Merkle Trees: The Math Behind Tamper-Proof Blockchain Records
In January 2009, Satoshi Nakamoto mined Bitcoin's genesis block. Hidden inside were transactions verified by a single 32-byte hash called the Merkle root. Change even one character in any transaction and that root changes completely — instantly exposing the fraud to every node on the network. That elegant trick is called a Merkle tree, and it is why blockchains can hold billions of dollars without needing a central bank to police them.
What You'll Learn
By the end of this lesson you will be able to: 1. Explain how hashing produces a one-way fingerprint for any data. 2. Build a four-leaf Merkle tree by hand, step by step. 3. Describe how a Merkle proof verifies a single transaction without downloading the whole blockchain. 4. Identify why altering any leaf invalidates the entire tree.
Hashing: One-Way Fingerprints
A hash function takes any input — a word, a file, an entire book — and outputs a fixed-length string called a digest. SHA-256, used in Bitcoin, always produces exactly 64 hexadecimal characters. Two properties make it powerful: **Deterministic:** the same input always produces the same hash. **Avalanche effect:** changing a single bit in the input scrambles the entire output. For example, SHA-256 of the word hello begins 2cf24dba, but SHA-256 of Hello begins 185f8db3 — completely different. You cannot reverse-engineer the input from the hash, which is why it is called a one-way function.
Bitcoin applies SHA-256 twice per transaction (called SHA-256d) to close a theoretical length-extension vulnerability. Ethereum uses Keccak-256 instead, a variant of SHA-3. Both produce 32-byte digests, but they are not interchangeable between the two blockchains.
Building a Merkle Tree Step by Step
Suppose a block holds four transactions: T1, T2, T3, T4. **Level 0 (leaves):** Hash each transaction individually: H1=hash(T1), H2=hash(T2), H3=hash(T3), H4=hash(T4). **Level 1 (pairs):** Concatenate adjacent hashes and hash the pair: H12=hash(H1 concat H2) and H34=hash(H3 concat H4). **Level 2 (root):** MerkleRoot = hash(H12 concat H34). The result is a pyramid: four leaves at the bottom, two nodes in the middle, one root at the top. Bitcoin block headers store only this 32-byte root — not the transactions themselves — which is why headers are small enough to download on a smartphone.
Merkle Proofs: Verifying One Transaction Cheaply
You want to confirm that T3 is in a block, but you only have the 80-byte block header containing the Merkle root. You ask a full node for a proof. The node sends just two hashes: H4 and H12. You then: 1. Compute H3 = hash(T3) yourself. 2. Compute H34 = hash(H3 concat H4). 3. Compute the candidate root = hash(H12 concat H34). 4. Compare with the root stored in the header. If they match, T3 is proven to be in the block with mathematical certainty — no trust required. For a tree with 1,000,000 transactions, you only need about 20 hashes (log base 2 of 1,000,000 is approximately 20). This technique powers Bitcoin's Simplified Payment Verification (SPV), letting lightweight wallets on phones verify payments without downloading the full blockchain.
A Merkle proof confirms a transaction is in a specific block, but it cannot confirm that block is on the longest valid chain. SPV wallets must still receive block headers from honest peers. For high-value transactions, running a full node remains the gold standard.
Match each Merkle tree concept to its correct definition.
Terms
Definitions
Drag terms onto their definitions, or click a term then click a definition to match.
A Merkle tree has 8 leaf nodes. How many hashes does a Merkle proof for one leaf require?
A bad actor alters one byte in transaction T2 after the block is mined. What happens to the Merkle tree?
Build a Merkle Tree by Hand
1. Write four short transactions — for example: Alice pays Bob 5 dollars, Bob pays Carol 3 dollars, Carol pays Dave 2 dollars, Dave pays Eve 1 dollar. 2. Go to an online SHA-256 calculator (search SHA-256 hash online tool in any browser). Hash each transaction phrase. Record only the first 8 characters of each hash — call them H1, H2, H3, H4. 3. Write H1 and H2 side by side as one long string and hash that combined string. Record the first 8 characters as H12. Repeat for H3 and H4 to produce H34. 4. Write H12 and H34 side by side and hash that to get your Merkle root. 5. Change one letter in your second transaction and redo steps 2 through 4. Count how many of the tree hashes changed. 6. Write two sentences: (a) which hashes changed and why the change propagated upward, and (b) why a blockchain network would immediately detect this tampering even without re-reading the original transactions.
Want to keep learning?
Sign up for free to access the full curriculum — all subjects, all ages.
Start Learning Free