When the ledger is asked to remember what it was never paid to hold.
Bitcoin is the first observable thermodynamic machine whose time does not compose us.[1] Each block collapses a finite entropy field through real work, mints a finite quantity of satoshis, and commits both into a shared ledger. The conversion is exact. Every satoshi that exists was minted against the resolution of a difficulty-scaled nonce space; every byte of memory that the network carries forward is the conserved residue of an irreversible computation.
The paper that frames this analysis[2] shows that the relationship between energy, value, and memory becomes measurable inside this system. In particular, joules per satoshi — Satoshi’s Constant — converges to a fixed value at the terminal supply. [3] That convergence is what gives the ledger its physical integrity: the cost of a satoshi is not chosen, it is enumerated by the protocol out of the bounded value domain.
The integrity is what this article is about. A bounded system can be attacked only by subverting one of its bounds. The bound the network is failing to enforce — right now, in 2026 — is the one that connects physical memory to value-mass.
Every block carries two quantities that the paper keeps carefully distinct.
The first is what the paper calls τblock: the total number of bytes the block occupies, the physical memory that every fully validating node must accept, store, and serve in perpetuity. [4] τblock is the “replication cost borne by the network” — the physical mass of the block as an object.
The second is the value-mass: the configuration of satoshis that the block inscribes. Summed across the block’s outputs, this is what the paper denotes Wt: the total satoshi mass inscribed during the block. [5] In well-formed Bitcoin, the two are coupled. Every persisted byte of memory corresponds to a satoshi that justified the cost of being persisted — whether as subsidy (in which case the network pays for it out of finite issuance) or as fee (in which case the user pays for it out of value they chose to transfer).
The mapping is exact. The paper writes it formally: W · ε(232 · D) → Mt+1, where the left side is the difficulty-scaled entropy field explored by proof-of-work, and the right side is the new memory state committed to the ledger. [6] “Every byte of memory written on the right corresponds to energy expended in traversing the field on the left. Nothing is inferred; nothing is hidden.”
What has changed since 2022 is that this correspondence no longer holds for every byte.
Rolf Landauer proved that erasing information has a thermodynamic cost. The corollary — the one this article relies on — is that creating information that is forbidden to be erased costs the same. A bit of information that is committed to a substrate that cannot opt out of storing it has been made thermodynamically permanent. The persistence of that bit is a debit against the universe’s energy budget, whether or not anyone pays the bill at the time of creation.
Bitcoin makes this sharper. The paper tightens the classical bound to the protocol’s native form: Eerase ≥ Trelative · EP · ln 2, where Trelative is the dimensionless participation ratio relative to Planck temperature. [7] The point is not that someone will pay to erase the bit. The point is that the bit has been made un-erasable at the consensus level, and that un-erasability is itself a thermodynamic commitment.
The miner pays for the act of resolution: the joules that collapse the entropy field into a valid block. The nodes pay for the persistence: the disk, the RAM, the bandwidth, the validation cost of carrying that resolved structure forward forever. These are two different debts. The miner’s debt is paid once, in joules. The nodes’ debt is paid in perpetuity, in storage.
The protocol’s design assumes the two debts are paid by the same party — that the writer of a byte is also the bearer of its persistence. Landauer’s principle makes that assumption physical. When the assumption is broken, the debt is externalized.
Define the attack precisely.
Begin with a payload — an image, a string, a token table, an inscription, a BRC-20, a Citrea commitment, any sequence of bytes that is not itself a satoshi transfer. Wrap it in a witness structure that the protocol discounts in block weight. Pay a one-time fee denominated in sat/vB. Submit the transaction. A miner includes it. The block is accepted.
What happened, thermodynamically?
The writer paid a fee: a transfer of satoshis from one address to another. This is a reallocation within the bounded value-mass. It does not change Wt — the total value-mass inscribed in the block. It does not change the protocol’s supply schedule. It does not pay the persistence cost of the bytes it has just been used to enshrine.
The miner received the fee: a reallocation to a single coinbase output. Again, no new value was created. Again, the value-mass is unchanged.
What did change is τblock. The block is now larger by the size of the data. Every full node, forever, must store, validate, and serve those bytes. The replication cost has increased. The persistence cost has increased. The physical mass of the block has increased.
But the value-mass has not. The bytes are written. The sats are accounted. And the cost of persisting the bytes — the Landauer bill — has been transferred to every node operator on Earth, with no compensation, in perpetuity.
That is the Landauer attack. It is a consensus-certified externalization of thermodynamic debt. It is enabled by the very feature that makes Bitcoin trustworthy: its irreversibility. The writer uses the network’s most expensive property — its commitment never to forget — to convert a one-time fee into permanent global storage.
One natural response is: the fee market already prices block space. A miner will only include a transaction if the fee is high enough. Won’t competition among writers keep the τblock cost in line?
No. The fee market prices one-time inclusion. It does not price perpetual storage. The two are unrelated. A miner accepts a fee and emits a block; the storage cost is paid by the network, not by the miner. There is no market mechanism in Bitcoin that amortizes the lifetime replication cost of a byte back to the writer. [8]
This is the same shape as a textbook externality. A factory can dump waste into a river because the cost of the river’s degradation is paid by everyone downstream, not by the factory. Bitcoin’s consensus rules — which make every byte unforgeable, unprunable from a full node, and permanent — are the river. Fees are not pricing the river. Fees are pricing the right to dump.
Worse: because the witness discount makes data artificially cheap in block-weight terms, the fee market under-prices data relative to its actual persistence cost. A megabyte of non-witness bytes costs four times as much in fees as a megabyte of witness bytes. A megabyte of witness bytes costs the same in storage. The fee market, in other words, is structurally biased toward the exact kind of attack described above.
The metric at the center of this analysis is τblock — the value-mass of the value-mass ratio: bytes of physical memory committed per satoshi of value inscribed in a block. The chart we would draw here, if the data were available inline, plots this ratio from genesis to tip on a log-log axis. Two regimes would be visible at a glance.
Pre-2022, the line tracks the halving schedule. As block subsidies fall, fees rise to compensate, and the bytes-per-value ratio stays roughly constant — each satoshi of inscribed value continues to back a roughly fixed amount of physical memory. The shape is monotonic: rising slowly, halving-stepped, never breaking the trend.
Post-2022, the line breaks upward. Inscriptions, BRC-20, Taproot annex abuse, and oversized witness pushes push block bytes higher without raising the value-mass. The curve goes the wrong way. The chart would show a vertical structural break at the SegWit-activation line, a slow climb through 2021, and a sharp upward break at the first inscription block, followed by sustained inflation that does not return to trend.
The chart is omitted here because the underlying dataset requires a one-time augmentation step that the host of this page does not currently run. The metric itself is recoverable from any block explorer: take block_size divided by coinbase + fees for any block, plot it on a log axis, and the structural break is unmistakable.
The paper defines joules per satoshi as the energetic price of one value-bit’s persistence: ε(t) = EP / C(t), where EP is Planck energy and C(t) is the cumulative realized supply at block t. [3] This is the system’s invariant: the cost of a satoshi, denominated in work.
But that invariant prices the value, not the memory. It is silent on whether the memory is paid for. The Landauer attack exploits that gap. It does not change C(t). It does not change ε(t). It changes τblock, the mass the network must carry, and it changes it in a way the invariant does not register.
Stated more sharply: each satoshi must now back more bytes. The mass-to-value ratio is increasing. The paper’s boundedness — the property that makes Bitcoin a money rather than a token — requires that this ratio be enforced, not merely described. [9] If the ratio is allowed to grow without bound, the bounded value-domain is no longer the dominant constraint on the system. The memory surface becomes dominant. Bitcoin is no longer money plus an audit trail; it is a global write-once filesystem with a monetary front end.
This dilution is invisible in price. It is legible in the chart above. The post-2022 break is not a market cycle. It is a structural change in the physical object.
In December 2025, Dathon Ohm submitted BIP-110, “Reduced Data Temporary Softfork.” [10] It is the first consensus-level proposal that addresses the Landauer attack directly. It is explicitly framed as a rejection of “the standardization of data storage as a supported use case at the consensus level.” [11]
Its rules are a precise mapping of the attack’s vectors:
Each rule addresses a specific way the Landauer attack has been implemented. Read together, they are a defense of the boundedness of the memory surface.
BIP-110 is also explicit about what it is not. It is temporary — one year — and is intentionally kept simple to minimize review time. [13] The author concedes that a more comprehensive solution may be needed later. The proposal is an emergency brake, not a permanent design.
That emergency-brake character is the right intervention at the right time. It is also the structural admission the network has been avoiding.
Bitcoin’s memory surface has no protocol-level thermodynamic limit. There is a byte-size limit (1 MB pre-SegWit, 4 MB post-SegWit weight). There is a witness discount that encourages the witness-discounted data to grow. There is no rule that says “a byte of consensus memory must be backed by a satoshi of value inscribed for the purpose of being value.” The attack exists because that rule is missing.
BIP-110 closes the most exploited holes. It does not write the rule. The holes it closes will reappear in new vectors the moment the rules are obsolete, the moment Taproot upgrades, the moment a new opcode gives someone an asymmetric storage channel. The Landauer attack is not a bug in a specific implementation; it is a structural gap in the network’s accounting.
What BIP-110 demonstrates is that the gap is now considered a problem. That is progress. But the deeper work — the work that turns Bitcoin from “a chain that allows non-monetary data and occasionally apologizes” into “a chain that prices memory against value at the consensus level” — has not begun.
A real defense must recognize that the cost of persisting a bit of data is a thermodynamic debt, and that the debt must be paid by the writer — not by every node operator, forever.
The paper’s framework supplies the vocabulary. The bounded value domain C(t) is finite. The energy budget EP is finite. The mapping between joules and satoshis is fixed. What is missing is the third mapping: between the bytes a block carries and the satoshis that block inscribes. The mass-to-value ratio τblock / Wt — the chart above — is the natural quantity. A protocol that prices memory against value would hold this ratio in a bounded range, just as the protocol holds C(t) bounded and the difficulty adjusts to keep block-time bounded.
Until that accounting exists, the Landauer attack continues. It is not a side effect. It is the predictable consequence of a system that guarantees permanence but does not price it.
BIP-110 is a year. What is owed is a permanent rule.