Disclosure: I operate BTC PoW Lab Pool and run BTC PoW Lab.
BTC PoW Lab is an independent research project studying exact structural properties, implementation boundaries and potential optimizations inside Bitcoin’s double SHA-256.
One of our main rules is to keep several very different claims separate:
- An exact mathematical property
- An empirical correlation
- A reusable computational capability
- A cheaper source-side selector
- A physical implementation improvement
- An end-to-end Bitcoin mining advantage
A result may be scientifically valid and useful without satisfying the last categories. This experiment is a good example.
The question
Suppose a Bitcoin block hash satisfies a B60 low-hash condition, meaning that its displayed hash begins with at least 60 zero bits.
How far can that condition be propagated backward through the second SHA-256 compression?
More specifically:
At what internal SHA-256 frontier does an exact B60 certificate stop depending on only part of the eight-word state and begin requiring the complete state?
If a compact certificate remained available sufficiently early, it might become relevant to an early filtering mechanism. If it rapidly expanded to the complete state, it would remain an exact late-stage classifier but would not provide cheap source-space skipping.
Preregistered experiment
The experiment was preregistered as:
LOWHASH-B60-BACKWARD-CONE-B1-001
The certificate equations, frontier range, controls and decision rule were frozen before opening the complete audit cohort.
This was not a search across many correlations followed by selecting the best-looking result. It was an exact structural derivation with a finite implementation audit.
The cohort contained:
- 1,914 historical Bitcoin B60-positive headers
- 1,914 matched controls
- 11 internal SHA-256 frontiers, from S62 backward to S52
- Complete SHA256d truth for every case
The historical positive corpus is outcome-selected, so it cannot be used to estimate enrichment probabilities such as P(B76 | B60). That was not the purpose of this experiment.
It was used only to verify a frozen exact certificate against known positive cases and matched negative controls.
Exact B60 certificate
At frontier S62, the B60 condition can be decided from only two of the eight SHA-256 state words:
(f62 + IV7) == 0
and
((e62 + IV6) & 0xF0FFFFFF) == 0
From there, the experiment transported the required dependency cone backward one frontier at a time.
For context, T1 is one of the standard SHA-256 round-update components. A “T1-only” step means that the required certificate can still be advanced without reconstructing every component of a complete SHA-256 round.
Results
| SHA-256 frontier |
Required state words |
Required continuation |
| S62 |
2/8 — e,f |
Direct exact certificate |
| S61 |
5/8 — d,e,f,g,h |
1 T1-only step |
| S60 |
6/8 — c..h |
2 T1-only steps |
| S59 |
7/8 — b..h |
3 T1-only steps |
| S58 |
8/8 — a..h |
4 T1-only steps |
| S57 |
8/8 |
1 complete round + fixed suffix |
| S56 |
8/8 |
2 complete rounds + fixed suffix |
| S55 |
8/8 |
3 complete rounds + fixed suffix |
| S54 |
8/8 |
4 complete rounds + fixed suffix |
| S53 |
8/8 |
5 complete rounds + fixed suffix |
| S52 |
8/8 |
6 complete rounds + fixed suffix |
The audit executed:
11 × (1,914 positives + 1,914 controls)
= 42,108 exact checks
At every frontier:
- 1,914/1,914 positive cases were accepted
- 0/1,914 controls were accepted
- 0 false positives
- 0 false negatives
- 0 disagreements with complete SHA256d
The independent package audit also passed all 15 checks covering nine payloads.
The final recorded decision was:
B60_WORD_CONE_BECOMES_FULL_AT_S58
What was demonstrated
The B60 condition has an exact backward certificate extending from S62 to at least S52.
The certificate is particularly compact at S62, where only two state words are necessary. Its dependency cone then expands predictably:
2/8 → 5/8 → 6/8 → 7/8 → 8/8
S58 is the first tested frontier at which all eight SHA-256 state words become necessary.
Therefore, backward certainty does not end at S61. It continues further—but it stops being a partial-state representation at S58.
What was not demonstrated
This is not an early Bitcoin nonce selector.
Knowing the message-schedule words W52–W61 together with the complete S52 state is sufficient to classify B60 exactly. However, producing that S52 state still requires propagating each source through the earlier SHA-256 work.
The certificate does not currently:
- Predict successful nonces from the Bitcoin header input
- Avoid constructing the required internal state
- Skip a measurable part of the nonce domain
- Increase success probability per hash
- Demonstrate reduced end-to-end work
- Demonstrate a physical ASIC, CPU or GPU speedup
Moving farther backward progressively approaches transporting or recomputing the complete SHA-256 state.
This makes the result an exact target-side classification boundary, not a demonstrated mining advantage.
Why the boundary matters
Late-round SHA-256 structure is sometimes described as though exact classification automatically implies early prediction.
It does not.
A usable mining selector would need to begin from information cheaply available at the legal Bitcoin source:
fixed job midstate
+ variable header/nonce
→ inexpensive early predicate
→ continue only selected candidates
Its complete cost—including message-schedule construction, state propagation, false positives, fallback and surviving SHA work—would then need to beat an equivalent ordinary SHA256d baseline.
This experiment identifies the opposite boundary: where an exact backward property becomes dependent on the complete internal state.
That is useful because it closes one route cleanly and prevents a mathematically exact but operationally late result from being promoted as a shortcut.
Relationship to BTC PoW Lab Pool
BTC PoW Lab Pool has integrated seven specific advantage tracks derived from discoveries made by the BTC PoW Lab research project.
Reproduction and criticism
The experiment has a preregistration, implementation, final JSON report, package manifest, independent audit and sealed review ZIP.
Review ZIP SHA-256:
f8d4c8b10d8c82cab5a5c8d3e0dd242a88cd87b32b2e4c44a5c8265a761f7e33
I welcome attempts to reproduce the certificate, identify an error in the interpretation or propose a genuinely source-connected mechanism that could move the useful decision boundary earlier.