ARK Invest and Glassnode have put a new number on blockchain capture risk: the smallest group of block-production entities needed to cross a protocol-relevant control threshold.
Their joint scorecard, published Sept. 1, put the threshold at three entities for Bitcoin and Ethereum and 19 for Solana. The same framework placed Bitcoin first in its composite decentralization ranking. The apparent tension reflects different forms of network exposure. The coalition needed to disrupt consensus is one risk measure; ownership, infrastructure, software, auditability and exit speed describe other routes to pressure a network.
Institutions considering a blockchain as settlement infrastructure must define the failure they need to survive before selecting a metric.
What the 3/3/19 result measures
The report calls the measure a critical resilience threshold. It asks how many of the largest entities must coordinate to pass a concentration point governing block production or voting power.
The inputs change by network. Bitcoin weights hash rate attributed to mining pools. Ethereum and Solana weight stake, while their dashboards may classify a liquid-staking protocol, exchange, distributed validator network, underlying operator or individual validator as the relevant entity. Protocol rules then determine what a given percentage can accomplish.
| Network | Reported count | Coordination unit | Risk captured | Outside the measure |
|---|---|---|---|---|
| Bitcoin | 3 | Mining-pool labels by hash rate | Concentrated block-template coordination at the report’s threshold | Hardware ownership, pool switching and node distribution |
| Ethereum | 3 | Staking entities under the report’s taxonomy | Stake concentration at the selected threshold | Underlying operators, attack level, clients, hosting and exit queues |
| Solana | 19 | Validators by delegated stake | A coalition crossing the measured one-third voting-power threshold | Common owners, delegation sources, software and data centers |
A seven-day Bitcoin mining snapshot on Sept. 6 attributed 26.88% of blocks to Foundry USA, 16.91% to AntPool and 15.25% to F2Pool. The three pools coordinated block templates for 59.04% of observed production, consistent with the report’s three-pool result.
Pool share remains distinct from miner ownership. Individual miners supply work to a coordinator and can redirect that hash rate. The report estimates that a miner could leave a 1% Bitcoin position in roughly 30 seconds by switching off hardware. This mobility makes pool concentration important for short-term censorship and template selection while leaving ultimate control of the machines more dispersed.
Ethereum highlights the classification problem from the other direction. Rated Network, an Ethereum validator analytics provider, listed Lido at 21.17%, SSV at 16.56% and Binance at 7.77% in its Sept. 6 pool view. The same table described Lido as 544 entities. One label can therefore represent a protocol, hundreds of operators or both, depending on the grouping.
Ethereum’s own threat model adds another distinction. Official protocol documentation says at least 33% of stake can delay finality. More than 50% can censor transactions and control short-range fork choice. At least 66% can finalize a preferred chain and alter finalized history. Each attack maps to a different threshold.
Solana’s coefficient also changes with stake distribution. Solana Compass, an independent network dashboard, showed a Nakamoto coefficient of 18 on Sept. 6. ARK and Glassnode reported 19, while the Solana Foundation’s June 2025 health report, using April 2025 data, recorded 20.
Solana Compass defines the coefficient as the fewest validators whose combined stake reaches 33.4% of voting power. The Foundation links that coalition to censoring blocks or stopping consensus. A value of 18 means that this specific disruption requires coordination across more top validators than a count of three would suggest. Shared ownership, stake sources, hosting, jurisdiction and software create separate exposures.
The dependencies that reshape capture risk
Infrastructure can give nominally separate entities a correlated failure mode. A data-center operator, cloud platform, government or network carrier can affect many nodes or validators together, even when the consensus coefficient looks widely distributed.
Bitcoin’s node footprint illustrates how measurements can shift with the crawler. The joint report cited 63% of Bitcoin nodes operating behind Tor. A Clark Moody network dashboard showed 12,959 Tor nodes among 26,837 reachable nodes on Sept. 6, or 48.3%. Different node populations and collection methods can produce materially different shares. In either case, Tor usage speaks to node visibility and geographic resilience, while mining pools remain the direct block-production measure.
Ethereum hosting data varies for the same reason. The report cited roughly 20% of nodes on AWS. Rated Network’s host view showed AWS at 14.4% of measured validator hosts. Ethernodes, an execution-layer node crawler, tracks another slice of the network and separates Amazon infrastructure across several ISP labels. A single AWS percentage loses meaning unless the node population and provider taxonomy travel with it.
Solana exposes the performance side of the tradeoff. High-throughput validators generally operate in commercial data centers. The Solana Foundation’s dated 2025 report counted more than 100 providers, with TeraSwitch and Latitude hosting 45.70% of stake between them. Solana Compass’s current broader view counted 437 data centers. The large facility count coexists with a sizable stake concentration among the leading providers.
Client software creates a second common dependency. Ethereum’s client-diversity guidance explains that independent implementations reduce the blast radius of a shared bug. Rated showed Geth at 50.17% of measured execution clients. On Solana, the Foundation reported about 92% of stake using Agave/Jito and about 7% using Firedancer or the hybrid Frankendancer in April 2025. These figures measure exposure to a shared codebase, a failure mode separate from deliberate collusion.
Exit speed determines how long concentrated influence can persist. Bitcoin miners can redirect work without waiting for a protocol queue. Ethereum validators follow a rate-limited exit process. ARK and Glassnode’s estimate of weeks applies to stressed conditions. On Sept. 6, beaconcha.in’s live queue showed an empty validator exit queue and a withdrawal estimate near one day. Ethereum’s withdrawal documentation explains that the delay moves with demand.
During coercion, the separation becomes practical. Hash power can leave a pool quickly when miners defect. Stake can remain tied to a validator during a congested exit queue, even when a liquid-staking token trades freely. Market liquidity and protocol exit provide different escape routes.
How institutions should read the scorecard
An institutional decentralization review can pair each threat with the corresponding measure:
- Transaction censorship or finality disruption calls for stake or hash-rate concentration at the relevant protocol threshold, with transparent entity grouping.
- Coordinated legal pressure and infrastructure outages call for validator and node maps by provider, jurisdiction and network operator.
- Software faults call for client-share and shared-codebase analysis.
- Persistent capture calls for beneficial ownership, delegation sources and the time required to withdraw or redirect resources.
- Independent verification and recovery call for the cost of running a verifier and reconstructing network state.
The joint report’s composite ranking favors Bitcoin because the framework combines auditability, ownership dispersion, geographic resilience, exit fluidity and other dimensions. Solana’s 19-entity result, now 18 on one live dashboard, describes one form of coordination risk.
The figure describes the largest-validator coalition needed to cross Solana’s measured voting threshold. An institutional decision also requires the rest of the map, including who supplies the stake, where the machines run, which software they share, how quickly participants can leave and how independently users can verify the ledger.