Merged Mining

What Is Merged Mining?

Merged mining (also called auxiliary proof of work, or AuxPoW) is a technique that allows a cryptocurrency miner to mine multiple blockchains simultaneously using the same computational work. The blockchain providing the proof of work is called the parent chain (for example, Bitcoin), and the blockchain accepting that work is called the auxiliary chain or child chain. Both chains must use the same hashing algorithm.

The concept was first proposed by Satoshi Nakamoto on December 9, 2010, in the BitDNS thread on Bitcointalk. Satoshi wrote: "Miners would subscribe to both networks in parallel. They would scan SHA such that if they get a hit, they potentially solve both at once." Two days later, Satoshi clarified the principle: "Independent networks/chains can share CPU power without sharing much else."

Namecoin became the first live implementation when it activated merged mining on October 11, 2011, at block 19,200. Since then, merged mining has become a foundational technique for bootstrapping security on new sidechains and alternative blockchains without fragmenting the existing miner ecosystem.

How It Works

Merged mining relies on the fact that mining is essentially repeated hashing: miners hash candidate block headers until one meets the difficulty target. If the parent and auxiliary chains use the same hash algorithm, a single hash attempt can satisfy either chain's target, or both simultaneously.

The process works in five steps:

1. The miner assembles candidate blocks for both the parent chain and the auxiliary chain(s)
2. The miner inserts a hash of the auxiliary chain's block header into the coinbase transaction of the parent chain's candidate block
3. The miner performs proof-of-work hashing on the parent block header as normal
4. If the hash meets the auxiliary chain's difficulty target (typically lower than the parent's), the miner has found a valid auxiliary block
5. The miner submits the auxiliary block along with an AuxPoW proof that the auxiliary chain can independently verify

Coinbase Insertion

The coinbase transaction in every block contains a scriptSig field with arbitrary data (this is the same field miners use to embed messages or pool identifiers). Merged mining uses this free space to embed the auxiliary chain's block hash.

The insertion follows a specific format. When data extends beyond 20 bytes, four magic bytes (0xfa 0xbe 0x6d 0x6d) signal the start of the merged mining data, followed by the 32-byte auxiliary block hash:

# Coinbase scriptSig structure for merged mining
[arbitrary pool data]
[magic bytes: fa be 6d 6d]       # 4 bytes - signals AuxPoW data
[aux block hash]                  # 32 bytes - hash of auxiliary block header
[merkle tree size]                # 4 bytes - number of aux chains (power of 2)
[merkle nonce]                    # 4 bytes - used for slot assignment

When mining multiple auxiliary chains simultaneously, the miner constructs a Merkle tree with each chain's block hash placed at a deterministic slot. The Merkle root replaces the single block hash in the coinbase. Each chain's slot is determined by its chain ID using a pseudo-random assignment algorithm:

// Slot assignment for auxiliary chain in the Merkle tree
rand = merkle_nonce
rand = rand * 1103515245 + 12345
rand += chain_id
rand = rand * 1103515245 + 12345
slot = rand % merkle_size

AuxPoW Proof Structure

To submit a valid block to the auxiliary chain, the miner provides an AuxPoW proof containing four components:

• The parent chain's coinbase transaction (proving the auxiliary block hash was included)
• A Merkle branch linking the coinbase transaction to the parent block's Merkle root
• The parent block header (80 bytes, containing the Merkle root and the hash that met the difficulty target)
• If multiple auxiliary chains are mined: the Merkle branch within the auxiliary chain Merkle tree

The auxiliary chain node verifies this proof by checking that the coinbase contains the correct auxiliary block hash, the Merkle branches are valid, and the parent block header hashes to a value that meets the auxiliary chain's difficulty target. The auxiliary chain never needs to validate the parent chain's transactions or state: it only verifies the proof of work.

Real-World Examples

Namecoin + Bitcoin

Namecoin, a decentralized DNS system, launched in April 2011 as the first Bitcoin fork. It activated merged mining in October 2011 at block 19,200, becoming the first live implementation of AuxPoW. Both chains use SHA-256d. Today, Namecoin benefits from over 50% of Bitcoin's total hashrate, making it one of the most secure alternative blockchains in existence.

Dogecoin + Litecoin

Dogecoin adopted AuxPoW in August 2014 at block 317,337, enabling it to be merged-mined with Litecoin (both use the Scrypt algorithm). Before this change, Dogecoin's hashrate fluctuated wildly as miners hopped between the two Scrypt chains. Within one month of activating merged mining, Dogecoin's mining difficulty increased by roughly 1,500% as Litecoin mining pools began including Dogecoin blocks. By 2019, nearly 90% of Dogecoin's hashrate came from large Litecoin pools.

Rootstock (RSK) + Bitcoin

Rootstock is a Bitcoin sidechain providing EVM-compatible smart contracts, secured primarily through merged mining. As of Q1 2026, approximately 84% of Bitcoin's total hashrate (over 833 EH/s) secures RSK via merged mining, with 93% of observed mining pools actively participating. RSK has also developed several innovations including fork-aware merge mining and the DECOR block reward sharing protocol. For a deeper analysis, see the Rootstock deep dive.

Use Cases

• Bootstrapping new blockchains: a new chain using the same hash algorithm can immediately access the parent chain's massive miner network instead of building its own from scratch
• Sidechain security: merged mining is the primary security mechanism for Bitcoin sidechains like RSK, allowing them to inherit Bitcoin's proof-of-work security without requiring a separate mining ecosystem
• Additional miner revenue: miners earn block rewards from auxiliary chains at essentially zero marginal cost, improving mining profitability during periods of declining subsidies from halvings
• Preventing hash algorithm fragmentation: instead of multiple chains competing for the same pool of miners (weakening each other's security), merged mining lets them share computational resources cooperatively

Comparison to Other Shared-Security Models

Merged mining is not the only way for a blockchain to borrow security from a larger network. Two other prominent models are restaking (used in proof-of-stake ecosystems like Ethereum via EigenLayer) and federated sidechains (like the Liquid Network).

The key distinction: merged mining is the only shared-security model native to proof-of-work systems. Restaking serves a parallel function for proof-of-stake ecosystems, while federated sidechains trade decentralization for operational simplicity. For a broader comparison of Bitcoin Layer 2 trust models, see the L2 trust model comparison.

Risks and Considerations

Centralization of Auxiliary Chain Mining

A 2017 academic paper ("Merged Mining: Curse or Cure?" by Judmayer et al.) found that mining pools in merge-mined cryptocurrencies "have operated at the edge of, and even beyond, the security guarantees offered by the underlying Nakamoto consensus." A mining pool controlling a modest share of Bitcoin's hashrate can control a majority of a much smaller auxiliary chain's hashrate, potentially enabling 51% attacks.

Asymmetric Attack Incentives

A miner attacking an auxiliary chain risks almost nothing on the parent chain. The parent chain's block reward still pays out regardless of what happens on the auxiliary chain. This makes attacks on auxiliary chains far cheaper than attacks on standalone chains with equivalent hashrate, because the attacker's cost is offset by parent chain revenue.

Blind Mining

Miners may include auxiliary chain block headers without actually validating the auxiliary chain's transactions. This "blind mining" means the proof-of-work stamp of approval does not guarantee transaction validity. Invalid or malicious blocks can receive proof of work if miners are not running full auxiliary chain nodes.

Opt-In Participation

Merged mining is voluntary. Miners must actively configure their software to participate, and not all pools support every auxiliary chain. If a significant portion of parent chain miners opt out, the auxiliary chain's effective security is only a fraction of the parent chain's total hashrate. This dependence on miner cooperation creates an ongoing political and economic dynamic.

Algorithm Lock-In

Both chains must use the same hashing algorithm. A SHA-256 chain cannot merge-mine with a Scrypt chain. If the parent chain ever changes its hash algorithm (unlikely for Bitcoin, but possible for smaller chains), all auxiliary chains lose their security relationship.

Why It Matters

Merged mining addresses one of the fundamental challenges in blockchain security: how to protect new chains without duplicating the massive energy expenditure that secures established networks. As the Bitcoin mining ecosystem matures and block subsidies decline through halvings, merged mining offers miners additional revenue streams at zero marginal cost, potentially contributing to long-term mining sustainability. For a deeper look at mining economics, see the mining economics analysis.

The technique also plays a growing role in Bitcoin's Layer 2 landscape. Sidechains like Rootstock rely on merged mining as their primary security mechanism, and proposals like BIP 301 (Blind Merged Mining) aim to extend the concept further. As Bitcoin's ecosystem expands with sidechains, scaling solutions, and application-specific chains, merged mining remains one of the most energy-efficient approaches to shared security in proof-of-work systems.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.