incentive standpoint.</p>
<p>Miners make real-world investments, in advance, in equipment that becomes less valuable as difficulty increases.</p>
<p>Miners have no guarantee that their investment will pay off, they merely have a probability of finding a good proof of work.</p>
<p>Staking chains are vulnerable to new attacks, like &quot;long range&quot; attacks, &quot;fake stake&quot; attacks, etc.  Staking is just as easy to pool and manipulate as mining.</p>
<p>Proof of stake systems have some good solutions, but they aren't all solved. Until they are solved, Bitcoin definitely won't transition.</p>
<p>A more realistic transition would be to a proof-of-burn, where a p2sh burn is locked to a height, and gets you a decaying probability of being able to mine some future block.</p>

CC BY-SA 4.0
2021-02-23T17:45:57.620Z
2021-02-23T17:45:57.620Z
Erik Aronesty
<p>Proof of Stake is basically a case of having your cake and eating it, too.</p>
<p>PoW is a simple work-around to a coordination problem that was previously thought to be unsolvable. It sort of &quot;cheats&quot; by providing an economic solution to a distributed systems challenge, by introducing a real cost as a disincentive to unwanted behavior as well as using a reward system both to bootstrap itself and to incentivize security. The advantages of Bitcoin's PoW system include that the group of block authors is truly open to anyone with computational resources, that the system converges on one ground-truth because there is a real cost in producing a competing chaintip, and that it is simple enough for its security model to be well understood.</p>
<p>PoS is more similar to the approaches that were pursued before the publication of Bitcoin. PoS is naturally divergent as there is no real cost in staking. The &quot;Nothing at Stake problem&quot; allows stakers to work on multiple chaintips and only publish the next block from the chain most favorable to them. There are different ways of approaching the vastly different security model of PoS.</p>
<p><a href="https://i.sstatic.net/bWZYl.png" rel="noreferrer"><img src="https://i.sstatic.net/bWZYl.png" alt="&quot;Casper summany: FIx stuff with Staking. FIx the problems in that with bonding and checkpoints. Fix problems with that with being fuzzily forgiving about slashing. Make it all 'rigorous' by doing real proofs of something somewhere&quot; – Bram Cohen" /></a><br />
<sub>Source: <a href="https://twitter.com/bramcohen/status/956263457392795648" rel="noreferrer">Bram Cohen describing ETH's PoS research</a></sub></p>
<p>For example, ETH's effort to switch to PoS has been in research since at least 2015.
The latest I've read, ETH's current PoS proposal piles multiple layers of complexity on top of the staking to achieve convergence. Stakers have to register as &quot;Validators&quot; of which there are a limited number, put up a sizeable collateral that can be slashed in retaliation for misbehavior, and additionally maintain frozen capital to stake in the first place. More mitigations are in place to punish validator malfunction and recover the system from such breakdowns.</p>
<p>Other approaches to and issues with PoS include:</p>
<ul>
<li>Some systems introduce a central party that rubberstamps the latest block (e.g. Peercoin). A central coordinating party costs the system its censorship resistance.</li>
<li>It's difficult to fairly launch a PoS system since stakers have to hold funds in the system to author blocks. Many PoS systems get either started as airdrops, Initial Coin Offerings (ICOs), or a proof of burn auction.</li>
<li>Staking requires some representation of the private key to be online at all times, which may mean that it is easier to redirect some of the staking power (in early PoS systems it had to be the actual private key, so not only staking power but actual funds could get stolen). Not participating in staking means that your share in the monetary supply is being inflated away.</li>
<li>Some systems require coins to have a certain amount of confirmations before being allowed to be used for staking, so spending funds interrupts your staking revenue.</li>
<li>Some people expect that <a href="https://medium.com/@bendavenport/a-stake-to-the-heart-57fcd8ec323b" rel="noreferrer">staking revenue will be taxed differently than mining revenue</a>.</li>
<li>Some PoS systems can be gamed for profit by trying a vast number of block candidates to cause the staker to get blocks more often than their stake should qualify them for. Such an incentive may turn such PoS systems just into PoW schemes under the hood.</li>
<li>Some researchers argue that <a href="https://download.wpsoftware.net/bitcoin/pos.pdf" rel="noreferrer">&quot;by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value&quot;</a>.</li>
</ul>
<p>So, while the Ethereum Foundation keeps giving (and missing) new <a href="https://twitter.com/martybent/status/896775534658686979" rel="noreferrer">delivery dates</a> for an incomplete research project, there seems to be less interest among Bitcoin contributors to discuss Rube Goldberg contraptions.</p>
<p>And then, beyond the general skepsis for PoS, it wouldn't be feasible to just switch to it:</p>
<blockquote>
<p>&quot;Even if there somehow was a workable solution that had desirable
properties and security proofs, it would be working under a vastly
different security model than PoW… and nobody can just decide to make
such a change without enormous community consensus for such an
invasive change.&quot;  –Pieter Wuille</p>
</blockquote>

CC BY-SA 4.0
2020-04-20T08:08:00.877Z
Thanks a lot for the great explanation! So, for what I can conclude from your post, PoS is interesting in theory, but very hard to implement into practice because of its divergent nature, which leads to the need of extra layers on the protocol, which also means more complex mechanism and therefore less secure/efficient?
Oscar Serna
CC BY-SA 4.0
2020-04-20T08:20:17.370Z
I still think there is something the Bitcoin community has to do about the high cost for transactions. This specially true for small-amount transactions due to the way that the transaction cost is calculated.
Oscar Serna
CC BY-SA 4.0
2020-04-20T15:13:56.120Z
@OscarSerna that's about it. I think the answer could have emphasised that POW is also the only way to bootstrap the system. Proof of stake would not work at the start when there's nothing of value to stake.
csiz
CC BY-SA 4.0
2020-04-20T15:17:55.863Z
@OscarSerna to reply to your second comment. Proof of stake doesn't solve high transaction costs; that is controlled by the transaction limit and desire of people to have their transactions finalised soon. To fix that you need to get logarithmic scaling with transactions. Ethereum's solution to that is sharding, which is a different beast than POS; but equally complex.
csiz
CC BY-SA 4.0
2020-04-20T15:37:11.543Z
Thanks a lot for your answer. Very interesting topics to study.
Oscar Serna
CC BY-SA 4.0
2020-04-20T20:42:33.197Z
@OscarSerna The cost of transactions is solved by increasing block size to allow more transactions to fit into a block. The cost of mining is nearly constant regardless of block size, so allowing more transaction in a block means each transaction can have a smaller fee without changing the reward for mining the block. However, increasing the block size requires a hard fork, which is why Bitcoin Cash (BCH) was created.
Paul
CC BY-SA 4.0
2020-04-20T22:43:37.127Z
@PedroLobito: I've turned the example paragraph into a bullet list instead. That might make it a bit clearer.
Murch
CC BY-SA 4.0
2020-04-20T22:45:14.020Z
OscarSerna: The transaction cost is not closely related to the consensus mechanism as csiz explained.
Murch
CC BY-SA 4.0
2020-04-21T02:00:15.087Z
@OscarSerna Lightning networks solves transaction cost issue for small transactions so much so that it makes transactions at the Wei level economically feasible. But it comes with its own set of issues. Lightning network is live now though and you can use it to send real Bitcoins
slebetman
CC BY-SA 4.0
2020-04-21T13:26:08.373Z
@slebetman As far as my understanding goes, the lightning network only solves the problem for a small segment of the cases of use of Bitcoin since it's only useful when you are planning ahead on transacting several times with the same peer in the future. The lightning network is very good, but doesn't solve the problem of high fees on transactions for the most common scenarios like dealing with mostly unrepeated peers, or simply not having the funds to lock up in a channel for future use. I agree that it is a good step forward though.
Oscar Serna
CC BY-SA 4.0
2020-04-21T14:12:25.037Z
The lightning network allows you to send payments to any other participant it can find a route to. It does work better for small payments, though. See for example https://bitcoin.stackexchange.com/q/43700/5406
Murch
CC BY-SA 4.0
2020-04-21T19:59:23.090Z
@OscarSerna Your understanding is wrong. You are focusing too much on the mechanism (debt passed to your neighbor in the lightning network) instead of the actual transaction (payment reaching your target). Lightning network works by passing debt around and then consolidate all debt transactions into a single bitcoin transaction when you close the network. As such as long as you are on the lightning network payments cost almost nothing (which is why payments of merely 1 Wei makes sense on Lightning). You don't need to plan ahead, all you need is just both you and the receiver be on the network
slebetman
CC BY-SA 4.0
2020-04-21T20:02:25.117Z
@OscarSerna .. there's nothing that says you need to open the lightning network when you want to do the payment and close the lightning network once you've done the payment. You can open it as long as you like. You can spend bitcoins on the lightning network for as long as you haven't closed the network but those bitcoins cannot be spent on the main bitcoin blockchain. Once you close the network you can no longer spend those bitcoins on the lightning network but you can now spend it on the bitcoin blockchain. Think of it like a prepaid card for bitcoin
slebetman
CC BY-SA 4.0
2020-04-22T01:14:02.947Z
Ok got it. Thanks a lot for your reply @slebetman . I guess I had it all messed up about the lightning network. I am currently developing my own tools for Bitcoin in Python, and I haven't made it there yet, so now I'm looking forward to start coding the lightning network as my next step.
Oscar Serna
CC BY-SA 4.0
2023-05-09T19:53:19.740Z
Passing by, i wanted to make an edit mentioning you may also be penalized for not being available. It's worth mentioning given of the pervert incentives this may create. Source: https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/rewards-and-penalties/#penalties. *(But for some reason i cannot edit this answer.)*
Antoine Poinsot
CC BY-SA 4.0
2020-04-19T16:58:38.100Z
2021-05-19T11:20:44.517Z
2021-05-19T11:20:44.517Z
Murch
<p>After reading a little bit about different consensus algorithms, I am just trying to understand why Bitcoin still uses proof-of-work. This consensus algorithm being exponentially expensive, and resource intensive, doesn't it make more sense for Bitcoin --the most expensive cryptocurrency out there-- to migrate to proof-of-stake?</p>

<p>Currently, Bitcoin transactions are so expensive that day-to-day transactions, like buying a cup of coffee, can be more expensive than the good/service itself in some parts of the world, which fails to deliver one of the original goals of Bitcoin. That is to be the common person's every-day money.</p>

<p>Why does Bitcoin stick to the proof-of-work consensus algorithm?</p>

CC BY-SA 4.0
2020-04-20T12:13:23.037Z
Was everyday use ever really a goal of Bitcoin? The number of transactions it can process per hour is hard-limited by its design. Either Satoshi Nakamoto didn't understand the order of magnitude of the world financial system or replacing it was never the intention.
Philipp
CC BY-SA 4.0
2020-04-20T15:04:08.687Z
According to the whtepaper, everyday use was the goal. At the time when the limit was introduced the number of transactions was order of magnitudes lower; and the code was basically in the alpha/prototype stages. I'm sure replacing the limit was the intention, but Satoshi didn't know of a viable solution.
csiz
CC BY-SA 4.0
2020-04-20T21:41:15.433Z
@Philipp Scaling to everyday use is clearly a difficult task, but its worth noting that on-chain transactions per second =/= payments per second. Finding nuanced ways to create bitcoin transactions which allow us to pack a huge number of payments into a single on-chain transaction is an interesting approach that may be viable. The lightning network is an example of this.
chytrik
CC BY-SA 4.0
2020-04-23T06:35:13.060Z
Oh, I thought micro transactions are the most important application of Bitcoin.
Volker Siegel
CC BY-SA 4.0
2021-05-19T11:40:52.950Z
@VolkerSiegel: In the past few years, the store of value use case has been emerging as the dominant application. Small payments are in the process of moving to second layer systems.
Murch
CC BY-SA 4.0
2023-09-01T18:20:33.660Z
https://www.google.com/amp/s/techcrunch.com/2022/09/15/ethereum-switches-to-proof-of-stake-consensus-after-completing-the-merge/amp/
Obie 2.0
<proof-of-work><proof-of-stake><energy-consumption>
Why doesn't Bitcoin migrate to proof-of-stake?
Oscar Serna
# Why doesn't Bitcoin migrate to proof-of-stake?

(Asked by: username_0 on 2020-04-19)

After reading a little bit about different consensus algorithms, I am just trying to understand why Bitcoin still uses proof-of-work. This consensus algorithm being exponentially expensive, and resource intensive, doesn't it make more sense for Bitcoin --the most expensive cryptocurrency out there-- to migrate to proof-of-stake?

Currently, Bitcoin transactions are so expensive that day-to-day transactions, like buying a cup of coffee, can be more expensive than the good/service itself in some parts of the world, which fails to deliver one of the original goals of Bitcoin. That is to be the common person's every-day money.

Why does Bitcoin stick to the proof-of-work consensus algorithm?

**Tags:** proof-of-work, proof-of-stake, energy-consumption

> **Comments:**
> **username_1**: Was everyday use ever really a goal of Bitcoin? The number of transactions it can process per hour is hard-limited by its design. Either Satoshi Nakamoto didn't understand the order of magnitude of the world financial system or replacing it was never the intention.  
> **username_2**: According to the whtepaper, everyday use was the goal. At the time when the limit was introduced the number of transactions was order of magnitudes lower; and the code was basically in the alpha/prototype stages. I'm sure replacing the limit was the intention, but Satoshi didn't know of a viable solution.  
> **username_3**: @username_1 Scaling to everyday use is clearly a difficult task, but its worth noting that on-chain transactions per second =/= payments per second. Finding nuanced ways to create bitcoin transactions which allow us to pack a huge number of payments into a single on-chain transaction is an interesting approach that may be viable. The lightning network is an example of this.  
> **username_4**: Oh, I thought micro transactions are the most important application of Bitcoin.  
> **username_5**: @username_4: In the past few years, the store of value use case has been emerging as the dominant application. Small payments are in the process of moving to second layer systems.  
> **username_6**: https://www.google.com/amp/s/techcrunch.com/2022/09/15/ethereum-switches-to-proof-of-stake-consensus-after-completing-the-merge/amp/  

---

## 6 answers

### Answer by username_5 on 2020-04-19. Score: 46 | Accepted answer

Proof of Stake is basically a case of having your cake and eating it, too.

PoW is a simple work-around to a coordination problem that was previously thought to be unsolvable. It sort of "cheats" by providing an economic solution to a distributed systems challenge, by introducing a real cost as a disincentive to unwanted behavior as well as using a reward system both to bootstrap itself and to incentivize security. The advantages of Bitcoin's PoW system include that the group of block authors is truly open to anyone with computational resources, that the system converges on one ground-truth because there is a real cost in producing a competing chaintip, and that it is simple enough for its security model to be well understood.

PoS is more similar to the approaches that were pursued before the publication of Bitcoin. PoS is naturally divergent as there is no real cost in staking. The "Nothing at Stake problem" allows stakers to work on multiple chaintips and only publish the next block from the chain most favorable to them. There are different ways of approaching the vastly different security model of PoS.

[!["Casper summany: FIx stuff with Staking. FIx the problems in that with bonding and checkpoints. Fix problems with that with being fuzzily forgiving about slashing. Make it all 'rigorous' by doing real proofs of something somewhere" – Bram Cohen](https://i.sstatic.net/bWZYl.png)](https://i.sstatic.net/bWZYl.png)  
Source: [Bram Cohen describing ETH's PoS research](https://twitter.com/bramcohen/status/956263457392795648)

For example, ETH's effort to switch to PoS has been in research since at least 2015.
The latest I've read, ETH's current PoS proposal piles multiple layers of complexity on top of the staking to achieve convergence. Stakers have to register as "Validators" of which there are a limited number, put up a sizeable collateral that can be slashed in retaliation for misbehavior, and additionally maintain frozen capital to stake in the first place. More mitigations are in place to punish validator malfunction and recover the system from such breakdowns.

Other approaches to and issues with PoS include:

* Some systems introduce a central party that rubberstamps the latest block (e.g. Peercoin). A central coordinating party costs the system its censorship resistance.
* It's difficult to fairly launch a PoS system since stakers have to hold funds in the system to author blocks. Many PoS systems get either started as airdrops, Initial Coin Offerings (ICOs), or a proof of burn auction.
* Staking requires some representation of the private key to be online at all times, which may mean that it is easier to redirect some of the staking power (in early PoS systems it had to be the actual private key, so not only staking power but actual funds could get stolen). Not participating in staking means that your share in the monetary supply is being inflated away.
* Some systems require coins to have a certain amount of confirmations before being allowed to be used for staking, so spending funds interrupts your staking revenue.
* Some people expect that [staking revenue will be taxed differently than mining revenue](https://medium.com/@bendavenport/a-stake-to-the-heart-57fcd8ec323b).
* Some PoS systems can be gamed for profit by trying a vast number of block candidates to cause the staker to get blocks more often than their stake should qualify them for. Such an incentive may turn such PoS systems just into PoW schemes under the hood.
* Some researchers argue that ["by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value"](https://download.wpsoftware.net/bitcoin/pos.pdf).

So, while the Ethereum Foundation keeps giving (and missing) new [delivery dates](https://twitter.com/martybent/status/896775534658686979) for an incomplete research project, there seems to be less interest among Bitcoin contributors to discuss Rube Goldberg contraptions.

And then, beyond the general skepsis for PoS, it wouldn't be feasible to just switch to it:

> "Even if there somehow was a workable solution that had desirable
> properties and security proofs, it would be working under a vastly
> different security model than PoW… and nobody can just decide to make
> such a change without enormous community consensus for such an
> invasive change." –Pieter Wuille

> **Comments:**
> **username_0**: Thanks a lot for the great explanation! So, for what I can conclude from your post, PoS is interesting in theory, but very hard to implement into practice because of its divergent nature, which leads to the need of extra layers on the protocol, which also means more complex mechanism and therefore less secure/efficient?  
> **username_0**: I still think there is something the Bitcoin community has to do about the high cost for transactions. This specially true for small-amount transactions due to the way that the transaction cost is calculated.  
> **username_2**: @username_0 that's about it. I think the answer could have emphasised that POW is also the only way to bootstrap the system. Proof of stake would not work at the start when there's nothing of value to stake.  
> **username_2**: @username_0 to reply to your second comment. Proof of stake doesn't solve high transaction costs; that is controlled by the transaction limit and desire of people to have their transactions finalised soon. To fix that you need to get logarithmic scaling with transactions. Ethereum's solution to that is sharding, which is a different beast than POS; but equally complex.  
> **username_0**: Thanks a lot for your answer. Very interesting topics to study.  
> **username_13**: @username_0 The cost of transactions is solved by increasing block size to allow more transactions to fit into a block. The cost of mining is nearly constant regardless of block size, so allowing more transaction in a block means each transaction can have a smaller fee without changing the reward for mining the block. However, increasing the block size requires a hard fork, which is why Bitcoin Cash (BCH) was created.  
> **username_5**: @PedroLobito: I've turned the example paragraph into a bullet list instead. That might make it a bit clearer.  
> **username_5**: username_0: The transaction cost is not closely related to the consensus mechanism as username_2 explained.  
> **username_14**: @username_0 Lightning networks solves transaction cost issue for small transactions so much so that it makes transactions at the Wei level economically feasible. But it comes with its own set of issues. Lightning network is live now though and you can use it to send real Bitcoins  
> **username_0**: @username_14 As far as my understanding goes, the lightning network only solves the problem for a small segment of the cases of use of Bitcoin since it's only useful when you are planning ahead on transacting several times with the same peer in the future. The lightning network is very good, but doesn't solve the problem of high fees on transactions for the most common scenarios like dealing with mostly unrepeated peers, or simply not having the funds to lock up in a channel for future use. I agree that it is a good step forward though.  
> **username_5**: The lightning network allows you to send payments to any other participant it can find a route to. It does work better for small payments, though. See for example https://bitcoin.stackexchange.com/q/43700/5406  
> **username_14**: @username_0 Your understanding is wrong. You are focusing too much on the mechanism (debt passed to your neighbor in the lightning network) instead of the actual transaction (payment reaching your target). Lightning network works by passing debt around and then consolidate all debt transactions into a single bitcoin transaction when you close the network. As such as long as you are on the lightning network payments cost almost nothing (which is why payments of merely 1 Wei makes sense on Lightning). You don't need to plan ahead, all you need is just both you and the receiver be on the network  
> **username_14**: @username_0 .. there's nothing that says you need to open the lightning network when you want to do the payment and close the lightning network once you've done the payment. You can open it as long as you like. You can spend bitcoins on the lightning network for as long as you haven't closed the network but those bitcoins cannot be spent on the main bitcoin blockchain. Once you close the network you can no longer spend those bitcoins on the lightning network but you can now spend it on the bitcoin blockchain. Think of it like a prepaid card for bitcoin  
> **username_0**: Ok got it. Thanks a lot for your reply @username_14 . I guess I had it all messed up about the lightning network. I am currently developing my own tools for Bitcoin in Python, and I haven't made it there yet, so now I'm looking forward to start coding the lightning network as my next step.  
> **username_15**: Passing by, i wanted to make an edit mentioning you may also be penalized for not being available. It's worth mentioning given of the pervert incentives this may create. Source: https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/rewards-and-penalties/#penalties. *(But for some reason i cannot edit this answer.)*  

---

### Answer by username_7 on 2020-04-20. Score: 21

I think there are at least four reasons:

1. The miners are stakeholders in the bitcoin ecosystem. Mining solves a problem for them. Taking away PoW mining would make bitcoin no longer work for one of its most important group of stakeholders.
2. Non-miners are in bitcoin because they like what bitcoin is. If they want some other consensus scheme, they know where to find it. There is certainly room in the market for at least one PoW chain and that's what bitcoin is.
3. Major changes impose costs on every participant in the ecosystem. Every implementation has to implement the new rules. Everyone has to test that the new stuff doesn't break anything they're relying on.
4. There isn't a consensus in the community that PoS can provide the same level of security as PoW at lower cost. That's the claim PoS advocates make, but it's far from an accepted truth.

> **Comments:**
> **username_8**: A thing that is not clear still to me is why in PoS, forks occur? I would appreciate any comment or answer to this related question: https://ethereum.stackexchange.com/q/87553/23024 Thanks  

---

### Answer by username_3 on 2020-04-19. Score: 14

I think there are some very convincing theoretical arguments to be made, but there is also just a very practical consideration:

Right now, a very large portion of BTC is being held in the cold wallets of popular exchange platforms. Hardcore bitcoiners will shake their heads and declare *"Not your keys, not your coins!"*, but this apparently has not stopped traders and normal users alike from keeping their coins stored with a custodial third party. Looking at the ['bitcoin rich list'](https://bitcoin.stackexchange.com/questions/91242/bitcoin-rich-list-reliable-or-not/91243#91243), we can confirm the huge number of coins held by exchanges.

This fact would put exchange operators in an undue position of power over the network: **by staking coins owned by their users, the exchange operators can obtain a large, centralized point of control over the network's consensus operations.**

There are already risks present when allowing a third party custodian to manage your coins/private keys, **but switching to a POS system adds an entirely new and very serious type of risk!** This is a very serious risk because it is existential in nature: if an exchange operator were to abuse their control of this huge number of coins somehow (by staking maliciously in some way or another), it would affect every user of the system, not just the users of that exchange.

This problem is only amplified by the fact that you have to not only trust the exchange operators to not act maliciously, you also have to trust them to secure their system against theft and intrusion. It is bad enough when hackers steal funds, giving hackers the ability to attack the network consensus as well is, in my opinion, an untenable addition of risk.

In case you aren't convinced: This risk is not theoretical, an attack like this recently happened on an altcoin network (Steem, mid-late Feb 2020). It appears that exchanges colluded to stake the coins they held custody of, in an effort to disrupt network consensus. A quick websearch [brings this article about it up](https://cryptocoingrowth.com/2020/03/02/steem-goes-down-after-major-exchanges-hijack-consensus-mechanism/).

> **Comments:**
> **username_9**: I do not think that the Steem scenario is very realistic for BTC; it started with a single exchange being dominant, and the Steem story highlights that this would ultimately kill the entire ecosystem of the coin in question. BTC had a similar problem in the past, where a majority of miners would in located in China; after some discussion, the Chinese miners agrees to stay well below 50% because they knew that BTC could break down anytime if they continued to grow, losing more than they could gain from growing.  
> **username_0**: This is a really interesting theory. I also think that username_9 is right about ecosystem regulating itself. Some good game theory applied here. Thanks for enriching the thread.  
> **username_3**: @username_9 right, it is a different situation, but I think this is still a foundational problem that is slightly different than miner centralization: With PoW, every effort is made to ensure the protocol does not favour or promote miner centralization. With PoS, centralization of coins seems unavoidable (exchanges hold a huge portion, and the fact that 'the rich get richer' under PoS only exacerbates this). Additionally, a hacker that steals coins could attack and incur almost no cost (other than lost value of the stolen coins), the same cannot happen in PoW.  
> **username_9**: I am not so sure about that "the rich get richer" aspect of PoS. If it's proportional to the amount held, the minting reward will be distributed accordint to the current money distribution and relative wealth remains unchanged. This changes if you have to allocate your money for PoS - the poor won't be able to allocate anything, and the rich will want to keep their money in cold wallets; I don't know how this plays out in practice.  

---

### Answer by username_10 on 2021-03-05. Score: 5

Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition. Most people that don't like PoS are thinking in "vanilla" or "chain based" PoS protocols which are certainly more insecure than PoW.

Ethereum 2.0 is using Casper currently in the Beacon Chain, and other coins are also using BFT PoS protocols. I will try to resume BFT PoS in a few lines:

* Each block must be signed by 2/3 of validators based on staking power. That provides absolute finality in just one block.
* There is a penalty system that punish evil behavior or validator inactivity which makes it MUCH MORE secure than PoW. If you sign 2 blocks with the same height, that's evil behavior and your staking deposit is burned automatically. If 1/3 of validators are inactive and the network halts, the penalty system start to burn slowly the deposits until the network can restart.
* Even if you have 99,9% of staking power you can't censor transactions for free because as far there is a single honest validator in the network he will include the transaction you want to censor in his block. If the attacker doesn't want to sign the block of the honest validator, his staking deposit receives a small percent of penalty, but a small percent of millions of dollars is too much money. The honest validator receives also a penalty, but his deposit is small so it's not a problem.
* If somehow the attacker has ALL staking power and start to censor for free and don't allow other validators register their staking deposits to create blocks, the community as a whole would agree to burn all staking deposits and restart the network, which makes every coin holder much richer than before.

Regards

> **Comments:**
> **username_3**: re: *"Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition."* - that is a bold claim, for example see this review of the CBC Casper protocols: https://medium.com/@muneeb/peer-review-cbc-casper-30840a98c89a. Quote from their conclusion: *"Importantly, it remains unclear if the definition of the Casper protocol family provides any meaningful safety guarantees for blockchains, or if this approach is applicable to scaling blockchains at all."*  
> **username_10**: Casper is a mix of of 2 protocols: a BFT PoS protocol (Casper FFG) and a "chain based" PoS protocol (Casper CBC). It looks this paper ignores completely Casper FFG, which is the most important part of the protocol as it provides absolute finality. The protocol could be even simpler: a classic BFT consensus (2/3 of validators must sign each block), with the typical penalty system for inactivity (light penalty) or evil behaviour like double-signing blocks with the same height (burn the deposit of the attacker). If the network gets halted due to many nodes being unavailable the network can ...  
> **username_10**: ... automatically revert to PoW  consensus after a timeout. This is very simple and could be implemented in Bitcoin without any risk. There are variations about this concept like using commitees of validators, but the simplest version could work very well with Bitcoin.  
> **username_10**: Note also that Bitcoin has 10 minutes blocks, so the bandwidth overhead of using so many signatures per block is not important. Using a protocol like this we could have 1 minute blocks, and absolute finality in 1 block. It's too good to be ignored, I hope Bitcoin developers finally implement it.  
> **username_3**: re: *”...if the network gets halted due to too many nodes being unavailable the network can automatically revert to proof of work”* - it is perhaps quite telling that PoW is the proposed solution to the shortcomings of PoS.  
> **username_10**: Not at all, this is optional. Whatever "chain based" protocol, no matter if it's  PoS or PoW can be used as a fallback protocol to automatically restart the network in "non-BFT mode" in an extreme situation like that. But this is optional, using committees (a random subset of validators to validate each block) even if 99% of validators go offline the network still can continue in "BFT mode" because at some point there will be a subset of validators in which 2/3 of them are online. Inactivity penalties will drain the deposits of the other validators so the network self-heal automatically.  

---

### Answer by username_11 on 2021-01-16. Score: 1

In addition to other answers, Bitcoin investors would also like to have a very conservative approach to updating bitcoin. Messing with the core idea will increase the perceived risk for something wanting to be a store of value.


---

### Answer by username_12 on 2021-02-23. Score: 0

Proof of stake just doesn't work the same as mining from an economic incentive standpoint.

Miners make real-world investments, in advance, in equipment that becomes less valuable as difficulty increases.

Miners have no guarantee that their investment will pay off, they merely have a probability of finding a good proof of work.

Staking chains are vulnerable to new attacks, like "long range" attacks, "fake stake" attacks, etc. Staking is just as easy to pool and manipulate as mining.

Proof of stake systems have some good solutions, but they aren't all solved. Until they are solved, Bitcoin definitely won't transition.

A more realistic transition would be to a proof-of-burn, where a p2sh burn is locked to a height, and gets you a decaying probability of being able to mine some future block.


---

