Bitcoin Mining Nonce Reference: How Miners Find Valid Blocks

The Proof-of-Work Puzzle

Bitcoin mining reduces to a single operation: hash an 80-byte block header with SHA-256d (double SHA-256) and check whether the resulting 256-bit digest falls below a target threshold. If it does, the block is valid. If not, the miner changes a field in the header and tries again. The field most commonly changed is the nonce: a 4-byte (32-bit) counter that exists solely to give miners something to iterate.

This process is called proof-of-work because the only way to find a valid hash is brute force. SHA-256 is a one-way function: you cannot reverse-engineer which input produces a hash below the target. Each attempt is an independent trial with the same vanishingly small probability of success.

Block Header Structure

Every Bitcoin block header is exactly 80 bytes, composed of six fields. The miner hashes this entire structure, so changing any single byte produces a completely different SHA-256d output.

The nonce provides 2³² (4,294,967,296) possible values. At today's difficulty, that search space is exhausted by a modern ASIC miner in well under one second, which is why miners need additional sources of entropy.

Extranonce: Expanding the Search Space

When 2³² nonce values are not enough, miners modify the coinbase transaction (the first transaction in every block, which creates new bitcoin). The coinbase's scriptSig field can hold 2 to 100 bytes of arbitrary data. Miners reserve a portion of this space as the "extranonce."

Changing any byte of the coinbase transaction changes its hash, which propagates up through the merkle tree, producing a new merkle root in the block header. This gives the miner an entirely fresh set of 2³² nonce values to iterate. In the Stratum protocol, the extranonce is split into two parts:

• ExtraNonce1 (assigned by the pool): typically 4 to 8 bytes, unique per connection, ensuring no two miners search overlapping hash space
• ExtraNonce2 (controlled by the miner): typically 4 to 8 bytes, incremented locally to generate new work

With 8 bytes of extranonce plus 4 bytes of nonce, miners have access to 2⁹⁶ combinations (approximately 7.9 × 10²⁸): sufficient for current-generation hardware. Miners can also vary the timestamp (within protocol rules) and use version-rolling (flipping unused version bits) for additional entropy.

Target and Difficulty

The bits field in the block header encodes the target using a compact floating-point format: 1 byte for the exponent and 3 bytes for the coefficient.

Target formula: target = coefficient × 2^(8 × (exponent - 3))

The maximum target (difficulty 1) is defined by bits = 0x1d00ffff, which decodes to a 256-bit number with roughly 32 leading zero bits. Difficulty is then calculated as:

Difficulty formula: difficulty = target_max / current_target

A higher difficulty means a lower target, meaning the hash must have more leading zeros. Every 2,016 blocks (roughly two weeks), the network recalculates the target by comparing actual block production time against the expected 2,016 × 10 minutes = 20,160 minutes. If blocks came too fast, the target decreases (difficulty increases); if too slow, the target increases. This is the difficulty adjustment mechanism that keeps the average block interval at 10 minutes regardless of how much hashrate joins or leaves the network.

Probability and Expected Hashes

Each SHA-256d attempt is an independent Bernoulli trial. The probability of any single hash being valid is:

P(valid) = 1 / (difficulty × 2^32)

At the May 2026 difficulty of approximately 136.6 trillion, the expected number of hashes to find one valid block is:

136,610,000,000,000 × 2^32 ≈ 5.87 × 10^23 hashes

That is roughly 587 sextillion hash attempts per block. With the network running at approximately 960 EH/s (9.6 × 10²⁰ hashes/second), the expected time to find a block across the entire network is about 612 seconds (10.2 minutes): closely matching the 10-minute target. Because each hash is memoryless, block discovery follows a Poisson process: sometimes blocks arrive in under a minute, sometimes they take over an hour.

For solo miners, the math is stark. A single Antminer S21 operating at 200 TH/s would need, on average, 2.94 × 10¹² seconds (approximately 93,000 years) to find a block alone. This is why almost all mining is done through mining pools, where participants share work and split rewards proportionally. Use the mining calculator to estimate expected revenue for specific hardware configurations.

Difficulty Milestones

Bitcoin's difficulty has grown by a factor of over 100 trillion since the genesis block, reflecting the exponential increase in dedicated mining hardware.

For more context on difficulty adjustments over time, see the difficulty adjustment tracker and our research on Bitcoin mining economics in 2026.

Hashrate Growth

Network hashrate measures the total computational power dedicated to mining. Each order-of-magnitude increase roughly corresponds to a hardware generation shift or a major expansion in mining infrastructure.

The network first crossed 1 ZH/s (1,000 EH/s) in April 2025. As of May 2026, hashrate fluctuates around 960 EH/s, occasionally exceeding 1 ZH/s during peak periods. This hashrate is distributed across mining pools worldwide, with Foundry USA, AntPool, and ViaBTC consistently among the largest.

Mining Hardware Generations

The nonce-grinding speed of the network depends entirely on mining hardware. Each generation of ASIC miners delivers more hashes per second while consuming less energy per hash.

The S9 at 14 TH/s exhausts the 4-byte nonce space (2³² hashes) roughly 307 times per second. The S23 Hydro at 580 TH/s exhausts it approximately 135,000 times per second, requiring constant extranonce cycling. The S23 Hydro 3U variant reaches 1.16 PH/s in a single unit: the first consumer-purchasable machine to exceed one petahash.

For a deeper analysis of mining profitability across hardware generations, see our research on mining economics in 2026.

How Pool Mining Works

The Stratum protocol (V1) coordinates work distribution between pools and miners via JSON-RPC over TCP. The process follows a defined sequence:

1. The miner connects and calls mining.subscribe. The pool responds with a unique ExtraNonce1 and the ExtraNonce2 size.
2. The pool pushes work via mining.notify, providing the previous block hash, coinbase template (split into two parts around the extranonce position), merkle branches, version, bits, and timestamp.
3. The miner constructs the full coinbase transaction by concatenating: Coinbase1 + ExtraNonce1 + ExtraNonce2 + Coinbase2.
4. The miner hashes the coinbase, computes the merkle root using the provided branches, assembles the 80-byte block header, and iterates the nonce.
5. When the miner finds a hash below the pool's share target (easier than the network target), it submits the ExtraNonce2, timestamp, and nonce via mining.submit.

Because each connection gets a unique ExtraNonce1, no two miners ever search the same hash space. Stratum V2, a newer protocol, adds binary framing, encryption, and allows miners to select their own transaction sets: an important step for mining decentralization.

Hashrate Units Reference

Mining discussions use SI-prefixed hash rate units. Each step represents a 1,000x increase.

Frequently Asked Questions

What is a nonce in Bitcoin mining?

The nonce is a 4-byte (32-bit) field in the Bitcoin block header that miners increment to produce different SHA-256d hashes. It provides 2³² (about 4.3 billion) possible values. The miner iterates through nonce values looking for a hash that falls below the current difficulty target. Because modern ASICs exhaust all 4.3 billion nonce values in a fraction of a second, miners also modify the extranonce in the coinbase transaction and use techniques like version rolling to access a much larger search space.

Why is 4 bytes not enough for the nonce?

When Satoshi Nakamoto designed Bitcoin in 2008, a 32-bit nonce (4,294,967,296 values) was more than sufficient for CPU mining at a few megahashes per second. At that rate, exhausting the nonce space took thousands of seconds. Today, an Antminer S23 at 318 TH/s exhausts the nonce space roughly 74,000 times per second. The extranonce mechanism, timestamp manipulation, and version-rolling collectively expand the effective search space to 2⁹⁶ or more combinations, making the 4-byte limitation irrelevant in practice.

How does Bitcoin adjust mining difficulty?

Every 2,016 blocks (approximately every two weeks), the network compares the actual time taken to mine those blocks against the expected 20,160 minutes. If blocks arrived faster than 10 minutes on average, difficulty increases proportionally; if slower, it decreases. The adjustment is capped at a 4x change in either direction per period. This difficulty adjustment mechanism is what maintains the approximately 10-minute block interval regardless of how much hashrate is on the network.

What is the current Bitcoin mining difficulty?

As of May 2026, Bitcoin's mining difficulty is approximately 136.6 trillion. This means the expected number of SHA-256d hashes required to find a valid block is about 5.87 × 10²³. The difficulty has risen by roughly 34% from 101.65 trillion in November 2024, driven by continued deployment of 3nm and 5nm ASIC hardware. Check the difficulty adjustment tracker for real-time values.

How many hashes does it take to mine a Bitcoin block?

On average, difficulty × 2^32 hashes. At the current difficulty of 136.6 trillion, that works out to approximately 5.87 × 10²³ hashes (587 sextillion). However, because each hash is an independent random trial, the actual number for any given block varies widely. Some blocks are found in seconds, others take over an hour. The distribution follows a geometric probability model (memoryless), so the "expected" value is the mean, not a guarantee.

What is the difference between nonce and extranonce?

The nonce is a 4-byte field in the block header itself. The extranonce is arbitrary data placed in the coinbase transaction's scriptSig field. Changing the extranonce changes the coinbase transaction hash, which changes the merkle root in the block header, giving the miner a completely new set of 2³² nonce values to try. In pool mining, the extranonce is split into ExtraNonce1 (assigned by the pool to ensure non-overlapping work) and ExtraNonce2 (incremented by the miner). Together with the nonce, they provide 2⁹⁶ or more combinations.

Can a miner predict which nonce will produce a valid hash?

No. SHA-256 is designed so that its output appears uniformly random for any given input. There is no mathematical shortcut to determine which nonce (or any other header modification) will yield a hash below the target. Every attempt has the same probability of success: 1 / (difficulty × 2^32). This unpredictability is fundamental to Bitcoin's security model. If someone found a shortcut, it would break proof-of-work entirely.

This reference is for informational and educational purposes only and does not constitute financial or investment advice. Mining difficulty, hashrate figures, and hardware specifications change frequently. Always verify current network data and hardware specs from primary sources before making mining decisions.