Home/Findings/Nonce Archaeology
Finding · free in full
Nonce Archaeology
Bitcoin's hardware history, written in a number nobody looks at.
To mine a block you guess a number — the nonce — until the block's hash comes out small enough. Once you win, the number you happened to stop on is written into the block forever. It has no further use. Nobody checks it. Nobody reads it.
It turns out to be a record of what machine was doing the guessing.
The luckiest block ever mined
1,082 tries
If miners search randomly, a winning nonce should be a uniform draw from about 4.3 billion possibilities. The lowest ever recorded on the Bitcoin blockchain:
Mined 14 July 2010 at 07:18:22 UTC. Under a uniform model, stopping this low is a roughly one-in-four-million event.
| Height | Nonce | Date |
|---|---|---|
| 67,071 | 1,082 | 2010-07-14 |
| 46,554 | 1,388 | 2010-03-23 |
| 117,874 | 2,048 | 2011-04-11 |
| 490,511 | 2,108 | 2017-10-18 |
| 414,561 | 2,759 | 2016-06-03 |
| 31,650 | 3,982 | 2009-12-26 |
| 66,040 | 5,737 | 2010-07-12 |
| 313,736 | 8,130 | 2014-08-03 |
Notice that five of the eight are from 2009–2011. That is the clue, and it is not luck.
The finding
In 2010 the nonce collapsed toward zero
Average the winning nonce over each 10,000-block epoch and divide by the midpoint of the range. Uniform searching gives 1.000. Bitcoin's first years do not:
At its floor, 96.33% of winning nonces sat in the bottom half of the range — where uniform searching predicts 50%. Then, between heights 70,000 and 90,000, it climbs back to 1.000 and never leaves.
The explanation is mundane and completely legible. The original client started at nonce 0 and counted upward. A CPU in 2010 could only get so far through 4.3 billion candidates before the block changed underneath it and the search restarted from zero. So the winning nonce was almost always a small number — not because miners were lucky, but because they never reached the rest of the range.
The recovery at height ~90,000 is late 2010: GPUs arrive. Suddenly the whole range is reachable within one attempt window, and the distribution flattens to what theory expects. You can date the arrival of GPU mining from a field nobody was recording.
The part we cannot explain
It is happening again, faintly, and it is not uniform across pools
The modern chain should be indistinguishable from a uniform draw. It very nearly is — but not quite, and the deviation has a shape in time:
| Year | Blocks | mean ÷ 231 | share below midpoint |
|---|---|---|---|
| 2014 | 58,865 | 1.000 | 0.4986 |
| 2017 | 55,928 | 0.976 | 0.5011 |
| 2018 | 54,498 | 0.964 | 0.5078 |
| 2019 | 54,232 | 0.944 | 0.5312 |
| 2020 | 53,222 | 0.900 | 0.5778 |
| 2021 | 52,686 | 0.907 | 0.5711 |
| 2022 | 53,188 | 0.931 | 0.5544 |
| 2023 | 53,999 | 0.942 | 0.5392 |
| 2024 | 53,473 | 0.947 | 0.5283 |
| 2025 | 53,082 | 0.960 | 0.5201 |
| 2026 | 29,840 | 0.960 | 0.5205 |
Flat through 2014. Drifting from 2018. A clear trough in 2020, then a slow recovery that is still incomplete in 2026.
The interesting part is what happens when you split it by who mined the block, using pool tags from our own copy of the coinbase field. During the 2020–2021 trough:
| Pool | Blocks | Below midpoint | σ |
|---|---|---|---|
| F2Pool | 13,922 | 0.6026 | 24.2 |
| Binance | 7,797 | 0.5938 | 16.6 |
| Poolin | 13,219 | 0.5677 | 15.6 |
| AntPool | 13,469 | 0.5450 | 10.5 |
| Slush / Braiins | 4,182 | 0.5210 | 2.7 |
| MARA | 464 | 0.4784 | −0.9 |
That spread is the finding. A protocol-level cause would hit everyone equally. F2Pool at 24.2σ while MARA sits at −0.9σ, on the same chain in the same months, means the cause lives in equipment or firmware, not in Bitcoin's rules.
Today most of it has cleared, and one pool has not:
F2Pool 2025–26
12.5σ
ViaBTC
5.9σ
Foundry
3.4σ
AntPool
1.9σ
OCEAN
0.3σ
We do not know the mechanism. The rise brackets the adoption of overt version-rolling in mining firmware, which is suggestive — but bracketing in time is correlation, and we are not presenting it as more than that. Pool tags are also self-reported, and proxy pools blur them.
What the data supports is narrow and worth stating exactly: the modern deviation is real, dated, and pool-dependent. Why, we can't yet say.
Controls
How we know the instrument isn't lying
A pipeline that finds patterns in a field nobody audits is exactly the pipeline that should be distrusted. So:
- Uniform-draw control. 60,000 synthetic uniform draws land at mean ÷ 231 = 0.997 and share-below-midpoint = 0.5022 — theory says 1.000 and 0.5000. The measuring stick is straight.
- Internal null period. 2011 through 2014 — 236,451 blocks — reads 0.999 to 1.000, flat. If our parse were skewing nonces, it would skew them there too.
- Label shuffle. Shuffling pool labels 200 times, the real between-pool spread exceeds the 95th percentile of shuffled spreads by 2.6×. The pool split is not an artefact of how many blocks each pool mined.
Retraction
One finding here was wrong, and we killed it
An earlier version of this work reported a "universal depletion of nonce octile 1" — an apparent shortfall in the lowest eighth of the range across all eras. It did not exist.
The cause was a single cast. In DuckDB, CAST(nonce/2^29 AS INTEGER)
rounds rather than truncating, so every bin was shifted half a width, the
first "octile" was really the bottom 1/16th of the range, and its expected share was 6.25%
rather than 12.5%. A hidden ninth bucket held the missing mass — the published shares summed
to 95%, which should have been the tell.
The three findings above were re-derived after the fix and stand unchanged. We found the same bug still live in a second script and fixed that too.
We publish this with the same prominence as the claim, because a research record that only ever grows is a marketing document.
Coverage
What this is measured from
Every block from genesis to height 960,043, parsed from raw block files on our own full archival node. Pool attribution comes from our own copy of the coinbase field. No external data source was consulted for any figure on this page.
The per-block nonce series, the epoch and yearly statistics, the per-pool-per-year panels and the 500 lowest nonces ever mined are available as a sealed, Bitcoin-anchored dataset — with the manifest, samples and verifier free to download before you decide. Everything above is complete as published either way.