Blake2B+SHA3 algorithm: the Handshake network, hardware and specs

Blake2B+SHA3 is the proof of work of the Handshake network. The name describes the substance exactly: inside there really are two different hash functions, and not one after the other but in parallel, with a merge afterwards. There is no other construction like it anywhere, and that is not an accident but the original design intent.

The intent was utilitarian. When the proof of work for the future network was being discussed in 2018, the author of the implementation wrote plainly that hardware manufacturers had to be put on an equal footing at the start. Pure SHA3 would not do: dedicated chips for it already existed, and launching on it would have handed the network to those who already had such hardware standing. A pairing of two functions with a nonstandard order of calls did not match anything ready made. The goal, in the words of the author himself, was not a perfect algorithm but simply something decent. He deliberately did not want to invent a new proof of work from scratch.

The network itself was conceived ambitiously: a decentralized replacement for the DNS root zone, where ownership of a top level domain is written in the blockchain rather than in the registry of an organization. Below the domain level everything works by ordinary DNS. The idea is a live one, but in six years not a single major browser has learned to resolve these names without extensions, and by 2026 almost all the infrastructure around the project has crumbled away. We go through this in detail below, because for a hardware buyer it matters more than any efficiency figure.

The scheme is an unusual one, so let us go through it step by step. The miner receives a preheader of exactly 128 bytes and computes two independent values from it. The first: Blake2B with a 64 byte output. The second: SHA3-256 over the same 128 bytes plus eight bytes of padding, 136 bytes in all, with a 32 byte output. Then the two are glued together with 32 bytes of padding, which gives exactly 128 bytes again, and a third hash is computed from them, Blake2B with a 32 byte output.

So this is not a chain of the hash of a hash kind, it is a fork with a merge afterwards. For silicon that means two independent pipelines of fundamentally different nature on one die. Blake2B is additions, rotations and exclusive OR over 64 bit words, while SHA3 is the Keccak permutation over a state of 1600 bits, built in an entirely different way. A noticeable part of the die is taken up by something that is not present in any machine for Blake2s or Blake3.

Next the finished 32 bytes are combined by exclusive OR with a 32 byte mask that the pool sets. The point is protection against block withholding: the miner does not see whether he has actually found a valid block, and cannot selectively hide lucky finds from the pool.

The nonce is a story of its own here. The main nonce takes only 4 bytes and stands at the very beginning of the hashed data, with 8 bytes of time right after it. Four bytes are catastrophically few: a machine at 9 TH/s runs through that whole space in fractions of a millisecond. That is why there is a second nonce of 24 bytes, it lies in the subheader and enters the work not directly but through a 32 byte commitment inside the preheader. Changing it costs two extra hashes, so it is the short nonce that gets run through in the hot loop, and the first eight bytes of data can be incremented as a single 64 bit number, letting the overflow spill naturally into the time field.

1. A 128 byte preheaderNonce, time, padding, parent, tree root, commitment
2. The first branchBlake2B over 128 bytes, a 64 byte output
3. The second branchSHA3-256 over 136 bytes, a 32 byte output
4. The mergeBlake2B over the 128 byte glue, a 32 byte output
5. The pool maskXOR with 32 bytes, protection against block withholding

• 2018Discussion of the proof of work for the future network. The task is stated as putting manufacturers on an equal footing at the start and not handing the network to the owners of already existing chips for SHA3.
• 2020On 3 February the mainnet launches. Full functionality two weeks later. Protocol design: Joseph Poon and Christopher Jeffrey.
• 2021On 5 May the HNS rate sets its all time high, on the order of 0.82 to 0.85 dollars. A decline lasting years begins after that.
• 2023At the end of April the first halving comes at block 170,000, the reward falls from 2000 to 1000 HNS.
• 2024On 30 December F2Pool closes its HNS pool. The start of the infrastructure walking away.
• 2025In August a soft fork stops the acceptance of claims for the token giveaway to developers. Only a few percent of the volume set aside had been claimed, and the supply cap is cut by roughly half.
• 2026In June ViaBTC closes its HNS pool, Namecheap fully exits support for Handshake domains, the Namebase venue shuts down.
• 2026On 27 July the second halving comes at block 340,000, the reward falls from 1000 to 500 HNS. The profitability of any machine on this algorithm halved.

The only catalog model on Blake2B+SHA3. Hashrate in TH/s, efficiency in joules per terahash. Click the name to open the profitability calculator.

There is no custom firmware for the Antminer HS3. AsicBoost firmware is built for SHA-256 boards, on Scrypt two models are supported separately, and there are no Handshake machines on that list. Network installation through HashCore Toolkit belongs to those same supported lines.

With third party projects it is the same. We went through the official supported model lists of the known firmware developers: the HS3 is not listed in any of them, they are all aimed at SHA-256 and partly at Scrypt. For the Goldshell HS series machines the manufacturer publishes its own firmware, but those are stock builds, not overclocking ones.

The reason is not technical but arithmetical, and it illustrates the size of the network well. Firmware development pays off through the size of the fleet. The entire world hashrate of Handshake, converted into machines of the HS3 class, is on the order of eighty units. Nobody is going to develop for a fleet like that, and nobody ever will now.

One frequent question is worth closing separately: AsicBoost technology is fundamentally inapplicable to this algorithm. It is an optimization for the specific structure of the Bitcoin header and double SHA-256. Handshake has neither of those.

We have to start with the date. On 27 July 2026 the second halving passed at block 340,000: the block reward fell from 1000 to 500 HNS. That happened literally a few days before this page was prepared, and at the time of checking the large aggregators were still computing profitability at the old reward. Any calculation based on them overstates income by exactly a factor of two.

Now the figures. Network hashrate is on the order of 0.7 PH/s, the reward is 500 HNS, 144 blocks a day. The Antminer HS3 with its 9 TH/s is about 1.25 percent of the whole network, that is around 900 HNS a day. At a rate on the order of one seventh of a cent per coin that is roughly 37 euro of revenue a month, and the spread of quotes between sources here exceeds a third. Electricity at the Spanish tariff of 0.15 euro per kilowatt hour costs about 225 euro. The result is a loss of about 188 euro a month, on the order of 2250 euro a year.

Put differently, revenue covers about a sixth of the electricity bill: for every euro earned the machine burns around six. The break even threshold on electricity works out at about 2.5 euro cents per kilowatt hour. That is not a cheap tariff, that is effectively free energy, which does not exist in Spain in either the domestic or the industrial segment. Separately about selling: HNS has two markets left, both on one exchange, with a combined daily turnover of about six thousand dollars. One machine can be served, but a farm will push the price down against itself.

Open the profitability calculator →

Efficiency here is measured in joules per terahash, J/TH. The notation matches SHA-256, kHeavyHash, Eaglesong, Blake3 and Blake2s, but that is a coincidence of notation, not of units. A Blake2B+SHA3 terahash is three hash function calls over 128 bytes, that is entirely different work, so putting 231 J/TH next to the single digit figures of Bitcoin machines is meaningless.

There is one model in the catalog, so there is nothing to compare within the page. More useful is a comparison with the rest of the fleet on the algorithm: the Antminer HS3 is at 231 J/TH, the nearest competitor the Goldshell HS6 at 756, the other Goldshell machines roughly from 870 to 1000. So the HS3 leads everything else by a little more than threefold. The gap is such that the whole Goldshell fleet at the current rate of the coin is not worth discussing at all.

The arithmetic goes as usual: multiply efficiency by hashrate in terahashes to get draw in watts, divide by 1000 to get kilowatts, multiply by your tariff and by 720 hours a month. For the HS3 that is about 225 euro a month at the Spanish tariff. Compare the sum you get with the mining forecast in the calculator, making sure to check which block reward it uses: after 27 July 2026 the correct figure is 500 HNS.

Look at the state of the network first, at the specifications second. A market cap of about a million dollars, daily turnover of the coin a few thousand, two markets on one exchange, one working pool. If that does not suit you, there is no need to read further: no hardware efficiency compensates for it.

Check the block reward in the calculator. The halving passed on 27 July 2026. Aggregators that have not updated show 1000 HNS instead of 500 and overstate income by exactly a factor of two.

Confirm the version of the machine. The Antminer HS3 has a variant at 9 TH/s and a variant at 8.55 TH/s at the same draw. The difference in efficiency is about five percent, and listings mix them up often enough.

Do not count on switching to another coin. The Antminer HS3 can do Handshake only. Siacoin is out of reach for it despite the shared name Blake2B in the descriptions: there the construction is different and the block size is different, and there is no firmware for it for this machine.

Separate shop window prices from market ones. Sellers ask from a thousand to almost three thousand dollars for the machine. That is the remains of old price lists, not a reflection of demand today: check against actual deals, not against price tags.

Count the monthly bill, not the price of the machine. At the Spanish tariff the HS3 burns about 225 euro a month and brings in about 37. The difference accumulates regardless of how much you paid for the machine itself.

Mixing up Blake2B, Blake2s and Blake3. The names are alike, the silicon is different. Blake2B has a 64 bit word, a 128 byte block, twelve rounds. Blake2s, which Kadena runs on, has a 32 bit word, a 64 byte block, ten rounds. Blake3 on Alephium is the same 32 bit branch of the family with seven rounds and a tree. The machines do not replace one another in either direction.

Thinking that since Blake2B is here, the machine will take Siacoin. Siacoin has one pass over an 80 byte header, Handshake has three calls, one of them SHA3, over a 128 byte preheader. Firmware for Siacoin for the Antminer HS3 does not exist. Only the Goldshell HS series machines can switch, because the manufacturer built that into the chip.

Computing profitability on a calculator that has not updated. The halving of 27 July 2026 cut the reward from 1000 to 500 HNS. Aggregators that have not accounted for it overstate the calculated income by exactly a factor of two.

Not checking where to hand over what you mine. HNS has two markets left, both on one exchange, with a combined daily turnover of about six thousand dollars. The venue that used to hold the main market for the coin shut down in June 2026.

Taking the number of registered names as a sign of life. It grew for several years and has practically stopped, while estimates in different explorers differ several times over. Meanwhile the registrar fully exited support for these domains in June 2026, and in six years not a single major browser has learned to resolve such names without extensions.

Looking in the algorithm for what is not in it. Descriptions turn up now and then where Blake2B+SHA3 is credited with a data expansion stage or with work over a large area of memory. None of that is here at all: the padding bytes are constant within a block and are computed once. The algorithm has no memory requirements whatsoever, and most likely such descriptions were carried over from other algorithms.