What does a PCOC cost at scale?

How to read this page

• Hike: one PCOC being made. A machine can make several hikes at once.
• Leg: 2 million memory steps. A hike's speed is given in legs per second.
• The floor used on this page: the calibration study's production-floor candidate, 1/5 of the reference speed, which comes to 0.2 legs per second. Every "the floor" and "1/5" below is that study candidate. The live gate on 26 Oct 2026 serves gl-admit-v12 at 0.1 legs/s (1/10), a testing floor. Packing more hikes onto one machine slows each of them; past a point they fall below the floor this page uses and are refused.
• Labels: each figure is marked measured (run on our own machines), sourced (from a dated public page), derived (arithmetic on those), assumption or judgement.
• A1–A10, S1, P1 name the assumptions, listed in full under Assumptions.
• Where an input is uncertain, we take the end that makes things easier for an attacker: the lower cost.

1. The benchmark: reference system 3

Reference system 3, a commodity laptop, is the lab machine whose specs set what a matching rented server looks like. It is one of the three commodity reference systems measured under the SPEC 2.3 hike rules.

Measured behaviour under the SPEC 2.3 hike rules (16 KiB slot, 2-million-step legs, steady 60-second windows, 22 Oct 2026):

2, 3 and 5 hikes at once were not run on reference system 3.

Why about four (derived):

• One hike at the floor reads 0.2 legs/s × 2,000,000 steps × 16 KiB ≈ 6.55 GB/s. This assumes each step moves one 16 KiB slot once, as a read with no write. The specification says so: every step reads and folds the full 16,384-byte slot, and “The step reads terrain and does not write it” (§11.1). Cache-line and prefetch overheads, which would add traffic, are not counted (A10).
• Reference system 3 delivered about 32–33 GB/s at its plateau (0.985–1.015 legs/s in all), 63–65% of its 51.2 GB/s peak. That figure comes from step rates, not memory counters.
• 32–33 ÷ 6.55 gives a ceiling of about 4.9–5.1 hikes. Four clear the floor and six do not; five was not run.
• Cores were not the limit on reference system 3: its load average was about 1–3 with six hikes running. Bandwidth ran out first.

Where reference system 3 sits among the lab machines. In the middle:

• Reference system 1 (Ryzen 5 5600H, 6 cores / 12 threads, two-channel), the primary reference, is somewhat faster: 0.402 legs/s alone, 0.283 each at four hikes (1.42× the floor) and 0.190 at six, below the floor. Its plateau is about 1.13–1.14 legs/s in all, about 37 GB/s, a ceiling of about 5.7 hikes (measured, 22 Oct 2026).
• Reference system 2 (Intel Core i7-10610U, 4 cores / 8 threads, no SHA instructions), the specification's low-end host, is slower: 0.242 legs/s alone and 0.238 each at two hikes, 1.19× the floor (measured, 22 Oct 2026). Three and four hikes were not run on it.
• A fourth lab machine (i5-7500T, 4 cores / 4 threads) was not part of the 2.2 runs. Under the earlier specification it made single PCOCs that were accepted, and an earlier prototype step suggested it holds about 2–3 hikes (derived estimate).
• So the slower lab machines hold fewer hikes than reference system 3, and the faster one holds about the same or one more.

2. The closest rentable equivalents

The match criteria:

• the same core class: AMD Zen 2/3/4 or Intel desktop/Xeon-E, 6–8 cores (one 14-core Intel included);
• two-channel DDR4 or DDR5;
• dedicated hardware, not shared cloud.

Rates are as listed on 21 Oct 2026, excluding VAT. “Month 1” adds the setup charge, because a 30-day campaign incurs it (A7). Hosts don't publish their installed memory speed, so “peak” uses the CPU's rated maximum and is an upper bound. “Ceiling” = peak × reference system 3's 63–65% efficiency ÷ 6.55 GB/s.

Sources for the table are listed under Sources (items 3–7). The auction listing is in euros; ≈ $55 uses the ECB rate of 1.1215 (A6).

Why the same limit of about four. All these boxes are two-channel:

• On DDR4-3200 (AX41, EX44, SYS-GAME-1, RISE-1, Rise-Game-1) the peak matches reference system 3's, so with similar efficiency they reach the same bandwidth ceiling. Four hikes need four cores, and each has at least six, so bandwidth, not cores, runs out first.
• DDR4-2666 (SYS-1, Vultr) has about 17% less peak bandwidth. At reference system 3's delivered-to-peak ratio they deliver about 26.9–27.8 GB/s. That covers 4.1–4.2 hikes at 6.55 GB/s each, so four hikes fit, but each gets only 1.03–1.06× the floor, against 1.23× measured on reference system 3 at four. Refusals there are likely to be higher than on reference system 3 (A4). We credit them with four, the attacker-favourable end. At three, SYS-1 costs about US$0.084 (derived).
• DDR5 boxes (AX42, RISE-S) have about 60–75% more peak bandwidth and could hold more than four, until their 8 cores run out.
• Server memory controllers, ECC and how many slots the host fills can all move delivered bandwidth either way.

None of this is measured on a rented server. It is reasoned from reference system 3 and the published specs (A3).

Older quad-channel boxes. OVH's Kimsufi line lists older Xeons whose platforms have four memory channels:

• KS-C: Xeon E5-1650v2, DDR3, $12 + $12.
• KS-5-B: Xeon E5-1650v4, DDR4, $26 + $26.
• KS-1-B: Xeon D-2123IT, $24 + $24.

On paper they have 60–77 GB/s, more than reference system 3. At four hikes, KS-C would cost about US$0.026 per PCOC (about US$0.03 in the result above); at two hikes, about US$0.050.

This is a paper floor resting on two unknowns. OVH does not say how many channels are filled; 32 GB could be two sticks, which would mean two channels.

These cores are 2013–2016 designs, and their per-hike step rate is unmeasured. Supply of old units is likely small (judgement).

They are left out of the range below, but they are the main way the true cost could be lower, and what a careful attacker would test before anything else.

3. The calculation

Per machine (derived): 4 hikes × (1 − 3.34% refused) × 240 three-hour windows ≈ 928 PCOCs per 30 days. So cost per PCOC = month-1 cost ÷ 928.

Machines needed: 10,000 → 11; 100,000 → 108; 1,000,000 → 1,078, rounded up to whole machines.

Supply. No provider publishes how many units it can deliver.

• On 21 Oct, a third-party stock tracker (servermarket.dev) showed AX41-1-LTD in stock in 2 of 2 locations and EX44-1-LTD in 1 of 2 (sourced).
• Hetzner says limited offers depend on cancellations and “can sometimes take up to several weeks for a meaningful number of servers to be available” (sourced).
• Hetzner may hold or reject large first orders (sourced: Hetzner fraud-prevention FAQ).
• Auction listings are mostly single units (“1 left”) (sourced).
• How many machines one offer line can supply to one buyer in 30 days has no source; it is judgement (S1). It sets where the batch lands inside the range, so it is shown openly below at 20, 30 and 50.

The range (derived):

• Low, US$0.065: the cheapest matched box (OVH SYS-1, $60 in month 1) supplies the whole batch: $60 ÷ 928.
• High, US$0.078: a diversified mix, filled from the cheapest line upward with up to 30 machines per offer line:

US$7,848 ÷ (108 × 928) ≈ US$0.078 per PCOC.

Machines per offer line (judgement, S1), 100,000 PCOCs, filled from the cheapest line upward:

Other sensitivity (applied to the US$0.078 diversified mix):

By batch:

At a million, the question becomes how many machines each offer can supply, not what they cost. This page doesn't model several accounts, resellers or longer windows. Running about 1,000 machines also needs dedicated people; that cost isn't counted here (P1).

4. Bigger servers (an open question)

Servers with more cores and more memory channels can be rented, but they cost more per box. The question is whether they cost less per PCOC. That depends on how many hikes each holds above the floor, which has not been measured on any of them. The table gives the hikes each would need to match the range, US$0.078 and US$0.065:

Sources: OVHcloud US Eco page and Hetzner's USD rate page, 21 Oct 2026. Hetzner's AX lineup on 21 Oct is AX41, AX42, AX102 and AX162. Peak bandwidth uses the platform's rated channel count and speed; hosts don't publish how many slots are filled.

Reasoning, not measurement:

• The two-channel boxes with more cores (RISE-3, AX102) cost significantly more and still hit the two-channel bandwidth ceiling (about 5–9 hikes). On this rule they would not reach the hikes they need.
• The many-channel EPYCs have the bandwidth, on paper, for the hikes they need. Whether delivered bandwidth per hike holds up across their memory nodes, and whether their cores sustain the floor, is unmeasured.
• The lowest-cost of them, KS-6, needs only about five to six hikes, so if it performs as its specs suggest, it would cost less than the range.
• We also judge that many-channel boxes are harder to get in quantity than desktop-class dedicated servers. They are far fewer on public lists, and most cost several to ten times as much per box (judgement).
• No direction is claimed.

5. Renting versus buying, other attackers, levers

Renting, per PCOC: about US$0.065–0.078 (the range above).

Buying, per PCOC: a US$320 mini PC on the benchmark chip (Ryzen 5 7430U; one retail listing, Newegg BAMX B7A Pro, 21 Oct 2026), with two RAM sticks, drawing 35 W, at US$0.12/kWh and 928 PCOCs a month. It is assumed to hold four hikes like reference system 3 (A8). A single-stick unit needs a second stick, and that cost isn't included. Bulk rates at 1,000+ units are unknown.

Excludes rack space, cooling, network and labour; we found no sourced colocation rate. Each omission lowers the figure, so it favours the attacker. No-name units sold in bulk would likely resell below enterprise desktops.

Inputs for buying:

• Electricity draw: 35 W, an assumption, unmeasured. A mini PC under sustained memory load may draw more.
• Electricity rate: US$0.12/kWh, within the US range for the 12 months to July 2026 (industrial 8.91¢, commercial 13.85¢; EIA Electric Power Monthly Table 5.3, released 24 Sep 2026).
• Residuals: Apto Solutions Residual Value Guide 2025, Dell/HP/Lenovo desktops: 50% / 27% / 17% at 12 / 24 / 36 months.

Up-front hardware at US$320 each: about US$3.5k (11 boxes), US$35k (108) and US$345k (1,078). Supply of about 1,078 units of one no-name model, and any bulk discount, is unknown (judgement).

Break-even. Buying undercuts month-1 rent per PCOC once the same boxes run for many months. For a single 30-day campaign of 100,000, rent (about US$6.5k–7.8k) is below the cost of buying (about US$35k), and rented boxes can be handed back. Buying fits a farm that keeps making identifiers; renting fits a campaign with an end date.

Idle machines already owned, electricity only at 35 W: about US$0.003 per PCOC (US$0.002–0.004 across the EIA range). A botnet uses other people's machines, so its operator carries none of this cost. The time limit stays the same: each PCOC still holds a machine's memory for 18 Bitcoin blocks, and each machine runs only about four at once.

Levers:

• Block count. The specification fixes 18 Bitcoin blocks; a longer hold would be a new specification version. As arithmetic only, about 48 blocks (~8 h) multiplies the hold by ~2.67. At the same mix that is about US$0.21 per PCOC. 100,000 in 30 days would then need 288 machines, more than the 270 that 30 machines per line across all nine matched lines allows, so the mix moves to dearer lines.
• Slot size. The slot could go from 16 KiB to 32 KiB, so each hike reads twice the memory per step. That needs a specification change, because 16 KiB is fixed today. Where bandwidth runs out before cores, fewer hikes would clear the floor per machine at the same delivered bandwidth. The effect on cost, and on honest makers running a single hike, is unmeasured.
• Each gate's floor. Each gate sets its own floor. This page's arithmetic uses the calibration study's 1/5 (0.2 legs/s) candidate. The live groundinglab gate serves 0.1 legs/s (1/10). A lower floor than 1/5 accepts denser packing, so rented costs on that gate sit below this page.
• Several cores per hike. A future profile that keeps several cores busy on one hike could change packing. Not measured.

Anchoring load on a shared anchoring service is outside the rent bill. groundinglab pools it today; a service can run its own; each admission gate sets its floor and rules. Farm sizes that have been disrupted publicly sit around a thousand to several thousand accounts (US DOJ, Meliorator, 968 X accounts, July 2024; Meta, Spamouflage, 7,704 Facebook accounts, August 2023).

Open questions

1. What has been tested is two-channel laptops. Under the SPEC 2.3 hike rules (22 Oct 2026), reference system 3 (Ryzen 5 7430U) and reference system 1 (Ryzen 5 5600H) both clear the floor at four hikes (0.246 and 0.283 legs/s) and fall below it at six (0.170 and 0.190); reference system 2 clears it at two (0.238). Two, three and five hikes were not run on the six-core laptops. These are steady 60-second windows; full hikes paced by real Bitcoin blocks are still to be measured. No rented server has been tested (A3).
2. Cores and bandwidth. Hikes per machine are limited by whichever runs out first, delivered memory bandwidth or available cores; RAM size is not the limit. On both laptops bandwidth ran out first: cores were not saturated at four hikes. That is reasoned from step rates and CPU load, not read from memory counters. On a rented box either could run out first, which is unmeasured. Machines with more cores cost significantly more and still hit the bandwidth ceiling.
3. Bigger boxes with more memory channels have not been tested. Whether they raise or lower cost per PCOC is open; no direction is claimed (section 4).
4. Older quad-channel Kimsufi units could cost less if their channels are filled and their cores sustain the floor. Both are unknown (section 2).
5. Slot size. The effect of 32 KiB slots on hikes per machine is unmeasured.
6. Still to close:
   • one rented AX41-class run at several hikes at once (A3);
   • full hikes paced by real Bitcoin blocks at several hikes at once, which the cost figures wait on;
   • three and five hikes on the six-core laptops;
   • accept rates at three and four hikes against groundinglab's live gate policy (A4);
   • runs that read memory counters;
   • Reference system 3's raw memory-table output saved to the record;
   • three and four hikes on reference system 2, and the fourth lab machine (i5-7500T) under the SPEC 2.3 hike rules.

Assumptions

Sources

1. groundinglab lab measurements: reference systems 1 and 3 at one, four and six hikes, and reference system 2 at one and two, under the SPEC 2.3 hike rules (22 Oct 2026; raw results on GitHub); the fourth lab machine's (i5-7500T) single PCOCs under the earlier specification (18–19 Oct 2026) and prototype-step runs (23 Sep 2026); reference system 3 memory read with dmidecode; groundinglab's own PCOC, 11,023 s (19 Oct 2026); 18-block windows on the chain.
2. The specification: “The step reads terrain and does not write it”, and every step reads and folds a full 16,384-byte slot (§11.1; specification).
3. AMD Ryzen 5 7430U product page, read 21 Oct 2026: amd.com.
4. OVHcloud US Eco (Kimsufi, So you Start, Rise), read 21 Oct 2026: eco.us.ovhcloud.com.
5. Hetzner, read 21 Oct 2026: USD rates and limited (LTD) offers, docs.hetzner.com; specs, AX matrix and EX matrix; fraud-prevention FAQ.
6. servermarket.dev Hetzner listing (auction and stock), third-party, checked 21 Oct 2026, 11:59 ACDT.
7. Vultr bare metal: US$185/month from infralist.io, a third-party listing, auto-checked 10 Oct 2026; spec (6 cores / 12 threads, 32 GB) confirmed on vultr.com/pricing (bare metal), 21 Oct 2026, which shows no bare-metal rate.
8. Channel counts and rated memory speeds: the CPU makers' platform specifications.
9. Apto Solutions Residual Value Guide 2025 (desktops).
10. Newegg, BAMX B7A Pro, one retail listing, 21 Oct 2026.
11. US EIA Electric Power Monthly, Table 5.3, released 24 Sep 2026 (data to July 2026).
12. US Department of Justice, Meliorator, 9 Jul 2024; Meta, Spamouflage, August 2023.

If you think a figure is wrong, re-run it from the inputs above and tell us.

Deeper dive, page 6 of 6. Previous: Cost and incidence · Back to Learn