Available online at www.sciencedirect.

com

ScienceDirect

Sustainability of bitcoin and blockchains

Harald Vranken1,2

Bitcoin is an electronic currency that has become increasingly It is not governed by central authorities, such as govern-
popular since its introduction in 2008. Transactions in the ments or central banks, and intermediaries for currency
bitcoin system are stored in a public transaction ledger (‘the issuance or settlement and validation of transactions, and
blockchain’), which is stored in a decentralized, peer-to-peer can provide lower transaction fees for payments [1,2].
network. Bitcoin provides decentralized currency issuance and The Bitcoin Foundation provides some centralized gov-
transaction clearance. The security of the blockchain depends ernance for standardization, protection and promotion of
on a compute-intensive algorithm for bitcoin mining, which bitcoin, but it does not act as a central bank and does not
prevents double spending of bitcoins and tampering with issue currency [3].
confirmed transactions. This ‘proof-of-work’ algorithm is
energy demanding. How much energy is actually consumed, is Bitcoin was introduced in 2008 by Satoshi Nakamoto [4],
subject of debate. We argue that this energy consumption which is a pseudonym of an author or group of authors
currently is in the range of 100–500 MW. We discuss the whose identity is covered in mysteries. The term ‘Bitcoin’
developments in bitcoin mining hardware. We also briefly often refers to the system, while the term ‘bitcoin’ or
outline alternative schemes that are less energy demanding. BTC refers to the unit of currency. In this paper, for
We finally look at other blockchain applications, and argue that simplicity we just use the term bitcoin. Bitcoin is an
also here energy consumption is not of primary concern. electronic, virtual currency that has no physical represen-
tation such as coins or banknotes. The bitcoin ecosystem
is a network of users that communicate with each other
Addresses
1
using the bitcoin protocol via the Internet. The bitcoin
Open University of the Netherlands, P.O. Box 2960, 6401 DL Heerlen, protocol is available as an open source software applica-
The Netherlands
2
Radboud University, P.O. Box 9010, 6500 GL Nijmegen, The
tion and allows users to store and transfer bitcoins for
Netherlands purchasing and selling goods, or to exchange bitcoins for
other currencies. The issuance of bitcoins takes places in
Corresponding author: Vranken, Harald (harald.vranken@ou.nl) the network while handling transactions in a process
called bitcoin mining. The bitcoin network started in
Current Opinion in Environmental Sustainability 2017, 28:xx-yy 2009 and ever since bitcoin has been the most popular
decentralized currency. In January 2017 there were
This review comes from a themed issue on Sustainability governance
and transformation 16 million bitcoins in circulation with a total value of
roughly 16 billion US dollars, although the exchange rate
Edited by Carolien Kroeze, Harald Vranken, Marjolein Caniels and
Dave Huitema of bitcoins has shown very large fluctuations.
Received: 10 February 2017; Accepted: 23 April
Both scientific and professional literature on digital cur-
2017 rencies, with bitcoin as prime example, is extensive.
Some provide gentle, general introductions to the tech-
http://dx.doi.org/10.1016/j.cosust.2017.04.011 nology applied in bitcoin (e.g. [5]), while others provide
1877-3435/ã 2017 Elsevier B.V. All rights reserved. more detailed overviews of the technical operation of
bitcoin (e.g. [6
,7
,8]) as well as economical and financial
aspects (e.g. [9
]).

In this review paper we provide an overview and synthesis

of recent literature published in the last two years that
Introduction addresses the sustainability of bitcoin. The sustainability
People have been using currencies for thousands of of bitcoin is depending on a mix of environmental
years. Initially, currencies were minted directly from [10

,11

], economical [1,12], financial [2,13,14] and eth-
precious metals such as gold and silver. Later on, paper ical [15] aspects. Bitcoin may pose risks to the stability of
money was introduced and the face value of cash was the current financial system, while also lack of controls
decoupled from its nominal value, but currencies were over bitcoin exchanges and the volatility of the bitcoin
still backed up by gold depositories. Nowadays, fiat currency raises concerns. Our focus in this review is on
currencies are allowed to float freely, only backed up sustainability in the context of environmental and eco-
by the faith and credit of the states that issue them. nomical aspects. We try to answer the question whether
Bitcoin is a decentralized system that attempts to over- the bitcoin system is sustainable given the energy con-
come the weaknesses of fiat and gold-based currencies. sumption required for bitcoin mining, which has been

www.sciencedirect.com Current Opinion in Environmental Sustainability 2017, 28:1–9

2 Sustainability governance and transformation

subject of debate in the last few years. The contributions the blockchain and propagated to the network. Although
of this paper are: firstly, to synthesize and critically assess computing a valid hash is difficult, verifying whether a
the viewpoints in scientific literature; and finally, to argue hash is valid is easy and hence each node that receives the
that the energy consumption of the bitcoin system is not block can quickly identify whether the new block is valid.
excessive, which stands in contrast to the public opinion When a node receives a new valid block, it stops the
that bitcoin mining is a gross waste of energy. We explore mining process for the current block and starts mining for
four subquestions: What factors play a role in the energy a new block. The node that won the block receives a
consumption of bitcoin mining, how large is this energy block reward, which is a fixed amount of new bitcoins.
consumption, does this impede sustainability, and if so Hence, the issuance of bitcoins (minting) is done during
are there alternatives that can reduce energy consump- the bitcoin mining process. The node that won the block
tion? In the following sections we outline the basic also receives the transaction fees for every transaction
operation of the bitcoin system, we summarize trends included in the block. Every 10 min on average, a node is
in the hardware used for bitcoin mining, we discuss the able to mine a new block. It can be the case that multiple
energy footprint of bitcoin mining, we present some of nodes simultaneously generate a valid block, which
the alternatives that have been proposed to reduce energy causes that multiple versions of the blockchain (‘forks’)
consumption, and we briefly discuss other applications of occur temporarily. Forks are resolved as soon as one of the
the blockchain technology that is at the basis of the forks contains more blocks. The computations to find and
bitcoin system. verify a cryptographic hash of a block during bitcoin
mining allows the bitcoin network to gain consensus
Overview of the bitcoin system about the state of transactions. This elegantly solves
The bitcoin system is a distributed, peer-to-peer network. the issue of double spending and hence an amount of
There is no central server or point of control, and all nodes bitcoins cannot be spent twice. The bitcoin mining
in the network are equal peers. Each transaction to process decentralizes the currency issuance and the trans-
transfer an amount of bitcoins among users is transmitted action clearing normally done by central banks and clear-
to the bitcoin network where it is stored in a distributed inghouses. In economics bitcoin is considered as money
transaction ledger, the blockchain. The blockchain con- to some extent, since it offers a unit of account, means of
tains the entire history of bitcoin transactions. Each node payment, and store of value [1,3]. It can even be argued
in the network stores a (complete or partial) copy of the that bitcoin has an intrinsic value due to the computa-
blockchain. New transactions are propagated rapidly tional effort for bitcoin mining [17].
across the nodes in the network. A transaction is in fact
a transfer from a source of funds (called an input) to a Each block does not only contain transactions, but also
destination (called an output). Transaction inputs and the hash of the previously accepted block in the block-
outputs are not related to accounts or balances: an input is chain. Hence, the blocks in the blockchain are linked to
a reference to an unspent transaction output of the sender each other: they form a chain of blocks, thence the term
in a previous transaction. Before forwarding a transaction ‘blockchain’. This provides security, as a node with
to its neighbors, each node first verifies the transaction, malicious intent cannot easily replace or modify an
which includes checking the syntax and structure, and already accepted transaction or add a new transaction
whether it is a valid transfer of an amount of yet unspent to an already accepted block, since this would require
transaction outputs. Each node independently verifies to redo the computations to find a valid hash for the
the transactions received, propagates valid transactions, modified block. And since new blocks are continuously
and builds a pool of valid transactions. The valid transac- added to the blockchain, each block linking to the previ-
tions are added to the blockchain in a process called ous block, also the hashes of the newly added blocks
bitcoin mining. Each node collects a number of valid would have to be recomputed.
transactions into a block and tries to compute a crypto-
graphic hash of the block that meets certain constraints The initial block reward was set to 50 BTC. The reward is
(based on the ideas of Hashcash [16]). A cryptographic halved every 210 000 blocks, which is approximately
hash is a kind of checksum for the block, that is one-way every four years. This will continue until 2140 when
(meaning that it is easy to compute a hash of a given the mining reward drops below 108 BTC, which is
block, but difficult to compute a block that matches a the minimal unit of bitcoin also known as satoshi. After-
given hash) and collision resistant (meaning that it is wards, transaction fees will provide the necessary incen-
difficult to find two blocks that yield the same hash). tive to continue mining of new blocks [18]. The bitcoin
Finding a hash that meets the constraints imposed by the protocol includes an algorithm to regulate that on average
bitcoin system, is a compute-intensive task that can be every 10 min a new block is mined, by adjusting the
executed only by brute-force trying. This implies a race difficulty to find a valid hash. This is required to keep up
among the nodes in the network to find a valid hash as with the improvements in the performance of mining
quickly as possible. The first node that finds such a hash, hardware which allows bitcoin miners to compute more
wins the block, which means that this block is added to and more hashes per second.

Current Opinion in Environmental Sustainability 2017, 28:1–9 www.sciencedirect.com

 Sustainability of bitcoin and blockchains Vranken 3

Hardware for bitcoin mining power consumption. The popularity of FPGAs was brief,
Bitcoin mining is attractive since it offers a strong finan- since the fourth generation appeared quickly.
cial incentive. For each block mined, the miner receives a
block reward as well as the transaction fees of the transac- The fourth generation appeared early 2013 with the
tions in the block. As bitcoin gained in popularity, an arms introduction of Application-Specific Integrated Circuits
race started among miners. Bitcoin miners initially used (ASICs) containing dedicated circuitry that is optimized
general-purpose computers, but they quickly switched to to perform hashing computations as efficiently as possi-
more dedicated hardware that offered higher perfor- ble. Butterfly Labs, ASICMiner and Avalon were the first
mance (in terms of hash rate R, measured in the number companies that provided ASICs for bitcoin mining,
of hashes (h) computed per second) at lower energy costs financed by online presales. ASICMiner initially did
(in terms of energy efficiency E, measured in the number not ship ASICs to customers, but ran the ASICs in their
of hashes computed per Joule). This dedicated hardware own data center, which allowed them to capture a large
for bitcoin mining has developed in a remarkable way, fraction of the total network hash rate. These first ASIC
and bitcoin miners even self-financed hardware and soft- manufacturers were very successful. Other companies
ware development [19

,20]. with greater capitalization quickly followed and devel-
oped the next generations of ASICs with improved tech-
The bitcoin mining hardware has seen four generations nology. Currently, the most advanced technologies are
[19

,20,17], see Table 1. Initially miners used general- only utilized by chip manufacturers that run their ASICs
purpose computers, in which the actual computations are in their own data centers located in areas that have low-
performed by the Central Processing Unit (CPU). cost energy and cooling. The bitcoin mining industry is
Although modern CPUs can execute software with a however very competitive. For instance, the Swedish
certain amount of parallelism, and multiple threads can company KnCminer operated data centers located in
be executed in parallel on multicore CPUs, they are not the Arctic circle to benefit from locally sourced hydro-
optimized for bitcoin mining. This first generation of electric power and cool air at extremely low cost, but still
bitcoin mining hardware using CPUs, is the least power- went bankrupt mid 2016. Many large miners are located
ful and the least energy efficient. As the difficulty of near cheap sources of electricity, such as hydroelectric
mining increased, the operational costs of CPUs dams (China, Republic of Georgia) and geothermal power
exceeded the profits from mining. plants (Iceland).

The second generation occurred at the end of 2010 when Figure 1 shows the daily revenue in US dollars per Gh/s
bitcoin miners started to use the Graphics Processing earned by bitcoin miners in the period 2011–2016. The
Unit (GPU) in the graphics cards of their computers. figure combines historical data on the mining revenue (i.
These GPUs are designed to perform complex graphics e. block rewards and transaction fees) and the hash rate of
calculations with lots of parallelism, which can be used the bitcoin network with US dollar to BTC exchange rate.
efficiently for bitcoin mining. GPUs offered higher hash The drops at the end of 2012 and mid 2016 correspond to
rates and better energy efficiency than CPUs. the transition of the block reward from 50 BTC to 25 BTC
and from 25 BTC to 12.5 BTC. The horizontal lines show
As the use of GPUs became more widespread, bitcoin the estimated daily energy cost per Gh/s for CPUs, GPUs,
miners started to look for more powerful and more effi- and a number of FPGAs and ASICs, including five gen-
cient alternatives. The third generation occurred mid erations of ASICs in Bitmain’s Antminer product line.
2011 when miners switched to Field Programmable Gate Bitmain Technologies, founded in 2013, is currently one
Arrays (FPGAs). The circuits in an FPGA can be config- of the leading ASIC manufacturers that ship ASICs to
ured and programmed by users after manufacturing. customers. When the revenue of mining drops below
Bitcoin miners customized FPGAs to support mining, these costs, profit turns negative and miners have to
which allowed to increase hash rates even further at lower switch to more efficient hardware [21]. Note that this
figure is in line with the analysis by Taylor [19

] and
shows costs for hardware that can be purchased by private
Table 1 customers and run at electricity costs of 200 USD/MWh.
Hash rate and energy efficiency (orders of magnitude) of four Electricity costs however vary widely in different coun-
generations of bitcoin mining hardware (data source: en.bitcoin. tries, and even within countries, depending on infrastruc-
it/wiki/mining_hardware_comparison) ture and geography. For instance, in 2015 the electricity
Hardware Introduction Hash rate (h/s) Energy efficiency (h/J) prices in OECD countries ranged for consumers from
CPU 2009 105–10 8 104–10 5
75.33 USD/MWh in Mexico to 337.38 USD/MWh in
GPU Late 2010 106–10 9 105–10 6 Denmark, and for industry from 35.34 USD/MWh in
FPGA Mid 2011 108–10 10 10 7 Norway to 263.33 USD/MWh in Italy (source: Interna-
ASIC Early 2013 1010–10 13 108–10 10 tional Energy Agency, www.iea.org). Industrial users run
purpose-built data centers comprised of specialized

www.sciencedirect.com Current Opinion in Environmental Sustainability 2017, 28:1–9

4 Sustainability governance and transformation

Figure 1

103
Daily bitcoin mining revenue and energy costs (USD per Gh/s)

102
CPU

101

GPU

0
10
FPGA (Bitforce SHA 256)

FPGA (Buterfly Labs Mini Rig)

10–1
ASIC (Avalon batch 1, 110 nm)

10–2 ASIC (AntMiner S1, 55 nm)

ASIC (AntMiner S4, 28 nm)

10 –3 ASIC (AntMiner S7, 28 nm)

ASIC (AntMiner S9, 16 nm)

10–4
2011-1-1 2012-1-1 2013-1-1 2014-1-1 2015-1-1 2016-1-1 2017-1-1
Date
Current Opinion in Environmental Sustainability

Daily mining revenue and daily mining energy cost for different types of hardware (USD per Gh/s) (data sources: www.blockchain.info for daily
mining revenue; en.bitcoin.it/wiki/mining_hardware_comparison for energy costs).

servers that integrate arrays of ASICs (‘ASIC clouds’) electrical characteristics) of a transistor with a factor S, the
offering better performance and energy efficiency [20]. transistor count increases by a factor S2 (Moore’s law) and
the transistor switching frequency increases by a factor S,
Bitcoin miners did not only participate in grass-root while keeping chip area and chip energy usage the same.
efforts to produce efficient hardware, they also cooperate Hence, the computational capabilities of chips increase
in mining pools in which participants split up the com- by a factor S3 per process generation. To maintain the
putations to mine a block. If a block is mined, each same power usage, the transistor energy efficiency also
participant is rewarded according to their contribution. has to improve with a factor S3. This is achieved by scaling
the transistor capacitance, which improves energy effi-
The bitcoin arms race increases the capital expenditure, ciency by a factor S, and by scaling the threshold and
which throws up barriers for newcomers to enter and operating voltages, which provides another factor S2
causes miners that cannot keep up to drop out. This improvement in energy efficiency. However, Dennard’s
leads to an oligopolistic market. According to data from scaling no longer holds for process generations below
bitcoinchain.com, the five largest miners, which are 90 nm, since further scaling of the threshold voltage
mostly based in China, mined over 85% of the blocks causes unacceptable levels of current leakage, and there-
in 2016. This implies several risks, such as government fore the operating voltage has to remain roughly constant.
interventions and undermining bitcoin’s principle of a Instead of improving the energy efficiency by S3, in post-
decentralized currency. Dennard scaling the energy efficiency can only be
improved by S. Hence, with each process generation
An interesting question is how bitcoin mining ASICs will we face a shortfall of S2. While transistor count continues
evolve in the near future. The semiconductor industry to increase according to Moore’s law, the per-transistor
has been introducing new CMOS process technology speed and energy efficiency improvements slow down
generations at a fairly constant two-year pace [22]. With exponentially [23,24]. To deal with this, more and more
each new generation, the dimensions of transistors on portions of chips are not used all the time, or not at full
pffiffiffi down further by a factor S, which
chips are scaled frequency (which is referred to as ‘dark silicon’) [25]. This
typically is 2. According to Dennard’s classic scaling caused a shift to multicore design in 2005. Some applica-
theory, by scaling the dimensions (and consequently the tions can benefit from specialized, heterogeneous cores

Current Opinion in Environmental Sustainability 2017, 28:1–9 www.sciencedirect.com

 Sustainability of bitcoin and blockchains Vranken 5

that can be dynamically powered up for a given workload value T. In the bitcoin network, the 256-bits crypto-
as in servers [26], or energy-efficient cores for computa- graphic hash of a block B is computed by applying the
tionally intensive applications [23]. However, this is not SHA-256 hash function [28] twice, h(B) = SHA256
the case for bitcoin mining ASICs that continuously (SHA256(B)), which yields a hash that behaves approxi-
operate at peak performance, which results in extremely mately as a uniformly random value between 0 and
high and sustained power consumption [27]. Since 2256  1. Hence, the only way to find a valid hash is to
2005 also the search has initiated for new types of randomly try nonce values. This scheme is called ‘proof-
switches that improve performance and energy efficiency. of-work’. The bitcoin network controls the difficulty for
It is unlikely that a new switch faster than CMOS tran- finding a valid hash by adjusting the target T every
sistors and consuming less power will be introduced into 2016 blocks, with the aim of keeping the average time
manufacturing on short term. Carbon nanotubes are to mine a new block near 10 min. The target is expressed
promising, but it still will require several years until this in terms of the difficulty D by D = Tmax/T, where Tmax is
reaches the manufacturing stage. 3D power scaling tech- the largest possible value of the target (which is (216  1)
nology allows the continuation of Moore’s law for the next 2208  2224). The probability that a nonce value yields a
10–15 years via power-efficient vertical transistors. Even- valid hash therefore is p = T/2256 = Tmax/(2256D)  1/
tually, switches will reach a fundamental performance (232D). The number of trials for choosing a nonce value
limit, and any further improvement in computing perfor- that yields a valid hash is approximately geometrically
mance can solely come from innovatives in system design distributed (assuming that these trials are independent,
[22]. The SHA-256 algorithm used for computing the which of course does not hold for a single miner, but
block hashes in bitcoin mining however does not lend considers that multiple miners are independently per-
itself to significant micro-architectural design modifica- forming the computations simultaneously). At rate R the
tions. The only improvement for bitcoin mining ASICs is expected time to find a valid nonce value therefore is
to migrate to the latest process technologies and possibly 1/( pR) = 232D/R, which equals 600 s. The hash rate of the
apply custom library cells or even custom physical layout bitcoin network then is R  232D/600. Combining this
[27]. Hence, the future improvement in performance and with the energy efficiency E, the estimated power con-
energy efficiency of bitcoin mining ASICs is expected to sumption of the bitcoin network is P = R/E  232D/
slow down. (600E) [10

].

Figure 2 shows the power consumption (orders of magni-

Energy costs of bitcoin mining tude) for various bitcoin mining hardware. Obviously, for
Next to the capital expenditure for bitcoin mining hard- any given date the estimated power consumption is
ware, the main costs for bitcoin mining are the operational realistic only when considering the hardware available
costs for running the hardware, which are mainly energy at that time (see Table 1). The figure indicates that in
costs. There has been lot of debate on the total energy January 2017 the actual power consumption could vary
consumption of bitcoin mining, not only on Internet fora from 45 MW (using state-of-the art ASICs with
but also in scientific literature [10

,11

,20]. The esti- 5  1010 h/J energy efficiency) up to 450 TW (using early
mates vary considerably, ranging from an energy con- generations of CPUs with 5  103 h/J energy efficiency).
sumption that is equivalent to the electricity generated by Since the worldwide annual electricity consumption is
a small power plant (in the order of 10 MW) up to the about 2.3 TW, it is clear that 450 TW is completely
electricity consumption of small to medium-sized coun- unrealistic. A more realistic upper bound on the energy
tries such as Denmark, Ireland or Bangladesh (in the consumed can be derived when assuming that the reve-
range of 3–6 GW). nue of bitcoin mining (see Figure 1) would be totally
spent on energy costs (hence ignoring capital expendi-
O’Dwyer and Malone analyzed the energy footprint of ture). The daily revenue of bitcoin mining, including
bitcoin mining in 2014 [10

]. Their analysis is based on block rewards and transaction fees, on January 1,
the observation that the power consumption of the bitcoin 2017 was 1 961 203 USD (according to www.
network (P, measured in W) can be computed from the blockchain.info). This is a plausible number when con-
hash rate of the bitcoin network (R, measured in h/s) and sidering that one block is mined every 10 min, which
the energy efficiency of the bitcoin mining hardware (E, yields a daily revenue of 1 800 000 USD (at a block
measured in h/J): P = R/E. reward of 12.5 BTC and an exchange rate of
1000 USD) not considering transaction fees. With this
During the mining process, the miner computes the hash revenue, the upper bound on the energy consumption is
of a block of transactions. A block also contains other data, in the range of 400 MW (electricity price of 200 USD/
such as the hash of the latest accepted block in the MWh) up to 2.3 GW (electricity price of 35 USD/MWh).
blockchain, and a ‘nonce’ value that the miner can choose When taking 60 USD/MWh as an average case for elec-
randomly. The aim of the miner is to find a nonce value tricity price, the energy consumption is 1.3 GW. The
such that the hash of the block is smaller than a target corresponding energy efficiency then is 1.8  109 h/J,

www.sciencedirect.com Current Opinion in Environmental Sustainability 2017, 28:1–9

6 Sustainability governance and transformation

Figure 2

1015

1014 CPU
13
10
GPU
1012

11 FPGA
10
Power usage of bitcoin network (W)

10
10

9
10
ASIC
108

107

6
10

105

104

103

102

101

100
2011-1-1 2012-1-1 2013-1-1 2014-1-1 2015-1-1 2016-1-1 2017-1-1
Date
Current Opinion in Environmental Sustainability

Estimated power usage of bitcoin network (232D/(600E)) for various hardware (energy efficiency ranges (orders of magnitude) according to Table 1
(data sources: www.blockchain.info for historical data on difficulty; en.bitcoin.it/wiki/mining_hardware_comparison for energy efficiency of
hardware).

and hence it is clear that bitcoin mining currently is only hardware as long as mining with their current hardware
profitable when applying ASICs. is still profitable and the break-even point has not been
reached yet at which revenues have covered the capital
An even more accurate estimation of the energy con- and operational expenditure of their current hardware.
sumption is derived when also considering the capital The future trend may well be to apply massive amounts
expenditure. Magaki et al. explored the design of pur- of ASICs from older process technologies running at low
pose-built data centers running servers with large arrays of power [27]. Bitcoin mining is very competitive. Bitcoins
ASICs (‘ASIC clouds’) dedicated to bitcoin mining [20]. will be mined by those who can do it most cheaply, and
They consider three designs in which either energy, costs others will be put out of business. It is therefore likely that
or total cost of ownership (TCO) are optimized, at an surviving miners run the latest hardware at locations
electricity price of 60 USD/MWh. In these three cases, offering the lowest electricity costs to be competitive
the electricity costs are 7.5%, 16.9%, and 13.7% of the and to maximize profit.
TCO. In the break-even case, where revenue equals
TCO, the energy consumption is 100, 230 and Estimates published in scientific literature vary
190 MW. The corresponding energy efficiency then is considerably:
in the range of 1.1  1010 to 2.4  1010 h/J.

O’Dwyer and Malone estimated that the total power
The ASICs that are currently being used by bitcoin consumption for bitcoin mining would be around
miners, are most likely a mix of the newest available 100 MW to 10 GW [10

]. Without further substantia-
and some older ASICs. The actual mix used in practice is tion, they conclude that an average of 3 GW would be
unknown. Bitcoin miners will not switch to newer most plausible (which is comparable to the Irish

Current Opinion in Environmental Sustainability 2017, 28:1–9 www.sciencedirect.com

 Sustainability of bitcoin and blockchains Vranken 7

national energy consumption). Our analysis however Alternatives for proof-of-work

shows that is overestimated. Various alternative consensus mechanisms have been

McCook argues that chip-fabricator miners, who apply proposed to address the energy consumption of proof-
the ASICs that they design and manufacture them- of-work [35]. In proof-of-stake, users are required to prove
selves for mining, can mine for up to 30% cheaper than the ownership of their amount of coins. Users create ‘
retail miners, and that they form the vast majority of the coinstake’ transactions in which they send the coins in
hash power [11

]. Applying the 80-20 rule, assuming their possession to themselves and add a predefined
chip fabricators hold 80% and retail miners hold 20% of percentage as reward. In the mining process, still the
the hash power, the energy efficiency on average is hash of a block has to be computed that is smaller than a
estimated at 2.5 Gh/J, which corresponds to a power target value. A block however does not include a nonce
consumption of 120 MW. value that can be modified by the miner, but a time-stamp

Magaki et al. state that the global power budget dedi- that changes every second. Hence, miners cannot rely on
cated to ASIC clouds is estimated by experts to be in computational power, but they can only compute one
the range of 300–500 MW [20]. hash every second. The miner that wins the block,
receives the transaction reward. The difficulty is deter-
mined individually for every user: it is inversely propor-
tional to the coin age, which is the amount of coins times
We conclude that although the energy consumption could the time period that the user held these coins. Hence,
be as low as 45 MW when solely using the latest bitcoin users with a large coin age have a higher chance to mine a
mining ASICs, in practice the energy consumption most block. When a block is mined that includes a coinstake
likely is in the range of 100–500 MW (which corresponds transaction, the coin age of the winner is reset. Hence,
to 3–16 PJ per year). Hence, the order of magnitude of the proof-of-stake is a raffle-like scheme, with repeatedly
energy consumption is 100 MW. occurring new chances for all participants [36–38]. Also
a combination of proof-of-work and proof-of-stake has
To put things into perspective, McCook also compares been proposed, in which a fraction of the proof-of-work
the sustainability of bitcoin mining with the sustainability block reward is raffled among all active nodes, while their
of gold mining and the banking system [11

]. The energy stake determines the amount of raffle tickets [39].
used per year for gold mining and recycling is estimated at
500 PJ, for printing paper banknotes and minting coins at Another alternative is proof-of-space, where the miner
40 PJ, and for the banking system, considering ATMs and must employ a specified amount of memory to compute
bank branches (which of course provide more services the proof [40,41]. In proof-of-space-time, the miner must
than just handling transactions), at 2340 PJ. Compared to prove that he stored data over a period of time [42].
these numbers, the energy used for bitcoin mining in the
range of 3–16 PJ is relatively small. Still, the proportion of Although these alternatives largely reduce the energy
bitcoin in the current financial system is relatively small, consumption as with proof-of-work, there still are security
and when bitcoin scales up, so will the effort for bitcoin issues when applying them to public blockchains [39,38].
mining.
Blockchains
Another line of thought to deal with the criticism that Blockchain is at the basis of currencies such as bitcoin, but
proof-of-work as applied in bitcoin wastes energy, is to it can also be used in many other financial and commercial
replace the computation of hashes by more ‘meaningful’ applications [43–49,35]. A prominent example is smart
tasks. This has been applied in other electronic curren- contracts, for instance as offered in Ethereum [50]. A
cies. For instance, NooShare proposes the scheduling of contract can execute a transfer when certain events hap-
arbitrary Monte-Carlo simulations as a proof-of-work, pen, such as payment of a security deposit, while the
Primecoin proposes the computation of long chains of correct execution is enforced by the consensus protocol
prime numbers (Cunningham chains), and Permacoin [51,52].
proposes proofs of retrievability [7
].
Blockchains can be classified as public blockchains, pri-
There are also other factors that impact the sustainability vate blockchains or consortium blockchains [35]. Bitcoin
of bitcoin [29]. For instance, bitcoin is not suited for real- is an example of a public blockchain, in which all records
time transactions due to the delay between the injection are visible to the public and everyone can take part in the
of a transaction into the bitcoin network and the inclusion consensus process. A private blockchain is fully controlled
of the transaction in a mined block that is added to the by one organization, with a closed group of known parti-
blockchain, and for the transaction actually to be con- cipants, which implies a centralized rather than a decen-
firmed a sufficient amount of subsequent blocks has to be tralized network. A consortium blockchain is partially
added to the blockchain [30,31]. Other concerns are the decentralized, where transactions are validated by a
growing size of the blockchain, and security [32–34,7
]. selected set of nodes. Private and consortium blockchains

www.sciencedirect.com Current Opinion in Environmental Sustainability 2017, 28:1–9

8 Sustainability governance and transformation

may permission other users to read records in the block- 4. Nakamoto S: Bitcoin: A Peer-to-Peer Electronic Cash System.
2008.
chain. Public blockchains rely on a consensus protocol
5. Zohar A: Bitcoin: under the hood. Commun ACM 2015, 58:104-
such as proof-of-work, which ensures that transactions 113 http://dx.doi.org/10.1145/2701411.
cannot be tampered as long an no single miner controls
6. Antonopoulos AM: Mastering Bitcoin: Unlocking Digital
more than 50% of the network’s hash power. Transactions
Cryptocurrencies. O’Reilly Media; 2014. ISBN: 978-1-4493-7404-
in private or consortium blockchains are editable as long 4. http://chimera.labs.oreilly.com/books/1234000001802/index.
html.
as the major participants have reached an agreement, and This book outlines the technical operation of bitcoin.
hence a strong consensus protocol such as proof-of-work is
7. Tschorsch F, Scheuermann B: Bitcoin and beyond: a technical
not required. This reduces security, but improves effi-
survey on decentralized digital currencies. IEEE Commun Surv
ciency and latency, and hence energy consumption is Tutor 2016, 18:2084-2123 http://dx.doi.org/10.1109/
COMST.2016.2535718.
barely an issue. This survey describes the basics of bitcoin, and discusses security
threats and privacy properties, as well as the proof-of-work scheme
and alternative approaches.
Conclusion
8. Garay J, Kiayias A, Leonardos N: The bitcoin backbone protocol:
In this review we described the basic operation of bitcoin analysis and applications. Annual International Conference on
mining and we explored the developments in the hard- the Theory and Applications of Cryptographic Techniques.
Springer; 2015:281-310.
ware used for bitcoin mining. The proof-of-work scheme
is compute-intensive and hence energy demanding, but 9. Chuen DLK (Ed): Handbook of Digital Currency. Academic Press;

2015. ISBN: 978-0-12-802117-0.
essential for dealing with the double-spending problem This book covers technical, economical and financial aspects of bitcoin.
and security of the blockchain. The mining hardware has
10. O’Dwyer KJ, Malone D: Bitcoin mining and its energy footprint.
evolved from CPUs, GPUs and FPGAs to ASICs, with an

Irish Signals & Systems Conference 2014 and 2014 China–Ireland
exponential increase in performance and energy effi- International Conference on Information and Communications
Technologies (ISSC 2014/CIICT 2014). IET; 2014:280-285.
ciency. It is expected however that this trend will slow In this paper the energy footprint of the bitcoin network is computed. It is
down in the next decade. We discussed the energy estimated that the electricity consumption of bitcoin mining is on par with
that of Ireland.
footprint of bitcoin mining, which has been subject of
debate. Our estimates show that the order of magnitude 11. McCook H: An Order-of-Magnitude Estimate of the Relative


Sustainability of the Bitcoin Network. 2015 In: https://www.
for the energy consumption is 100 MW. As bitcoin academia.edu/7666373/An_Order-of-Magnitude_Estimate_
becomes more popular, the effort for bitcoin mining will of_the_Relative_Sustainability_of_the_Bitcoin_
Network_-_3rd_Edition.
increase. Since bitcoin mining is very competitive, only This paper compares the sustainability of the bitcoin network with the
those miners will survive who apply the most competitive banking industry, the gold production industry, and the process of
mining hardware and benefit from the lowest electricity printing and minting of physical currency.
costs. The sustainability of bitcoin on itself therefore is 12. Harwick C: Cryptocurrency and the problem of intermediation.
Independ Rev 2016, 20:569-588.
not primarily at risk due to energy consumption. We also
briefly reviewed alternative schemes such as proof-of- 13. Grant G, Hogan R: Bitcoin: risks and controls. J Corp Account
Finance 2015, 26:29-35 http://dx.doi.org/10.1002/jcaf.22060.
stake, which are far less energy demanding. Finally, we
looked at other applications of blockchain technology, 14. Walch A: The bitcoin blockchain as financial market
infrastructure: a consideration of operational risk. N Y Univ J
which are currently receiving lots of interest. Private and Legisl Public Policy 2015, 18:837-893.
consortium blockchains are only partially decentralized, 15. Angel JJ, McCabe D: The ethics of payments: paper, plastic, or
which relaxes the need and effort for proof-of-work bitcoin? J Business Ethics 2015, 132:603-611.
schemes, and hence energy consumption may be barely 16. Back A: Hashcash — A Denial of Service Counter-Measure. 2002
an issue. In: ftp://sunsite.icm.edu.pl/site/replay.old/programs/hashcash/
hashcash.pdf.
17. Hayes AS: Cryptocurrency value formation: an empirical study
Acknowledgements leading to a cost of production model for valuing bitcoin.
We kindly thank the anonymous reviewers for their valuable comments. Telemat Informat 2016 http://dx.doi.org/10.1016/j.
tele.2016.05.005. (in press).

References and recommended reading 18. Kaskaloglu K: Near zero bitcoin transaction fees cannot last
forever. The International Conference on Digital Security and
Papers of particular interest, published within the period of review, Forensics (DigitalSec2014); The Society of Digital Information and
have been highlighted as: Wireless Communication: 2014:91-99.

of special interest 19. Taylor MB: Bitcoin and the age of bespoke silicon. In


of outstanding interest

Proceedings of the 2013 International Conference on Compilers,
Architectures and Synthesis for Embedded Systems, CASES’13.
1. Ali R, Barrdear J, Clews R, Southgate J: The economics of digital Piscataway, NJ, USA: IEEE Press; 2013. pp. 16:1–16:10. ISBN:
currencies. Bank Engl Q Bull 2014, 2014:276-286. 978-1-4799-1400-5. http://dl.acm.org/citation.cfm?id=2555729.
2555745.
2. Mikołajewicz-Wozniak A, Scheibe A: Virtual currency schemes This paper describes the history of bitcoin mining hardware, especially
— the future of financial services. Foresight 2015, 17:365-377 the development of ASICs, as well as the incentives and strategies of
http://dx.doi.org/10.1108/FS-04-2014-0021. bitcoin miners.
3. Beer C, Weber B: Bitcoin — the promise and limits of private 20. Magaki I, Khazraee M, Gutierrez LV, Taylor MB: ASIC clouds:
innovation in monetary and payment systems. Monet Policy specializing the datacenter. In Proceedings of the 43rd
Econ 2014, 4:53-66. International Symposium on Computer Architecture, ISCA’16.

Current Opinion in Environmental Sustainability 2017, 28:1–9 www.sciencedirect.com

 Sustainability of bitcoin and blockchains Vranken 9

Piscataway, NJ, USA: IEEE Press; 2016, 178-190 http://dx.doi. trends. Proceedings of 6th IEEE International Congress on Big
org/10.1109/ISCA.2016.25:. ISBN: 978-1-4673-8947-1. Data 2017.
21. Wang L, Liu Y: Exploring miner evolution in bitcoin network. In 36. King S, Nadal S: PPcoin: Peer-to-Peer Crypto-Currency with
Proceedings 16th International Conference on Passive and Active Proof-of-Stake. 2012.
Network Measurement; vol 8995 of Lecture Notes in Computer
Science Series. Springer; 2015:290-302 http://dx.doi.org/ 37. Bentov I, Gabizon A, Mizrahi A: Cryptocurrencies Without Proof of
10.1007/978-3-319-15509-8_22. Work. 2014arXiv:1406.5694.
22. Gargini PA: How to successfully overcome inflection points, or 38. Kiayias A, Konstantinou I, Russell A, David B, Oliynykov R: A
long live Moore’s law. Comput Sci Eng 2017, 19:51-62 http://dx. Provably Secure Proof-of-Stake Blockchain Protocol. Cryptology
doi.org/10.1109/MCSE.2017.32. ePrint Archive, Report 2016/889. 2016 In: http://eprint.iacr.org/
2016/889.
23. Venkatesh G, Sampson J, Goulding N, Garcia S, Bryksin V, Lugo-
Martinez J, Swanson S, Taylor MB: Conservation cores: 39. Bentov I, Lee C, Mizrahi A, Rosenfeld M: Proof of Activity:
reducing the energy of mature computations. In Proceedings of Extending Bitcoin’s Proof of Work Via Proof of Stake. Cryptology
the Fifteenth Edition of ASPLOS on Architectural Support for ePrint Archive, Report 2014/452. 2014 In: http://eprint.iacr.org/
Programming Languages and Operating Systems. ACM; 2010 2014/452.
http://dx.doi.org/10.1145/1736020.1736044. ISBN: 978-1-60558-
839-1; 205-218. 40. Ateniese G, Bonacina I, Faonio A, Galesi N: Proofs of space:
when space is of the essence. International Conference on
24. Esmaeilzadeh H, Blem E, Amant RS, Sankaralingam K, Burger D: Security and Cryptography for Networks. Springer; 2014:538-557.
Power challenges may end the multicore era. Commun ACM
2013, 56:93-102 http://dx.doi.org/10.1145/2408776.2408797. 41. Dziembowski S, Faust S, Kolmogorov V, Pietrzak K: Proofs of
space. Advances in Cryptology — CRYPTO 2015; vol 9216 of
25. Taylor MB: A landscape of the new dark silicon design regime. Lecture Notes in Computer Science Series. Springer; 2015:585-
IEEE Micro 2013, 33:8-19. 605 http://dx.doi.org/10.1007/978-3-662-48000-7_29.
26. Hardavellas N, Ferdman M, Falsafi B, Ailamaki A: Toward dark 42. Moran T, Orlov I: Proofs of Space–Time and Rational Proofs of
silicon in servers. IEEE Micro 2011, 31:6-15. Storage. Cryptology ePrint Archive, Report 2016/045. 2016 .
27. Barkatullah J, Hanke T: Goldstrike 1: Cointerra’s first- Report 2016/035 In: https://eprint.iacr.org/2016/035.
generation cryptocurrency mining processor for bitcoin. IEEE 43. Underwood S: Blockchain beyond bitcoin. Commun ACM 2016,
Micro 2015, 35:68-76. 59:15-17 http://dx.doi.org/10.1145/2994581.
28. NIST: FIPS PUB 180-4, Secure Hash Standard (SHS). 2015 http://
dx.doi.org/10.6028/NIST.FIPS.180-4. 44. Umeh J: Blockchain double bubble or double trouble? ITNOW
2016, 58:58-61.
29. Extance A: Bitcoin and beyond. Nature 2015, 526:21-23.
45. Fanning K, Centers DP: Blockchain and its coming impact on
30. Decker C, Seidel J, Wattenhofer R: Bitcoin meets strong financial services. J Corp Account Finance 2016, 27:53-57 http://
consistency. In Proceedings of the 17th International Conference dx.doi.org/10.1002/jcaf.22179.
on Distributed Computing and Networking, ICDCN’16. New York,
NY, USA: ACM; 2016 http://dx.doi.org/10.1145/ 46. Yli-Huumo J, Ko D, Choi S, Park S, Smolander K: Where is current
2833312.2833321. 13:1–13:10. ISBN: 978-1-4503-4032-8. research on blockchain technology? A systematic review.
PLOS ONE 2016, 11 http://dx.doi.org/10.1371/journal.

31. Karame GO, Androulaki E, Roeschlin M, Gervais A, Capkun S: pone.0163477.
Misbehavior in bitcoin: a study of double-spending and
accountability. ACM Trans Inform Syst Security 2015, 18:1-32 47. BitFury Group, Garzik J: Public Versus Private Blockchains — Part
http://dx.doi.org/10.1145/2732196. 1: Permissioned Blockchains. White Paper. 2015 In: http://bitfury.
com/content/5-white-papers-research/public-vs-private-pt1-1.
32. Gervais A, Ritzdorf H, Karame GO, Capkun S: Tampering with the pdf.
delivery of blocks and transactions in bitcoin. In Proceedings of
the 22nd ACM SIGSAC Conference on Computer and 48. BitFury Group, Garzik J: Public Versus Private Blockchains — Part
Communications Security, CCS’15. New York, NY, USA: ACM; 2: Permissionless Blockchains. White Paper. 2015 In: http://bitfury.
2015, 692-705 http://dx.doi.org/10.1145/2810103.2813655:. com/content/5-white-papers-research/public-vs-private-pt2-1.
ISBN: 978-1-4503-3832-5. pdf.
33. Gervais A, Karame GO, Wüst K, Glykantzis V, Ritzdorf H, 49. Forte P, Romano D, Schmid G: Beyond Bitcoin — Part I: A Critical
Capkun S: On the security and performance of proof of work Look at Blockchain-Based Systems. Cryptology ePrint Archive,
blockchains. In Proceedings of the 2016 ACM SIGSAC Report 2015/1164. 2015 In: http://eprint.iacr.org/2015/1164.
Conference on Computer and Communications Security, CCS’16.
New York, NY, USA: ACM; 2016, 3-16 http://dx.doi.org/10.1145/ 50. Wood G: Ethereum: A Secure Decentralised Generalised
2976749.2978341:. ISBN: 978-1-4503-4139-4. Transaction Ledger. Ethereum Project Yellow Paper. 2014:151 In:
http://gavwood.com/paper.pdf.
34. Paul G, Sarkar P, Mukherjee S: Towards a more democratic
mining in bitcoins. In In Proceedings of 10th International 51. Luu L, Chu DH, Olickel H, Saxena P, Hobor A: Making smart
Conference on Information Systems Security (ICISS); vol 8880 of contracts smarter. In Proceedings of the 2016 ACM SIGSAC
Lecture Notes in Computer Science (LNCS). Edited by Prakash A, Conference on Computer and Communications Security, CCS’16.
Shyamasundar R. Proceedings of 10th International Conference New York, NY, USA: ACM; 2016, 254-269 http://dx.doi.org/
on Information Systems Security (ICISS); vol 8880 of Lecture Notes 10.1145/2976749.2978309:. ISBN: 978-1-4503-4139-4.
in Computer Science (LNCS) Cham: Springer International
Publishing; 2014:185-203 http://dx.doi.org/10.1007/978-3-319- 52. Luu L, Teutsch J, Kulkarni R, Saxena P: Demystifying incentives
13841-1_11. ISBN: 978-3-319-13841-1. in the consensus computer. In Proceedings of the 22nd ACM
SIGSAC Conference on Computer and Communications Security,
35. Zheng Z, Xie S, Dai H, Chen X, Wang H: An overview of CCS’15. New York, NY, USA: ACM; 2015, 706-719 http://dx.doi.
blockchain technology: architecture, consensus, and future org/10.1145/2810103.2813659:. ISBN: 978-1-4503-3832-5.

www.sciencedirect.com Current Opinion in Environmental Sustainability 2017, 28:1–9