Bitcoin’s Hidden Hashrate: Who Actually Secures the Network

The Number Everyone Quotes, and the Owners Nobody Can Name

Somewhere between roughly 940 exahashes and just over one zettahash per second of raw computing power stands guard over more than $1.6 trillion of Bitcoin. That figure, the network hashrate, shows up in every mining headline, on every dashboard, and in almost every argument about how safe the chain is. It gets treated as a single, clean fact. It is not. Behind it sit millions of machines owned by a crowd that is mostly anonymous, partly offshore, and shrinking in the one corner that files public paperwork. The Bitcoin miners you actually read about, the Nasdaq-listed operators with earnings calls, investor decks, and multibillion-dollar AI leases, run only about a third of that hashrate, and their share is falling.

This article is about the other two-thirds. Who are they, why do they stay out of view, and what does it mean that the majority of Bitcoin’s security is supplied by operators who will never appear on a public scoreboard? The question matters more in 2026 than it has in years. BTC trades near $84,286, up about 3.8 percent on the week, and the rally has begun pulling idled machines back online. At the same time, the listed mining sector is quietly walking away from the network, redirecting power and data-center floor space to artificial-intelligence tenants that pay far more per megawatt. The visible minority is getting smaller. The invisible majority is doing relatively more of the work. And every tool we use to watch the network measures the aggregate effort, never the identities behind it.

A Quick Refresher: Hashrate Is Work, and It Is an Estimate

Hashrate is the number of SHA-256 guesses that miners collectively make each second while racing to find the next block. It is the physical work, burned as electricity through purpose-built chips, that makes rewriting Bitcoin’s history prohibitively expensive. Crucially, nobody meters it directly. There is no sensor on the network counting hashes. The figure everyone quotes is inferred from two things the chain does reveal: the mining difficulty and how fast blocks are actually arriving. The rule of thumb is that hashrate equals difficulty multiplied by 2 to the 32nd power, divided by the 600-second block target.

Difficulty currently sits at 132.76 trillion, after a 4.16 percent upward retarget on 19 September, the second increase in a row. That implies a network of roughly 950 EH/s. Smoothed seven-day and thirty-day readings hover near 940 EH/s; noisier single-day spot readings occasionally top a zettahash. Treat any single figure as an estimate with a real margin of error, and treat difficulty, which is reset by consensus every 2,016 blocks, as the only hard anchor beneath it. The record was about 1,162 EH/s (1.16 ZH/s) on 19 October 2025, and the seven-day average slipped back under a zettahash in January 2026. (If a dashboard tells you the all-time high was 1.43 ZH/s, that is a well-known auto-summary glitch, not a real reading.)

What all that work buys is a security budget. At the current 3.125 BTC block subsidy and a price near $84,000, miners collectively earn roughly $14 billion a year to defend the chain, with transaction fees adding under one percent on top. The mechanics of how difficulty self-corrects, and the one genuine bug buried in that machinery, are a story of their own, told in our explainer on Bitcoin’s difficulty and the fight to fix the timewarp loophole. For this piece, the only point that matters is this: the number is an estimate of aggregate work, and it says nothing at all about who is doing it.

The Visible Minority: Listed Miners Are About a Third of the Network

Start with what we can see clearly. CoinShares tracks the cohort of publicly listed Bitcoin miners, the companies with tickers, filings, and quarterly disclosures. In the second quarter of 2026, that whole cohort produced a combined realized hashrate of 319 EH/s against a network of roughly 957 EH/s. That is close to a third. Count nameplate capacity instead of realized output and the number rises: aggregators that add up every announced fleet put tracked public hashrate nearer 45 percent. Both figures point the same way. The listed sector, the part of the industry that Wall Street analysts model and financial media cover, is a minority of the network.

The gap between those two numbers, realized versus nameplate, is itself a lesson in how much of the picture is inferred rather than observed. Nameplate is what a company has energized on paper; realized is the work its machines actually contributed once curtailment, downtime, maintenance, and demand-response events are subtracted. A fleet advertised at 70 EH/s can deliver meaningfully less in a hot Texas summer. If even the transparent, filing-obligated part of the industry carries that much slack between claim and delivery, the opaque part is fuzzier still.

Individually, even the giants are small slices. Marathon (MARA) has energized around 70 EH/s, Bitdeer roughly 63 EH/s realized, Riot about 44 EH/s, CleanSpark near 39 EH/s. Each of those is a household name in mining, and each accounts for only a few percent of global hashrate. There is no dominant owner. There is a long, loud front row of public companies that, added together, still leaves most of the auditorium in the dark.

And It Is Shrinking: The AI Pivot Is Pulling the Visible Fleet Off the Network

The minority is not just small; it is contracting, and faster than the network around it. The public cohort’s realized hashrate fell 13.4 percent over the six months from Q4 2025 to Q2 2026, while the network as a whole fell 10.6 percent. Strip out one outlier and the divergence is starker: excluding Bitdeer, the listed cohort shed 21.2 percent of its hashrate in that window. The companies that publish the most data are the ones walking off the network the fastest.

The reason is arithmetic, not sentiment. A megawatt pointed at AI and high-performance computing now earns multiples of what the same megawatt earns hashing Bitcoin. The numbers inside the public cohort are stark. Core Scientific booked $136.7 million of colocation revenue in Q2 against just $27.5 million from mining, so leasing was 83 percent of sales, up from 67 percent a quarter earlier. TeraWulf reached $31.9 million of HPC lease revenue, 71 percent of its total, against $12.8 million from mining. Once a miner signs a fifteen-year data-center lease with an investment-grade tenant, it does not switch back. The CoinShares Q2 report, authored by researcher Luke Nolan, called the shift “structurally irreversible” for most operators.

Analysts have stopped pretending otherwise. John Todaro of Needham has said “investors are almost exclusively valuing Bitcoin miners for their HPC and AI opportunities at this point” because “the revenue per megawatt and EBITDA margins are far higher for HPC and AI colocation than for mining.” James Butterfill, head of research at CoinShares, has described this as “one of the most challenging periods” for miners, projecting that some listed operators will draw as much as 70 percent of revenue from AI by the end of 2026, up from roughly 30 percent, against more than $70 billion of announced AI and HPC contracts sector-wide. The practical upshot for our question is simple: the transparent part of Bitcoin’s security is retreating, and the opaque part is inheriting the network by default.

So Who Runs the Other Two-Thirds?

If listed companies run a third and less every quarter, the majority belongs to five overlapping groups, none of which owes anyone a disclosure. First, private industrial fleets: machines owned by funds, family offices, trading desks, and private companies, often hosted at third-party sites under confidential contracts. Second, offshore operators in jurisdictions that publish no mining statistics and, in several cases, prefer it that way. Third, sovereign and state-linked miners that treat hashrate as energy policy. Fourth, a long tail of small commercial and self-hosted miners, from container farms behind a gas well to a single machine in a garage. Fifth, hashrate that is pooled under a coordinator whose individual member-owners are simply never named.

The closest proxy we have for locating any of this is geography, and geography is itself an estimate assembled from pool-login IP data and voluntary surveys. The most recent country snapshot from Hashrate Index, its Q2 heatmap, puts the United States around 37 percent, Russia near 17 percent, and China at roughly 12 percent, with a scatter of smaller hubs behind them. Outside the United States, a large share of that hashrate is privately held or state-linked and surfaces in no public filing anywhere. The map below is the best view we have, and it is deliberately low-resolution.

Source figures are the Q2 heatmap and are estimates; illegal or unreported mining is, by definition, hard to count. The point is not the exact decimals. It is that the two largest non-US blocks of hashrate, Russian and Chinese, are also two of the least transparent, and together they are on the order of a quarter to a third of everything securing the chain.

Pools Are Not Owners: Two Different Questions About Control

Here is where most coverage blurs a crucial line. Ask “who controls Bitcoin’s hashrate” and you get one very confident answer: three pools do. Foundry USA sits near 24.6 percent of blocks, AntPool near 22.1 percent, and F2Pool near 15.7 percent, with ViaBTC around 10 percent and SpiderPool around 7 percent behind them. The top three coordinate close to two-thirds of all blocks. That concentration is real, and it is visible.

But a mining pool does not own the machines. It coordinates hashrate that thousands of independent operators voluntarily point at it, assembles candidate blocks, and pays contributors per share, usually through a full-pay-per-share scheme that lets the pool absorb the variance so individual miners get steady income. Any of those contributors can redirect a config file and switch pools in minutes. So the answer to “who controls the hashrate” splits in two. By pool, control is concentrated in a few coordinators and quite visible. By owner, it is fragmented across a mostly private, mostly anonymous base that no dashboard can enumerate.

That distinction is more than semantics, because block construction, the power to include or exclude transactions, lives at the pool layer, not the ownership layer. It is why non-custodial and miner-chooses-transactions designs draw so much attention: OCEAN builds pools around non-custodial payouts, and the Stratum V2 protocol lets individual miners select their own transaction sets rather than accept the pool’s template. It is also worth noting who runs the two biggest pools: Foundry belongs to Digital Currency Group, and AntPool is tied to Bitmain, the same firm that builds most of the world’s ASICs, a concentration explored in our look at the Bitmain and MicroBT reshoring war. Our sibling explainer maps the pool layer in depth. This piece is about the ownership layer beneath it, which is far harder to see.

The Offshore and Sovereign Hashrate

Zoom into the opaque blocks on that map and a pattern emerges: the hashrate that is hardest to see is often hidden on purpose. Russia, at roughly 17 percent, legalized industrial mining nationally with a law that took effect in November 2024, then layered regional bans on top and remains heavily sanctioned abroad; its largest miner, BitRiver, was the first crypto miner ever placed under United States sanctions, back in 2022. Much of the Russian fleet is private and industrial, and its operators have every incentive to stay off public trackers. China, banned since 2021 yet estimated anywhere from 12 to 20 percent of the network, is even less legible: mining persists in Xinjiang and Sichuan under local tolerance, and no one can measure an activity the state officially prohibits.

The Gulf states run the opposite model but land in the same place. The United Arab Emirates and Oman together account for around 6 percent, built as deliberate sovereign industrial policy through state-linked operators such as Phoenix Group. That gives the hashrate durability, because it answers to national strategy rather than quarterly margins, but it also concentrates it in a handful of politically connected entities that answer to a government, not to shareholders. Ethiopia’s roughly 2.5 percent runs on hydropower through 20-odd mostly Chinese-backed private firms. Bhutan mines through its sovereign investment arm. None of these operators files a 10-Q. For sanctioned, capital-controlled, or politically exposed miners, opacity is not a side effect. It is a design goal.

The strategic irony is sharp. The fastest-growing and most geopolitically significant hashrate outside the United States is precisely the hashrate least likely to ever appear in a public disclosure, which means the part of Bitcoin’s defense that matters most for its censorship-resistance is the part we can see the least.

Bitdeer, the Exception That Proves the Rule

One public miner is running the other way, and it is instructive. Bitdeer grew its realized hashrate 44 percent to about 63 EH/s over the same six months the rest of the cohort was shrinking, and it produced 990 BTC in June alone, up 388 percent year on year. By mid-year it reported roughly 73 EH/s of self-mining capacity. What lets Bitdeer expand while its peers retreat is vertical integration: it designs and builds its own SEALMINER chips, so it is far less exposed to the ASIC supply bottleneck that gates everyone else, a dynamic detailed in our coverage of the chipmakers behind the mining rigs.

Even so, Bitdeer alone is well under a tenth of the network. Its story is really the general rule stated in the positive: growing hashrate in 2026 takes cheap captive power, your own silicon, or indifference to the AI arbitrage, and almost no listed company has all three. The private majority faces exactly the same math. It just does the arithmetic quietly, with no press release either way.

Counting Machines Does Not Tell You Who Owns the Work

Efficiency blurs the ownership picture even further. A single Antminer S23 Hydro runs at roughly 9.5 joules per terahash and around 560 TH/s; a 2016-vintage S9 needed about 98 joules per terahash to deliver 13.5 TH/s. One new machine now does the work of dozens of old ones. That means a site can double its hashrate without adding a single new owner, and an owner can hold its share flat while swapping out its entire fleet underneath the number. CoinDesk’s TheMinerMag noted that the newest generation of rigs is being used to upgrade existing fleets rather than expand the network, calling it a notable shift.

This is why the hashrate can sit flat near 940 EH/s for months while machines quietly change hands and get replaced. The count of exahashes tells you how much work is being done. It tells you almost nothing about how many distinct owners are doing it, where they are, or whether last quarter’s owner is this quarter’s owner. Aggregate work is observable; the roster behind it is not, and efficiency gains keep the roster churning behind a stable headline number.

The Re-Energizing: The Stall Breaks, but Net-New Is Capped

All of this is happening against a live rebound. Earlier in 2026 the network logged its first quarterly hashrate drop in six years as miners cut power and leaned into AI. Then the price recovered. The rally back toward $84,000, fueled in part by record spot-ETF demand of the kind we tracked in our global map of the 2026 ETF boom, has pushed difficulty up twice in a row, plus 1.31 percent on 5 September and plus 4.16 percent on 19 September, to 132.76 trillion. That is the clearest signal that idled machines are switching back on. Hashprice, the revenue a miner earns per unit of hashrate, jumped 22 percent to $39.63 per petahash per day.

But re-energizing matters less for our question than it looks. Bringing an idle rig back online is fast and cheap; adding genuinely new hashrate means new chips, and chips are slow and supply-gated. So the recovered hashrate is overwhelmingly old machines coming back, not a wave of new owners entering the field. The composition of the network barely changes. Jamie Redman of Bitcoin.com News captured the underlying stall well, writing that the flat hashrate “indicates that miners are evolving very carefully, and they might be facing hardware limits.” The rebound heats the number back up without redrawing the roster behind it, which means the visible-versus-hidden split holds even as the total climbs.

Does the Opacity Threaten Security? The 51% Question

The obvious worry: if we cannot see the owners, how do we know a hidden coalition does not already control enough hashrate to attack the chain? Two answers cut against the fear. First, the binding concentration is at the pool layer, which is visible, not the owner layer, and even pool concentration is fragile because miners can defect instantly. That is exactly what has defused past scares, when a single pool drifted toward half the network and its own contributors moved away.

Second, the economics are brutal for an attacker. Campbell Harvey of Duke University estimates that a one-week majority attack would cost about $8 billion, roughly “50 basis points of the value of bitcoin,” and would only pencil out if the attacker also shorted Bitcoin through offshore derivatives to profit from the crash they cause, because, as he puts it, “the difference today is the derivatives markets.” Matt Prusak, president of American Bitcoin, is blunter, arguing that “economic feasibility kills the 51% thesis.” Bitcoin has never suffered a successful majority attack, unlike smaller proof-of-work coins that have.

Crucially, the opacity of ownership does not lower the cost of the attack. The aggregate work is identical whether you can name the owners or not; an attacker must still out-hash the network, and the network’s hashrate is the network’s hashrate. If anything, a fragmented, anonymous, globally scattered owner base is harder to coordinate or coerce than a short list of named, regulated, publicly traded firms would be. A hostile actor cannot subpoena or pressure operators it cannot find. The trust questions that follow real failures, examined in our piece on the blame wars after a crypto hack, tend to concentrate where control is legible and centralized, which is the opposite of Bitcoin’s mining base.

The Transparent Alternative: Proof-of-Stake, and What Bitcoin Trades Away

It helps to see what the other major security model looks like. Ethereum’s proof-of-stake makes its security set legible by design. Roughly a third of all ETH is staked across some 900,000 validators whose addresses live on-chain, whose stake can be slashed for misbehavior, and whose activity is publicly attributable, as our guide to running a home validator in 2026 lays out. You can, in principle, audit who secures Ethereum.

Proof-of-work does the opposite on purpose. A miner is just a machine solving a puzzle. It has no identity, no registration, and no on-chain footprint beyond the coinbase transaction that pays it. That anonymity is not a flaw in the system; it is a feature of it. It is exactly what makes Bitcoin hard to censor or switch off, because you cannot slash, sanction, or serve papers on an owner you cannot locate. The cost of that resilience is the very transparency this article keeps running into. Ethereum invites you to verify who secures it. Bitcoin asks you to trust the incentives rather than the identities. Satoshi Nakamoto framed the whole design as one-CPU-one-vote, a model rooted in anonymous work rather than a known roster of validators, and that choice is the reason the ownership question has no clean answer.

What the Opacity Hides, and What It Doesn’t

It is worth being precise about the limits of what we do not know, because vagueness cuts both ways. Opacity hides the identities of the owners, the exact country split (which is an estimate built from pool logins and surveys), the true gap between nameplate and realized capacity, and who sits behind any block a tracker labels unattributed. It does not hide the aggregate work, because difficulty is a hard number set by consensus. It does not hide the steady arrival of blocks near every ten minutes. And it does not hide the security budget, roughly $14 billion a year at today’s price.

Even a wide error bar barely dents the conclusion that matters. Assume every hashrate estimate is off by 30 percent in either direction; the majority-attack cost still runs into the billions, and the qualitative verdict, that attacking Bitcoin is wildly uneconomic, does not flip. So the honest summary is narrow: we know how much work secures Bitcoin to within a reasonable band, and we know it is far more than enough; we do not know, and mostly cannot know, who is doing it. For a system whose whole premise is trust-minimization, not having to know the owners is arguably the design working as intended. It is worth remembering that even the one genuine weakness in the difficulty machinery, the timewarp loophole covered in our report on the fight to fix it, is a code bug, not an ownership problem. No amount of transparency about who mines would patch it, and no amount of opacity makes it worse.

The Bottom Line: A Security Model That Works Because You Can’t See It

Put it all together and the shape is clear. The hashrate number is real. The roster behind it is mostly hidden, and getting more so as the listed cohort retreats into AI. That is not a crisis. An anonymous, globally scattered, hard-to-coerce owner base is closer to Bitcoin’s original goal than a tidy list of regulated public companies would ever be. The system was built so that the identity of the security provider would not matter, and in 2026 it increasingly does not.

Two things are still worth watching. The first is the pool layer, where real block-construction power concentrates in a way that ownership does not, and where the push toward non-custodial pools and Stratum V2 is the meaningful decentralization fight. The second is the shrinking public-disclosure window: as more listed miners lease their megawatts to AI, the one slice of the network researchers could actually inspect is getting thinner, so our estimates of the whole will lean ever harder on geography guesses and pool-login data.

Regulators, notably, have stepped back from the miners themselves. The SEC’s Division of Corporation Finance said in March 2025 that proof-of-work mining, whether solo or pooled, does not implicate the securities laws. So the machines are largely unregulated, mostly unnamed, and mostly out of view. And every ten minutes or so, they find another block anyway. That is the strange achievement at the center of Bitcoin: a global security force of unknown size and unknown membership, doing its job precisely because no one has to know who they are.

Frequently Asked Questions

What share of Bitcoin’s hashrate do public mining companies control?

In the second quarter of 2026, listed miners tracked by CoinShares produced about 319 EH/s of realized hashrate out of roughly 957 EH/s network-wide, close to a third. Counting nameplate capacity, the figure is nearer 45 percent. Either way, most of the network is run by private or unlisted operators that publish no figures.

If mining pools do not own the hashrate, who controls block production?

Pools such as Foundry USA and AntPool coordinate hashrate contributed by thousands of independent miners and assemble the blocks, so the top three pools decide roughly two-thirds of block content. But they do not own the machines, and any miner can switch pools in minutes, which makes pool-level power real but not permanent.

Is Bitcoin less secure because we cannot identify most miners?

No. Security comes from the aggregate cost of the work, not from knowing the owners. A one-week majority attack is estimated at around $8 billion, and an anonymous, globally scattered miner base is harder to coordinate or coerce than a short list of named firms would be.

Why is Bitcoin’s hashrate flat in 2026 if the price is rising?

Listed miners are diverting power and capacity to AI and high-performance computing, which pays far more per megawatt, so net-new mining has stalled even as idled rigs re-energize on higher prices. The recovery is mostly old machines switching back on, not new owners entering.

How is total hashrate calculated if it cannot be measured directly?

It is estimated from mining difficulty and observed block times, roughly difficulty times 2 to the 32nd power divided by 600 seconds. Difficulty, reset by consensus every 2,016 blocks, is the only hard number; the hashrate derived from it is an estimate with a margin of error.

By Marcus Okafor, Bitcoin and mining desk, HOGE Wire.