<p>Every hash attempt, regardless of who does it, or what difficulty it occurs at, is an independent evaluation of a hash function, resulting in a number uniformly distributed between <em>0</em> and <em>2<sup>256</sup> - 1</em>.</p>
<p>Now consider the distribution of the <em>minimum</em> of <em>N</em> independent samples. See <a href="https://math.stackexchange.com/questions/786392/expectation-of-minimum-of-n-i-i-d-uniform-random-variables">this question</a> for a derivation, but the result is that the average of that distribution is approximately <em>2<sup>256</sup> / (N+1)</em>.</p>
<p>This gives an intuition about the relation between the smallest observed hash and the number of hashes performed: on average, the minimum will scale approximately proportional to <em>1 / (N+1)</em> with <em>N</em> performed hashes.</p>
<p>The statistical tool for estimating <em>N</em> from the observation is called likelihood estimation: we have a probability distribution with unknown parameter <em>N</em>, and make one observation from that distribution. That distribution of the minimum of <em>N</em> hashes (if we simplify it a bit by turning the output of hashing into a continuous real function, uniformly distributed over <em>[0, 2<sup>256</sup>]</em>), has probability density function <em>f<sub>N</sub>(x) = N(1-x/2<sup>256</sup>)<sup>N-1</sup></em>. Given an observation <em>min_hash</em>, the value for <em>N</em> that maximizes <em>f<sub>N</sub>(min_hash)</em> (the <a href="https://en.wikipedia.org/wiki/Maximum_likelihood_estimation" rel="nofollow noreferrer">maximum likelihood estimator</a>) is <em>-1 / log(1 - min_hash/2<sup>256</sup>)</em>. For small values of <em>min_hash</em>, that expression is closely approximated by <em>2<sup>256</sup>/x - 1/2</em>.</p>

CC BY-SA 4.0
2021-06-06T19:20:21.273Z
2021-06-07T06:06:19.777Z
2021-06-07T06:06:19.777Z
Pieter Wuille
<p>Proof-of-work as used in Bitcoin relies on finding low hashes, in other words finding hashes that begin with a certain number of zeros. To find a hash whose binary representation starts with 30 zeros, you would need to do, on average, 2^30 attempts. When you find this hash and present it, it is a proof that you have actually done about as much work. And it works both ways, when you perform 2^30 attempts, the lowest hash you will end up with will start with roughly 30 zeros.</p>
<p>Importantly, this works on any scale. The smallest block hash I could find starts with 23 hexadecimal zeros, or 92 binary zeros, which shows that the network has calculated around 2^92 hashes in its existence.</p>
<p>If you want to see it even more intuitively, check out <a href="https://bitcoin.stackexchange.com/a/105023">this answer</a> from a different thread that shows how the number of zeros in the lowest ever hash has been rising over time.</p>

CC BY-SA 4.0
2021-06-06T08:41:47.133Z
2021-06-06T08:41:47.133Z
Vojtěch Strnad
<p>If not mathematically (I imagine the proof might be quite rigorous), could you please provide an intuitive explanation for why the lowest hash ever found tells approximates the total amount of work ever done on the system? Source: <a href="https://youtu.be/zYzEmBlJ77s?t=4720" rel="nofollow noreferrer">https://youtu.be/zYzEmBlJ77s?t=4720</a></p>
<p>My thinking: We can figure out the probability of finding a hash that is lower than the hash we found. From there, we can find the &quot;mid-point&quot; of a distribution for how many attempts it would take to find such a hash. So it just gives you a point on a distribution.</p>
<p>Thank you!</p>

<hash>
How can we derive all work ever done on the system from the lowest hash ever found?
Bob
# How can we derive all work ever done on the system from the lowest hash ever found?

(Asked by: username_0 on 2021-06-06)

If not mathematically (I imagine the proof might be quite rigorous), could you please provide an intuitive explanation for why the lowest hash ever found tells approximates the total amount of work ever done on the system? Source: <https://youtu.be/zYzEmBlJ77s?t=4720>

My thinking: We can figure out the probability of finding a hash that is lower than the hash we found. From there, we can find the "mid-point" of a distribution for how many attempts it would take to find such a hash. So it just gives you a point on a distribution.

Thank you!

**Tags:** hash


---

## 2 answers

### Answer by username_1 on 2021-06-06. Score: 5

Every hash attempt, regardless of who does it, or what difficulty it occurs at, is an independent evaluation of a hash function, resulting in a number uniformly distributed between *0* and *2256 - 1*.

Now consider the distribution of the *minimum* of *N* independent samples. See [this question](https://math.stackexchange.com/questions/786392/expectation-of-minimum-of-n-i-i-d-uniform-random-variables) for a derivation, but the result is that the average of that distribution is approximately *2256 / (N+1)*.

This gives an intuition about the relation between the smallest observed hash and the number of hashes performed: on average, the minimum will scale approximately proportional to *1 / (N+1)* with *N* performed hashes.

The statistical tool for estimating *N* from the observation is called likelihood estimation: we have a probability distribution with unknown parameter *N*, and make one observation from that distribution. That distribution of the minimum of *N* hashes (if we simplify it a bit by turning the output of hashing into a continuous real function, uniformly distributed over *[0, 2256]*), has probability density function *fN(x) = N(1-x/2256)N-1*. Given an observation *min\_hash*, the value for *N* that maximizes *fN(min\_hash)* (the [maximum likelihood estimator](https://en.wikipedia.org/wiki/Maximum_likelihood_estimation)) is *-1 / log(1 - min\_hash/2256)*. For small values of *min\_hash*, that expression is closely approximated by *2256/x - 1/2*.


---

### Answer by username_2 on 2021-06-06. Score: 2

Proof-of-work as used in Bitcoin relies on finding low hashes, in other words finding hashes that begin with a certain number of zeros. To find a hash whose binary representation starts with 30 zeros, you would need to do, on average, 2^30 attempts. When you find this hash and present it, it is a proof that you have actually done about as much work. And it works both ways, when you perform 2^30 attempts, the lowest hash you will end up with will start with roughly 30 zeros.

Importantly, this works on any scale. The smallest block hash I could find starts with 23 hexadecimal zeros, or 92 binary zeros, which shows that the network has calculated around 2^92 hashes in its existence.

If you want to see it even more intuitively, check out [this answer](https://bitcoin.stackexchange.com/a/105023) from a different thread that shows how the number of zeros in the lowest ever hash has been rising over time.


---

