§ 01Bitcoin is secure because it is slow
This is not a criticism — it is the design. A Bitcoin block arrives roughly every ten minutes, and ten minutes is an enormous amount of time on a global network. By the time a miner finds a new block, essentially every other miner has already received the previous one. Everybody is building on the same tip. Collisions are rare.
When a collision does happen — two miners publish at nearly the same moment — the protocol has to pick one. A Bitcoin block references exactly one parent, so history must be a single line. One block survives, the other becomes an orphan: valid work, correctly performed, discarded. Its electricity bought nothing, and the security it would have contributed evaporates.
Now try to make that network faster. Shorten the interval and the probability that two miners find blocks without seeing each other rises sharply. At some point the orphan rate becomes so high that speeding the network up actively makes it less secure, because a growing share of total hashrate is being spent on blocks that get thrown away. That is the ceiling every single-chain proof-of-work network runs into, and it is not a software limit. It is the speed of light and the topology of the internet.
In a single-chain protocol, block speed and security pull against each other, because every simultaneous block but one is wasted.
§ 02Kaspa stops treating simultaneous blocks as competitors
A Kaspa block references every tip it can see, not one. If four miners publish at the same instant, the next block points at all four, and all four become permanent parts of the structure. Because blocks have many parents, the ledger is not a chain — it is a directed acyclic graph, a blockDAG. Acyclic because you can never reference a block that came after you.
Nothing about this is free, and it is not obviously safe. A mesh of blocks does not tell you what order the transactions happened in, and without an order you cannot say which of two conflicting spends came first — which means you cannot prevent double-spends. A DAG on its own is not a ledger. It needs a rule that turns the mesh back into a single sequence that every node independently agrees on.
That rule is GHOSTDAG.
§ 03GHOSTDAG: a greedy answer to an impossible question
GHOSTDAG looks at the DAG and asks which blocks were published by participants who were paying attention. A block that references nearly everything visible at the time it was mined was clearly well-connected. A block that references very little was mined in relative isolation — either the miner had a poor connection, or they were deliberately withholding.
The formal version of “paying attention” is the anticone: the set of blocks that neither reference a given block nor are referenced by it. GHOSTDAG greedily builds the largest set of blocks whose anticones all stay within a bound called k. Blocks inside that set are blue. Everything else is red.
Blue blocks are ordered first. Red blocks are then interleaved at deterministic positions. Because the rule is deterministic and the DAG is shared, every honest node derives the identical total order from the identical data — no voting, no committee, no leader election. Ordering emerges from structure.
This is the single most common error in Kaspa discussion. A red block is stored, it is ordered, and its transactions execute and settle. Red only means the block’s anticone exceeded k, so it contributes no weight to the blue score that determines the heaviest chain. Validity and security weight are two different properties.
Following the highest-blue-score parent backwards from the DAG frontier traces the selected chain — Kaspa’s analogue of Bitcoin’s longest chain. The frontier itself is represented by the virtual block, an unpublished block referencing all current tips, whose computed state is what wallets and explorers report as the present.
§ 04It is still proof-of-work, deliberately
Kaspa did not solve throughput by replacing proof-of-work with a validator set. Miners still burn energy, difficulty still retargets, and the security argument is still “rewriting history costs more than it earns.” The hash function is kHeavyHash, a matrix-multiplication design chosen to be less power-hungry per unit of work than SHA-256 — and, in principle, reusable by optical computing hardware.
Two consequences worth stating plainly. First, difficulty retargets continuously rather than every 2016 blocks, so the network responds to hashrate changes in seconds instead of weeks. Second, kHeavyHash was ASIC-resistant only briefly: purpose-built machines from IceRiver, Bitmain and others displaced GPUs during 2023, and they set the difficulty now.
Because ten blocks per second means a great deal of data, Kaspa also prunes. Old block bodies are discarded while headers and validity proofs are retained, so a full node’s storage stays bounded and verification remains something an ordinary person can do on ordinary hardware. Without pruning, the block rate would have made running a node a datacentre activity within a year, and permissionless verification would have quietly died.
§ 05The money: no premine, and a halving with no halving day
Every KAS in existence was mined. There was no presale, no investor round, no foundation allocation, no team vesting schedule. For roughly the first two weeks after launch the block reward was randomised between 1 and 1000 KAS, then fixed at 500 KAS per second. This history is on-chain and you can read it yourself — that is the point of saying it.
In May 2022 emission entered the chromatic phase. Instead of halving abruptly every four years, the reward is multiplied by 2-1/12 every Kaspa month. Twelve of those steps compound to exactly one half, so the network halves annually — but no miner ever wakes up to half their revenue. Each step is a 5.61% reduction.
The ratio 2-1/12 is the frequency interval between two adjacent semitones in twelve-tone equal temperament, and the opening rate was 440 KAS per second: the pitch of A4. Each annual halving is called an octave. The naming is whimsical; the mathematics is not.
The cap is 28,704,035,605 KAS. Because the halvings are annual rather than four-yearly, issuance is already far along — the majority of supply exists today, and new supply arrives more slowly than on almost any other proof-of-work network.
The full curve is scrubbable on the tokenomics page →
§ 06What Crescendo and Toccata actually delivered
Kaspa launched at one block per second, not ten. Getting to ten took a full rewrite of the node from Go into Rust, more than a year of a public 10-BPS testnet, and a hardfork. That hardfork, Crescendo, activated on 5 May 2025 and dropped block time from one second to one hundred milliseconds, cutting the per-block reward tenfold so that emission per second was unchanged.
Throughput rose roughly eight to nine times, not ten. The gap is real and worth understanding: more parallel blocks means a higher chance that two of them include the same transaction, and duplicated transactions do not add capacity. Around 80 to 90 percent efficiency is what the testing measured, and quoting a clean tenfold figure is an overstatement.
Toccata followed on 30 June 2026, activating at DAA score 474,165,565 in rusty-kaspa v2.0.x. It made the base layer programmable: covenant opcodes and transaction introspection, covenant IDs for tracking lineage, zero-knowledge verification opcodes, and partitioned sequencing commitments. It also raised the minimum fee rate from 1 to 100 sompi per gram and required integrators to accept transaction version 1.
Toccata shipped capability. It did not ship audited applications, universal wallet support, or a mature developer toolchain — those accumulate over years. Both statements are true at once, and an account that says both is worth following.
§ 07What is genuinely unsettled
Fee revenue has to start mattering. Annual halvings mean subsidy declines quickly. Every proof-of-work network eventually needs transaction fees to carry security, and Kaspa reaches that point sooner than most. Whether sustained demand appears is an empirical question, not a design one, and nobody has the answer yet.
GHOSTDAG still has a hard-coded k. The parameter is chosen in advance for an assumed worst-case propagation delay. DAGKnight — parameterless, adaptive to real observed delay — has been publicly discussed for years and has not shipped to mainnet. Treat any date you see for it as unconfirmed until it appears in a KIP and a tagged release.
Smart contracts are new here. Kasplex and Igra provide EVM environments, and Toccata added L1 primitives, but none of it has the operational history of a mature platform. New execution surfaces are where value gets lost.
Confirmation is not finality. Kaspa is genuinely fast at inclusion and ordering. Finality — the point at which reversal becomes economically unrealistic — still depends on accumulated work. Comparing one network’s block time to another network’s finality is misleading in both directions.