The Day Bitcoin Erased Itself

On the afternoon of March 23, 2026, the Bitcoin network briefly forked in half, ran two competing versions of its own history in parallel for several minutes, and then deleted one of them. Three blocks of valid transactions, mined by real machines burning real electricity, were removed from the public ledger as if they had never existed. The miners who produced them got nothing. The transactions inside them went back into the queue to be mined again, by someone else, using more electricity. This is on the public record. It is documented in block-explorer data and was reported the next morning by CoinDesk and by the on-chain researcher 0xB10C, who first surfaced it on Twitter.

What happened in those few minutes is worth walking through carefully, because it is the clearest possible illustration of what the entire Bitcoin network is actually doing, all the time, in less visible form. The reorg made the waste visible. The rest of the time, the waste is just the design.

What Actually Happened At Block 941,881

At 15:49:35 UTC, Foundry USA broadcast a valid block to the network. Twelve seconds later, AntPool broadcast a different valid block. Both were legitimate. Both contained real Bitcoin transactions. Both had solved the cryptographic puzzle that the network requires. They had simply both found a solution at almost exactly the same moment, which is rare but not impossible, and is becoming less rare as a smaller number of large pools take a larger share of the global mining capacity.

The network is decentralized and propagates information across the world at the speed of light, but the speed of light still takes time. Nodes geographically closer to Foundry's announcement saw Foundry's block first and treated it as the next link in the chain. Nodes closer to AntPool saw AntPool's block first and treated theirs as canonical. The network was now running two different versions of history in parallel. Both were valid. Bitcoin's rule for this situation is straightforward: keep building, and whichever chain accumulates more proof-of-work first becomes the truth.

The next block went to ViaBTC, which extended AntPool's chain. The block after that went to Foundry, which extended its own. Two competing chains were now two blocks deep each. Real transactions worth real money sat on both sides. Then Foundry caught a streak. Block 941,883 went to Foundry. So did 941,884, 941,885, and 941,886. Their chain was now six blocks long. AntPool's chain was still only two. The network reorganized around Foundry's version. AntPool's two blocks and ViaBTC's one block, all three of them valid, all three of them representing minutes of real work by real machines, were orphaned. They were removed from the canonical chain. The transactions inside them went back into the mempool to be mined again later.

The miners pointed at AntPool's pool and ViaBTC's pool burned electricity for those three blocks. The pools paid out to those miners regardless, according to standard pool accounting, and absorbed the loss themselves. But the electricity is gone. It was converted to heat in industrial facilities and home garages across multiple continents, and the work that heat represented produced nothing.

Every Other Miner Did The Same Thing

Here is the part most coverage missed. The three orphaned blocks are not the whole story of wasted work that afternoon. They are the visible part. Every other miner who participated in the race to find blocks 941,881 through 941,886 also burned electricity. None of them won. The winner-take-all structure of proof-of-work means that for every block, one miner gets paid and every other miner who was racing for the same block gets nothing. The losers do not even appear on the chain. They are invisible.

The Bitcoin network currently runs at approximately 900 exahashes per second of total mining power. That is nine hundred quintillion guesses per second. A single block at the time of the reorg required, on average, the network to try roughly five hundred and forty sextillion candidate nonces before one of them produced a hash low enough to qualify. Every nonce that did not qualify was thrown away. Every miner that did not win the block was throwing away their guesses too. The energy that produced those guesses is gone. The only thing the network keeps from any given ten-minute interval is the single nonce that worked, in the single block that won. The rest of it heats the air.

This is the part of Bitcoin's design that the energy-waste arguments usually skip. The waste is not an accident or a side effect. The waste is the security. The Cambridge Centre for Alternative Finance estimates that the global Bitcoin network drew between 120 and 175 terawatt-hours of electricity in the past year. Digiconomist, using different methodology, puts the figure at about 176 terawatt-hours. The US Energy Information Administration's accepted range is 120 to 170. Pick whichever number you prefer. It is more than the annual electricity consumption of Norway, Argentina, or the Netherlands. The US share of that, about 132 gigawatt-hours per day, represents 1.1 percent of total US daily electricity demand. A country-scale electrical load is being spent, every day, on guesses that will be discarded the moment one of them works.

The economic model has held because the value of one winning guess has, historically, exceeded the cost of all the losing guesses combined. That margin has been narrowing. When Bitcoin traded at $65,000 earlier this year, the average cost in electricity alone to mine a single Bitcoin in the United States was $106,135. The CoinShares estimate is that twenty percent of operating miners are currently underwater on power costs alone, not counting hardware depreciation. The system is not breaking. It is doing exactly what it was designed to do. The waste has just become more expensive to ignore.

The Field Bitcoin Refuses To Read

There is an academic answer to this. It has existed in peer-reviewed form since 2017, the literature is open-access, and most Bitcoin commentary pretends it does not exist. The field is called proof of useful work and the premise is precise. The security property a proof-of-work network needs is that the work is hard to perform, the result is easy to verify, and an attacker cannot cheat without redoing the work. Bitcoin uses SHA-256 nonce-guessing to satisfy these three properties. Useful work means using a different computation, one that produces an output a human being would actually want, to satisfy the same three properties.

A 2020 paper by Andrei Lihu and colleagues proposed using the training of machine learning models as the proof. Miners would be paid for performing honest gradient descent on neural networks. A 2025 paper by Bitansky and others proved something more dramatic: matrix multiplication, which happens to be the single largest computational bottleneck in modern AI, can be wrapped in a proof-of-work protocol with only about one percent overhead. Their proposal would let miners run AI training and inference workloads as their consensus contribution. Two payments for the same hardware, the same electricity, the same hour of work.

There is an honest counterargument. A 2020 paper by Maya Dotan and Saar Tochner argues that any secure proof-of-work must be built on what cryptographers call preimage-resistant functions, meaning functions whose output cannot be predicted from their input and which are therefore mathematically arbitrary by definition. Their position is that the tension between usefulness and security is fundamental and cannot be designed away with clever protocols. The Bitansky and Lihu papers both take this seriously and propose specific cryptographic constructions intended to resolve it. The debate is alive. Twenty years from now we will know which side was right. The point is that the debate is happening, in public, in peer-reviewed venues, and almost none of it has reached the surface of mainstream Bitcoin discourse.

The case for Bitcoin's design in 2009 was that it was the first system that worked. Satoshi Nakamoto integrated twenty years of prior cryptographic research, removed the last trusted-party requirement that had killed every previous attempt, and shipped. The result has held against every attack for fourteen years. The case for replicating that design unchanged in 2026 has to do better than "it works." We have the data now. We know what a proof-of-work network actually costs to run. We have a hashrate concentration trend, an electricity-price-sensitive miner cohort that goes underwater every time the price retreats, and a documented case where three blocks worth of real transactions were erased from the ledger because two pools happened to win at the same time. We also have a peer-reviewed literature proposing that the same computational scale could be doing something useful and getting paid for it twice.

The next generation of distributed networks built on belief is going to choose. The choice is not whether to abandon proof of work. The proof of work model is real, the security math is real, the chain has held. The choice is whether to keep paying for arbitrary guesses or to start paying for useful guesses. The first network to make that move at scale will not be remembered as an attack on Bitcoin. It will be remembered the way Bitcoin is remembered, as the integration of work other people had been doing for years, shipped at the moment it became obvious.