Scrypt algorithm: overview, coins, ASIC miners and specifications

Scrypt is a key derivation function that Colin Percival designed in 2009 to protect passwords from brute force attacks. Unlike SHA-256, where everything comes down to arithmetic speed, Scrypt forces whoever is computing to keep a working buffer in memory and hit it constantly at unpredictable addresses. Cutting corners on memory does not work: without the buffer the computation has to be repeated many times over, and the silicon you saved is eaten up by the extra work.

The algorithm arrived in mining in 2011 together with Litecoin. The idea was that the memory requirement would make dedicated chips unattractive and leave the network to ordinary computers. That held until 2014: the Litecoin parameters ask for only 128 kilobytes per thread, and that much fits directly on the die. Today Scrypt is a pure ASIC algorithm, exactly like SHA-256.

The defining feature of Scrypt now is not memory but economics. Litecoin and Dogecoin are mined by the same hash through merge mining, so one machine brings in payouts in two coins at once with no extra electricity. The asic.es catalog holds 21 models for this algorithm from five manufacturers, with efficiency spread from 0.15 to 3.75 J/MH, a gap of twenty five times.

The task facing the miner is the same as in Bitcoin: find a block header whose hash lands below the current target. What differs is how the hash itself is computed. Scrypt is not one function but a chain: PBKDF2 built on HMAC-SHA256 expands the header into a starting state, then the ROMix core runs on the Salsa20/8 stream cipher, and at the end PBKDF2 folds the result back down to 256 bits.

The point of the whole thing sits in the middle. ROMix first fills a buffer of 1024 blocks of 128 bytes in sequence, each one derived from the previous. Then come 1024 reads from that buffer, and the address of every read depends on the value just computed. There is no way to know the addresses in advance, so the buffer has to be held in full.

The Litecoin parameters are mild: N equals 1024, r equals 1, p equals 1, which gives a 128 kilobyte buffer. For a password on a server that is a sensible compromise, for ASIC resistance it turned out to be far too little: 128 kilobytes of SRAM sits comfortably next to every compute core, and a chip ends up with hundreds of such cores on the die.

The practical consequences follow from that. The density of a Scrypt chip is limited by memory area rather than by logic transistors, so the absolute hashrate numbers are orders of magnitude lower than on SHA-256 and are measured in megahashes, not terahashes. Comparing J/MH with J/TH across algorithms is meaningless, they are different units and different work.

1. Block headerVersion, previous block hash, Merkle root, time, target, nonce
2. PBKDF2-HMAC-SHA256The header is expanded into 128 bytes of starting state
3. ROMix, first phase1024 buffer blocks are filled in sequence through Salsa20/8
4. ROMix, second phase1024 reads at addresses that depend on the current value
5. Final PBKDF2Folded to 256 bits and compared with the target, otherwise a new nonce

• 2009Colin Percival publishes scrypt as a function for protecting passwords in the Tarsnap backup system. Mining is not yet on anyones mind.
• 2011Litecoin launches. Scrypt was chosen deliberately, to cut off the existing SHA-256 farms and leave mining to graphics cards and processors.
• 2013The peak of the GPU era. A rig of Radeons delivers megahashes and Scrypt is considered an algorithm resistant to dedicated hardware.
• 2014The resistance ends. The first Scrypt ASICs appear from Gridseed, Zeus and Innosilicon, and graphics cards leave the network within months. In September Dogecoin switches on merge mining with Litecoin, and the two coins become a pair.
• 2017The Antminer L3+ at 504 MH/s sets the standard for home and industrial mining, and these machines keep running in the networks for years afterwards.
• 2021The Antminer L7 at 9.5 GH/s raises the bar nineteen times over and stays the only serious machine on the market for three years.
• 2023The August Litecoin halving cuts the reward from 12.5 to 6.25 LTC. The DOGE share of the payout becomes a visible part of farm income.
• 2024The Antminer L9 at 16 GH/s and 0.21 J/MH ships in May. The same year ElphaPex breaks the Bitmain monopoly on this algorithm with the DG1 series.
• 2025ElphaPex DG2 at 16 GH/s and 0.22 J/MH, followed by the DG2+ at 20.5 GH/s and 0.19 J/MH. Competition becomes the market norm for the first time.
• 2026Bitdeer releases the SealMiner DL1: an air cooled version at 25 GH/s and a hydro version at 52.5 GH/s, both at 0.15 J/MH. That is the current efficiency ceiling.

Below are the twelve highest performing machines in the catalog. The full list of 21 models opens with the button, including the older L3 and Goldshell series that still live on cheap power.

Custom firmware is noticeably less common on Scrypt than on SHA-256, and the reason is simple: a mature ecosystem grew only around Bitmain control boards. In our catalog the AsicBoost firmware is available for two models, the Antminer L7 and the Antminer L9. Every other machine, including the whole ElphaPex and Bitdeer range, runs factory software.

What the firmware gives you on the L7 and L9: autotuning of each board separately, manual frequency and voltage profiles, undervolted operation for the sake of J/MH and mild overclocking when absolute hashrate matters more. On top of that you get proper monitoring, flexible pool settings and the factory limits on temperature thresholds lifted.

The developer fee is 2.8%. Initial setup and reaching stable numbers take 3 to 4 hours per machine, because autotuning fits the parameters to the specific chips rather than to an averaged batch.

Installation runs over the network through HashCore Toolkit, so the fleet is flashed in batches rather than one machine at a time. Before flashing it is worth checking that the model is on the supported list and that the power supply has headroom: after overclocking the draw grows faster than the hashrate.

The income of a Scrypt farm comes from three parts: the LTC payout, the DOGE payout for those very same shares, and small change from the side AuxPoW coins. The first two are comparable in size, and in some periods the Dogecoin share in money exceeded the Litecoin share. That is the key difference of this algorithm: one machine works two markets at once.

On the cost side everything is ordinary: the price per kilowatt hour, machine efficiency in J/MH and the difficulty of both networks. Difficulty and exchange rates are not yours to control, efficiency you choose when buying, the electricity price you choose when siting the farm. Those two decisions are what determine whether the farm survives the next downturn.

Keep the Litecoin halving of August 2027 in mind separately: the reward drops from 6.25 to 3.125 LTC. The DOGE part of the income does not change, so the blow is softer than in Bitcoin, but machines worse than 0.4 J/MH will be on the edge after it. Calculate payback with room for that event, not on todays numbers.

Open the profitability calculator →

Efficiency on this algorithm is measured in joules per megahash, J/MH. It is the only figure that compares machines of different generations honestly. Hashrate tells you how much a unit computes, J/MH tells you what that will cost you.

Reference points from the catalog for 2026. From 0.15 to 0.22 J/MH is the current generation, the SealMiner DL1, ElphaPex DG2 and DG2+, and the Antminer L9. From 0.28 to 0.36 J/MH are machines one step back, including the L7 and the early DG1 line, which live on cheap power. From 0.5 to 1.6 J/MH are the home Goldshell units and the old L3s, where the economics are already marginal. Above 3 J/MH there is only history such as the Innosilicon A4 at 3.75 J/MH.

Translated into money in practice. A machine at 0.15 J/MH running 25 GH/s burns about 3.7 kW, while a machine at 0.36 J/MH needs roughly 9 kW for the same hashrate. A gap of 5.3 kW running around the clock is about 46,000 kilowatt hours a year, which at European industrial tariffs is a sum comparable to the price of the machine itself.

Work out your tariff first. Above 0.10 euro per kilowatt hour it only makes sense to look at 0.15 to 0.22 J/MH. At 0.05 euro and below, machines of the L7 generation are still in the game.

Look at J/MH, not at hashrate. A machine with less hashrate but better efficiency almost always wins over the distance. Hashrate sets the size of the payout, efficiency sets the profit.

Settle the heat question up front. Hydro models such as the DL1 Hydro and DG Hydro need a loop that is already in place. Without one, take the air cooled versions, otherwise the machine will sit idle.

Check whether you need firmware. If you plan on autotuning and power profiles, among the recent machines that means the Antminer L9 only. ElphaPex and Bitdeer run on factory software.

Count income across both coins. A calculator that only counts Litecoin understates the result. The DOGE payout comes for the same shares and in some periods exceeds half of the income.

Budget for the 2027 halving. The machine has to pay off at a reward of 3.125 LTC, not only at todays 6.25. If a model merely breaks even now, it will be running at a loss after August 2027.

Comparing J/MH with J/TH. These are units from different algorithms. A Scrypt machine at 0.15 J/MH and a SHA-256 machine at 15 J/TH have nothing to do with each other and cannot be compared.

Counting income in Litecoin only. Dogecoin makes up half the picture. Judging by one coin regularly leads people to skip a purchase that would in fact have paid off.

Buying a home miner for industrial work. The Goldshell Mini-DOGE is excellent as a quiet machine in a flat, but at 1 J/MH and worse there is no sense putting it into a ten kilowatt farm.

Ignoring the coin list of the pool. Pools differ in which side AuxPoW coins they carry. At an equal fee their final payouts are not the same, and over a year the difference adds up to a visible sum.

Overclocking without power headroom. On the L7 and L9 overclocking raises the draw faster than the hashrate. A power supply with no headroom goes into protection, and in the worst case takes a board with it.

Paying working machine prices for an A4 or L3. Old models only make sense as near free hardware on near free electricity. In any other scenario they lose money from day one.