MASTERING-BITCOIN · Interactive Practice | Unit 13 · Video 4

The 10-Minute Heartbeat: Bitcoin's Lottery

IKey Formulas

Formula	Name	Description
$E[\text{tries}] = 16^{k}$	Expected hash attempts	For $k$ leading hex zeros
$\text{target} = \text{coeff} \times 2^{8(\text{exp} - 3)}$	Compact target decoding	E.g., `0x1903a30c` → exponent 0x19, coefficient 0x03a30c
$T_{\text{new}} = T_{\text{old}} \cdot \dfrac{t_{\text{actual}}}{20160 \text{ min}}$	Difficulty retargeting	Every 2016 blocks; capped at 4× either way
$\text{MTP} = \text{median}(t_{-11}, \dots, t_{-1})$	Median Time Past	Consensus time floor (BIP113)

IIVisualization 1: The Mining Lottery

Mining is trial and error: keep changing the nonce until the hash starts with enough leading hex zeros. Each leading zero is 4 bits, so it multiplies the expected work by 16.

Use the slider to set the number of required leading hex zeros and watch the expected number of attempts explode.

⚙ interactive visualization — coming to this page format soon

Notice: Each additional leading zero multiplies the expected work by 16. That's why Bitcoin uses a 256-bit target instead of "count the leading zeros" — it allows fine-grained adjustment of difficulty. Verification, however, stays trivial: one hash check.

IIIVisualization 2: Difficulty Retargeting

Every 2016 blocks (~2 weeks at 10 min each = 20160 minutes), every node independently recomputes the target:

$T_{\text{new}} = T_{\text{old}} \cdot \frac{t_{\text{actual}}}{20160}$

The adjustment is capped at 4× in either direction — a safety guardrail against hash-rate whiplash.

Drag the slider to set how long the previous 2016 blocks actually took.

⚙ interactive visualization — coming to this page format soon

Reflect: If hash power doubles overnight, blocks arrive twice as fast and the multiplier would drop toward 0.5 — but only after 2016 blocks have been mined. Bitcoin doesn't adjust continuously; difficulty steps in discrete jumps every two weeks.

IVVisualization 3: Median Time Past (MTP)

Miners write their own timestamps. To prevent lying, consensus requires a candidate block's timestamp to exceed the median of the previous 11 block timestamps (and be less than 2 hours ahead of wall-clock time). Since BIP113, all timelocks (CLTV, CSV, nLockTime, nSequence) compare against MTP — not the candidate's stamped time.

Use the slider to inject a "cheater" timestamp into one of the recent 11 blocks and see whether the median moves.

⚙ interactive visualization — coming to this page format soon

Notice: Tampering a single timestamp barely moves the median. To shift MTP meaningfully, an attacker must lie consistently across at least 6 of the last 11 blocks — meaning they must have mined most of them. The incentive to single-block-lie collapses.

VQuiz Questions

Question 1

You are mining a toy version of Bitcoin where the target requires the hash to start with 3 leading hex zeros. What is the expected number of nonce attempts to find a valid block?

✅ Correct! Each leading zero multiplies expected work by 16, so $16^3 = 4096$ .

❌ Not quite. You multiplied 16 × 3 instead of exponentiating. Each leading zero is independent, so probabilities multiply.

❌ Not quite. Each additional leading hex zero multiplies expected attempts by 16.

Show solution

Solution:

Each leading hex zero has probability $\frac{1}{16}$ (since each hex digit takes 16 possible values). For $k$ independent leading zeros:

$E[\text{tries}] = 16^k$

For $k = 3$ :

$16^3 = 4096$

Note: $48 = 16 \times 3$ is the common trap — multiplying instead of exponentiating.

Question 2

The previous retargeting period of 2016 blocks took 40,320 minutes (twice as long as the expected 20,160 minutes). What happens to the target at the next adjustment?

✅ Correct! When actual time > expected, target grows (easier), pushing block times back toward 10 minutes.

❌ Not quite. Remember: $T_{\text{new}} = T_{\text{old}} \times (t_{\text{actual}} / 20160)$ . If blocks are too slow, the target must grow to make mining easier.

Show solution

Solution:

Apply the retargeting formula:

$T_{\text{new}} = T_{\text{old}} \cdot \frac{t_{\text{actual}}}{20160} = T_{\text{old}} \cdot \frac{40320}{20160} = T_{\text{old}} \cdot 2$

Blocks took longer than expected → network is too slow → target should expand (become easier).
Multiplier of 2 is within the 4× cap, so it applies fully.
A larger target means more hashes qualify, so blocks are easier to find.

Question 3

True or False: A miner can unlock a time-locked transaction early by simply writing a future timestamp into the block header they're currently mining.

✅ Correct! Timelocks check against MTP (median of previous 11 timestamps), not the candidate block's own stamp. BIP113 anchors timelocks to consensus history.

❌ Not quite. Before BIP113 this attack was conceivable, but the rule was changed precisely to prevent it. Timelocks now check MTP.

Show solution

Solution:

False. Since BIP113, all timelocks (CLTV, CSV, nLockTime, nSequence) are evaluated against Median Time Past (MTP) — the median of the previous 11 block timestamps — not against the candidate block's own stamped time.

Wall time written by the miner is tolerated within ±2 hours and is only used for the difficulty retargeting calculation.
MTP is the consensus time. To shift MTP by even a few minutes, an attacker would need to lie consistently across at least 6 of the last 11 blocks — meaning they must have mined most of them.
A single forged future timestamp doesn't change MTP and thus can't unlock anything early.

Question 4

Block 277,316 stored its target as the compact value 0x1903a30c. Using $\text{target} = \text{coeff} \times 2^{8(\text{exp} - 3)}$ , what is the exponent in base-10 and what power of 2 does the formula evaluate?

✅ Correct! 0x19 = 25, and $8 \times (25 - 3) = 176$ .

❌ Not quite. Watch the conversion: 0x19 is hex for 25, not 19.

❌ Not quite. The compact format is: first byte is the exponent ( $0x19 = 25$ ), next three bytes are the coefficient, and the formula is $\text{coeff} \times 2^{8(\text{exp}-3)}$ .

Show solution

Solution:

Split 0x1903a30c into its compact form:

First byte (exponent): 0x19 = 25 in decimal
Next three bytes (coefficient): 0x03a30c

Plug into the formula:

$\text{target} = 0x03a30c \times 2^{8 \times (25 - 3)} = 0x03a30c \times 2^{8 \times 22} = 0x03a30c \times 2^{176}$

This yields a 256-bit number with roughly 60 leading zero bits — the ceiling that any valid header hash must fall below.

Solved: 0 / 4