<p>The downsides outweigh the upsides: as you mentioned this would require a hard fork, and would leave everyone (not just mining farms) who owns a Bitcoin miner with a very expensive paperweight, and as such it's unlikely a large enough portion of the community is willing to make the change for it to be successful. It would require throwing away a significant amount of infrastructure.</p>
<p>I suppose one day if it were to become a problem where Bitcoin miners are colluding to try and rewrite the blockchain or censor transactions, then we could reevaluate this. However, mining already comes with such razor-thin margins that it is extremely unlikely miners will be throwing away their profits to do this: they would all have to agree to work against their own best interests.</p>

CC BY-SA 4.0
2021-01-24T05:27:34.177Z
Furthermore, ASICs are inevitable. There are two types of PoW functions: those for which ASICs exist, and those for which it hasn't been economically viable yet to construct them. But in the end, given sufficient incentives to invest in the necessary R&D, custom-designed silicon is always going to be more power efficient than generic hardware. Resetting the PoW function is at best pushing the can a few years down the road, at the cost of an enormously invasive (and possibly divisive...) action that probably nobody could convince the ecosystem to take.
Pieter Wuille
CC BY-SA 4.0
2021-01-24T06:16:58.613Z
It’s additionally impossible to prevent the persons responsible for making the change to proof of work from pre-producing their own ASICs.
Claris
CC BY-SA 4.0
2021-01-24T13:44:28.597Z
Also, making a PoW function ASIC resistant would result in less ASIC designs being developed, due to the increased cost of ASIC design, increasing the centralizing effect of ASICs.
user1937198
CC BY-SA 4.0
2021-06-22T10:59:32.417Z
To add to Pieter's comment, Andrew Poelstra addresses this matter more at length there: https://diyhpl.us/~bryan/papers2/bitcoin/asic-faq.pdf .
Antoine Poinsot
CC BY-SA 4.0
2021-01-24T05:22:14.973Z
2021-01-24T05:22:14.973Z
ieatpizza
<p>ASIC-resistance is a mirage. <em>Application Specific Integrated Circuits</em> (ASICs) are made to do one thing only and will always beat general purpose hardware.</p>
<blockquote>
<p>&quot;General purpose computational devices like CPUs, GPUs, and even DRAM all make substantial compromises to their true potential in order to be useful for general computation.&quot;<br />
–David Vorick, <a href="https://blog.sia.tech/the-state-of-cryptocurrency-mining-538004a37f9b" rel="nofollow noreferrer">&quot;State of Cryptocurrency Mining&quot;</a></p>
</blockquote>
<p>As an &quot;ASIC-resistant&quot; cryptocurrency appreciates in value, eventually someone would find it economically viable to produce an ASIC. Given the high development cost and relatively lower increase in profitability, for an ASIC-resistant algorithm such a market would be even more likely to be dominated by a single producer.</p>
<p>Instead, consider the upsides of an ASIC-friendly hashing algorithm. ASICs beat general purpose hardware by magnitudes which quickly curbed botnets mining with CPU or GPU. As ASICs are the most efficient tools to turn power into security, similar dominance of all available hash rate to Bitcoin's security would take magnitudes more CPUs or GPUs at vastly worse energy efficiency. It's easier for manufacturers to enter the market, which opens production up to more competition. Since the hardware is network specific, miners cannot hop networks to pursue every tiny shift in relative profitability, resulting in a more stable hash rate. Due to the upfront cost of the hardware, miners are—quite literally—invested in the success of the network.</p>
<p>After over a decade, ASICs have caught up to state-of-the-art miniaturization. Product cycles have slowed down. This reduces the advantage of mining operators with close ties to manufacturers, as the longer lifespan of hardware allows it to spread further geographically. When machines run longer, the initial hardware investment is smaller compared to the on-going energy costs which favors locations with cheap electricity. While China does have relatively cheap electricity, there are various regions with stranded energy due to abundant hydro, solar, or geothermal sources all across the globe. While previously most hash rate was situated in China, the recent crackdown on the Bitcoin mining industry there has expedited an already existing downward trend. Hopefully a lot of the currently migrating hash rate will show up in numerous different locales.</p>
<p>Finally, a change of the hashing algorithm would necessarily require a hard fork. Given the doubtful benefits, such a hard fork would be extremely controversial.</p>

CC BY-SA 4.0
2021-07-22T22:42:14.557Z
This ignores the possibility of proof of work functions which together form a Turing complete language.  An ASIC that could generate proofs for such work would be indistinguishable from a CPU.  Interim ASIC resistant functions would be useful as stepping stones towards this goal because they shift the attention of innovators from finding faster hardware to finding a more useful work function.
MatrixManAtYrService
CC BY-SA 4.0
2021-07-27T18:17:48.687Z
@MatrixManAtYrService: Your comment doesn't make sense to me since it is detrimental for proof of work functions to have additional purposes than generating proof of work. Also, an ASIC that can produce work equivalent to a CPU would need to be a general purpose computing chip, which directly contradicts that it would be optimized for the proof of work function.
Murch
CC BY-SA 4.0
2021-07-27T22:48:58.880Z
If you take it as axiomatic that proofs-of-arbitrary-work are significantly less secure than proofs-of-useless-work, then yeah: there's no reason to go looking for an instruction set for general computation that produces proofs-of-arbitrary-work as a side effect of doing that work.  But I don't see why that would be the case.  The work is still happening whether or not somebody wants it done, the complexity constraints that make it useful for the protocol are just as valid.
MatrixManAtYrService
CC BY-SA 4.0
2021-07-27T23:27:10.897Z
@MatrixManAtYrService: This topic collects some arguments why it's detrimental if PoW functions have secondary purposes: https://bitcoin.stackexchange.com/q/331/5406
Murch
CC BY-SA 4.0
2021-01-26T21:48:05.273Z
2021-06-22T13:15:43.063Z
2021-06-22T13:15:43.063Z
Murch
<p>Because ASICS are a good thing.</p>
<p>Do you really want the worlds most powerful sound money standard to be secured by script kiddies and botnets?</p>
<p>Bitcoin is growing up.</p>
<p>Dedicated hardware and big businesses are the future, not home-mining.</p>

CC BY-SA 4.0
2022-03-18T17:35:31.077Z
2022-03-18T17:35:31.077Z
Erik Aronesty
<p>Bitcoin uses a Proof of Work algorithm that makes it the perfect victim of ASIC mining. As a result, hash power is not very decentralized (more than 50% of Bitcoin's hash power is concentrated in China and most of that is concentrated in a small area). Furthermore, considering the fact that just a handful of companies produce efficient ASIC hardware, those companies essentially have complete control over the hashing power of the entire network.</p>
<p>Other algorithms have been developed that are memory intensive and are ASIC-resistant.</p>
<p>Is there a reason why Bitcoin won't move to ASIC-resistant algorithms (aside from the fact that it would require a hard fork)? In other words, do ASIC-prone algorithms fundamentally provide any benefit (in terms of security or scalability) over ASIC-resistant algorithms?</p>

<mining-theory><mining-profitability><proof-of-work><decentralization><asic-resistance>
Why is Bitcoin not moving to an ASIC-resistant Proof of Work algorithm?
S.O.S
# Why is Bitcoin not moving to an ASIC-resistant Proof of Work algorithm?

(Asked by: username_0 on 2021-01-24)

Bitcoin uses a Proof of Work algorithm that makes it the perfect victim of ASIC mining. As a result, hash power is not very decentralized (more than 50% of Bitcoin's hash power is concentrated in China and most of that is concentrated in a small area). Furthermore, considering the fact that just a handful of companies produce efficient ASIC hardware, those companies essentially have complete control over the hashing power of the entire network.

Other algorithms have been developed that are memory intensive and are ASIC-resistant.

Is there a reason why Bitcoin won't move to ASIC-resistant algorithms (aside from the fact that it would require a hard fork)? In other words, do ASIC-prone algorithms fundamentally provide any benefit (in terms of security or scalability) over ASIC-resistant algorithms?

**Tags:** mining-theory, mining-profitability, proof-of-work, decentralization, asic-resistance


---

## 3 answers

### Answer by username_1 on 2021-01-24. Score: 5

The downsides outweigh the upsides: as you mentioned this would require a hard fork, and would leave everyone (not just mining farms) who owns a Bitcoin miner with a very expensive paperweight, and as such it's unlikely a large enough portion of the community is willing to make the change for it to be successful. It would require throwing away a significant amount of infrastructure.

I suppose one day if it were to become a problem where Bitcoin miners are colluding to try and rewrite the blockchain or censor transactions, then we could reevaluate this. However, mining already comes with such razor-thin margins that it is extremely unlikely miners will be throwing away their profits to do this: they would all have to agree to work against their own best interests.

> **Comments:**
> **username_2**: Furthermore, ASICs are inevitable. There are two types of PoW functions: those for which ASICs exist, and those for which it hasn't been economically viable yet to construct them. But in the end, given sufficient incentives to invest in the necessary R&D, custom-designed silicon is always going to be more power efficient than generic hardware. Resetting the PoW function is at best pushing the can a few years down the road, at the cost of an enormously invasive (and possibly divisive...) action that probably nobody could convince the ecosystem to take.  
> **username_3**: It’s additionally impossible to prevent the persons responsible for making the change to proof of work from pre-producing their own ASICs.  
> **username_4**: Also, making a PoW function ASIC resistant would result in less ASIC designs being developed, due to the increased cost of ASIC design, increasing the centralizing effect of ASICs.  
> **username_5**: To add to username_2's comment, Andrew Poelstra addresses this matter more at length there: https://diyhpl.us/~bryan/papers2/bitcoin/asic-faq.pdf .  

---

### Answer by username_6 on 2021-01-26. Score: 5

ASIC-resistance is a mirage. *Application Specific Integrated Circuits* (ASICs) are made to do one thing only and will always beat general purpose hardware.

> "General purpose computational devices like CPUs, GPUs, and even DRAM all make substantial compromises to their true potential in order to be useful for general computation."  
> –David Vorick, ["State of Cryptocurrency Mining"](https://blog.sia.tech/the-state-of-cryptocurrency-mining-538004a37f9b)

As an "ASIC-resistant" cryptocurrency appreciates in value, eventually someone would find it economically viable to produce an ASIC. Given the high development cost and relatively lower increase in profitability, for an ASIC-resistant algorithm such a market would be even more likely to be dominated by a single producer.

Instead, consider the upsides of an ASIC-friendly hashing algorithm. ASICs beat general purpose hardware by magnitudes which quickly curbed botnets mining with CPU or GPU. As ASICs are the most efficient tools to turn power into security, similar dominance of all available hash rate to Bitcoin's security would take magnitudes more CPUs or GPUs at vastly worse energy efficiency. It's easier for manufacturers to enter the market, which opens production up to more competition. Since the hardware is network specific, miners cannot hop networks to pursue every tiny shift in relative profitability, resulting in a more stable hash rate. Due to the upfront cost of the hardware, miners are—quite literally—invested in the success of the network.

After over a decade, ASICs have caught up to state-of-the-art miniaturization. Product cycles have slowed down. This reduces the advantage of mining operators with close ties to manufacturers, as the longer lifespan of hardware allows it to spread further geographically. When machines run longer, the initial hardware investment is smaller compared to the on-going energy costs which favors locations with cheap electricity. While China does have relatively cheap electricity, there are various regions with stranded energy due to abundant hydro, solar, or geothermal sources all across the globe. While previously most hash rate was situated in China, the recent crackdown on the Bitcoin mining industry there has expedited an already existing downward trend. Hopefully a lot of the currently migrating hash rate will show up in numerous different locales.

Finally, a change of the hashing algorithm would necessarily require a hard fork. Given the doubtful benefits, such a hard fork would be extremely controversial.

> **Comments:**
> **username_7**: This ignores the possibility of proof of work functions which together form a Turing complete language.  An ASIC that could generate proofs for such work would be indistinguishable from a CPU.  Interim ASIC resistant functions would be useful as stepping stones towards this goal because they shift the attention of innovators from finding faster hardware to finding a more useful work function.  
> **username_6**: @username_7: Your comment doesn't make sense to me since it is detrimental for proof of work functions to have additional purposes than generating proof of work. Also, an ASIC that can produce work equivalent to a CPU would need to be a general purpose computing chip, which directly contradicts that it would be optimized for the proof of work function.  
> **username_7**: If you take it as axiomatic that proofs-of-arbitrary-work are significantly less secure than proofs-of-useless-work, then yeah: there's no reason to go looking for an instruction set for general computation that produces proofs-of-arbitrary-work as a side effect of doing that work.  But I don't see why that would be the case.  The work is still happening whether or not somebody wants it done, the complexity constraints that make it useful for the protocol are just as valid.  
> **username_6**: @username_7: This topic collects some arguments why it's detrimental if PoW functions have secondary purposes: https://bitcoin.stackexchange.com/q/331/5406  

---

### Answer by username_8 on 2022-03-18. Score: 0

Because ASICS are a good thing.

Do you really want the worlds most powerful sound money standard to be secured by script kiddies and botnets?

Bitcoin is growing up.

Dedicated hardware and big businesses are the future, not home-mining.


---

