A blockchain is a distributed ledger -- a database that is simultaneously maintained by many computers across a network, with every participant holding an identical copy, and where records are organized into cryptographically linked blocks so that altering any historical entry requires redoing all subsequent work across the majority of the network. This architecture makes blockchain records practically immutable and eliminates the need for a trusted central authority. Instead of a bank or government confirming that a transaction happened, a blockchain relies on mathematical proofs and distributed consensus.
Bitcoin, introduced in a 2008 white paper by the pseudonymous Satoshi Nakamoto, was the first practical implementation of this idea. But the technology's potential extends well beyond digital currency. The combination of shared record-keeping, tamper-resistance, and programmable self-executing contracts (smart contracts) has generated significant interest -- and significant skepticism -- across industries including finance, logistics, healthcare, and governance.
Understanding how blockchain actually functions, rather than relying on marketing language or oversimplified metaphors, requires working through the key mechanisms: how blocks are structured and chained, how distributed consensus works, what different consensus mechanisms require and sacrifice, how smart contracts execute, and where the real limitations of the technology lie. This article explains each mechanism in detail, with specific technical examples and an honest assessment of both the technology's strengths and its weaknesses.
"The root problem with conventional currency is all the trust that's required to make it work. The central bank must be trusted not to debase the currency... With e-currency based on cryptographic proof, without the need to trust a third party middleman, money can be secure and transactions effortless." -- Satoshi Nakamoto, Bitcoin forum post (2009)
Key Definitions
Distributed ledger: A database replicated and synchronized across multiple nodes (computers) with no single central authority controlling the canonical copy. Every participant can read the full history.
Block: A bundle of transaction records, combined with metadata including a timestamp, reference to the previous block, and a cryptographic hash. Bitcoin blocks contain approximately 2,000 to 3,000 transactions on average.
Hash: A fixed-length output generated by a cryptographic hash function (such as SHA-256) from an arbitrary input. The same input always produces the same hash, but any tiny change to the input -- even a single character -- produces a completely different hash. This property is called the avalanche effect.
Consensus mechanism: The protocol by which distributed network participants agree on which transactions are valid and which version of the ledger is canonical. Different mechanisms make different tradeoffs between security, speed, energy use, and decentralization.
Smart contract: Self-executing code stored on a blockchain that automatically runs when predefined conditions are met, without requiring a trusted intermediary.
Node: A computer participating in the blockchain network. Full nodes store and validate the complete blockchain. Light nodes store only block headers and rely on full nodes for transaction verification.
The Structure of a Blockchain
How Blocks Are Built
Each block in a blockchain contains several components:
- A batch of validated transaction records (e.g., "Address A sent 0.5 BTC to Address B")
- A timestamp recording when the block was created
- A reference to the previous block in the form of that block's cryptographic hash
- A nonce (a number used in Proof of Work mining -- explained below)
- A Merkle root -- a single hash that summarizes all transactions in the block using a tree structure, enabling efficient verification of individual transactions without downloading the entire block
- The block's own hash, computed from all the above
Bitcoin blocks are limited to approximately 1 MB in size (with SegWit allowing slightly more), which constrains throughput. Ethereum blocks are limited by a gas limit rather than raw size, which determines how much computation can be included per block.
How the Chain Works
The cryptographic link between blocks is what creates the "chain." Block 500 contains the hash of Block 499. Block 501 contains the hash of Block 500. If an attacker modifies a transaction in Block 499, the hash of Block 499 changes, which invalidates the hash reference in Block 500, which invalidates Block 501, and so on through every subsequent block.
This is the fundamental security mechanism. To alter a historical transaction, an attacker must recompute every subsequent block's hash and do so faster than the rest of the network is extending the legitimate chain. For Bitcoin, which has been running since January 2009, the chain contains over 800,000 blocks as of early 2025 -- recomputing even a fraction of that history is computationally infeasible.
Cryptographic Hashing in Detail
The security of block linking depends on cryptographic hash functions being one-way and collision-resistant. SHA-256 (Secure Hash Algorithm 256-bit), used by Bitcoin, takes any input of any size and produces a 64-character hexadecimal string (256 bits). The properties that make this useful:
- Deterministic: The same input always produces the same output
- One-way: Given a hash output, it is computationally infeasible to determine the input (you would need to try approximately 2^256 possibilities -- a number larger than the estimated atoms in the observable universe)
- Collision-resistant: It is computationally infeasible to find two different inputs that produce the same hash
- Avalanche effect: Changing a single bit of the input changes approximately 50% of the output bits
These properties ensure that the hash of a block faithfully represents its exact content -- any modification, no matter how small, produces a completely different hash that is immediately detectable.
The Merkle Tree
Inside each block, transactions are organized into a Merkle tree (named after Ralph Merkle, who patented the concept in 1979). Each transaction is hashed individually, then pairs of hashes are concatenated and hashed together, and this process repeats up the tree until a single root hash remains -- the Merkle root.
The Merkle tree enables a critical efficiency: you can prove that a specific transaction is included in a block by providing only a small number of hashes (logarithmic in the number of transactions) rather than the entire block. This is called a Merkle proof and is essential for light clients that do not store the full blockchain.
The Distributed Network
A blockchain is not stored in one place. Bitcoin's network has approximately 15,000 to 17,000 reachable nodes worldwide (Bitnodes, 2024), each maintaining a complete copy of the ledger. Ethereum has roughly 6,000 to 8,000 nodes running the execution layer.
When a new transaction is broadcast to the network, each node independently validates it -- checking that the sender has sufficient funds, that the digital signature is valid (proving the sender controls the private key for that address), and that the transaction has not already been spent (double-spend prevention). Valid transactions are added to a pool of pending transactions called the mempool. The next block will be drawn from this pool.
When a new block is added, it propagates across the network through a gossip protocol, and each node verifies and adds it to their copy. This distribution is what makes the ledger censorship-resistant: there is no single server to shut down, no single point of failure, and no single entity that can unilaterally modify the record.
Consensus Mechanisms
Why Consensus Is Necessary
In a centralized database, a single authority decides which transactions are valid. In a distributed blockchain, there is no central authority -- thousands of independent nodes must agree on the same version of the ledger without trusting each other. The consensus mechanism is the set of rules that governs how this agreement is reached and how the system defends against participants who try to cheat.
The fundamental problem consensus mechanisms solve is the Byzantine Generals Problem, described by Leslie Lamport, Robert Shostak, and Marshall Pease in 1982: how can distributed parties reach agreement when some participants may be dishonest or faulty? Different blockchain consensus mechanisms offer different solutions to this problem, each with distinct tradeoffs.
Consensus Mechanisms Compared
| Mechanism | Used By | Energy Use | Security Model | Decentralization | Speed | Validator Requirements |
|---|---|---|---|---|---|---|
| Proof of Work (PoW) | Bitcoin | Very high (~150 TWh/yr) | Economic cost (hardware + electricity) | High (permissionless) | ~7 tx/sec | Specialized hardware (ASICs) |
| Proof of Stake (PoS) | Ethereum (post-Merge) | Very low (~0.01 TWh/yr) | Economic stake (slashing) | High (permissionless) | 15-100 tx/sec | 32 ETH minimum stake |
| Delegated PoS (DPoS) | EOS, Tron | Low | Elected delegates | Moderate | 1,000+ tx/sec | Community voting |
| Proof of Authority (PoA) | Private enterprise chains | Very low | Trusted identities | Low (permissioned) | Very high | Approved validators only |
| Byzantine Fault Tolerant | Hyperledger Fabric | Very low | Known participants | Low (consortium) | 3,000+ tx/sec | Consortium membership |
Proof of Work
Proof of Work (PoW), used by Bitcoin, requires nodes (called miners) to find a nonce value such that the hash of the new block starts with a specified number of leading zeros. Because hash functions are essentially random in their outputs, the only way to find such a nonce is to try billions of guesses per second -- a process called mining.
The difficulty of the puzzle adjusts automatically every 2,016 blocks (approximately every two weeks for Bitcoin) to maintain an average block time of 10 minutes, regardless of how much total computing power the network has. When more miners join, difficulty increases; when miners leave, it decreases.
The first miner to find a valid nonce broadcasts the new block to the network and receives a block reward (currently 3.125 Bitcoin per block, halved approximately every four years in an event called the halving). All other nodes verify that the nonce is correct -- this verification is instant, taking milliseconds compared to the minutes of mining -- and add the block to their chain.
Attacking a PoW blockchain requires controlling more than 50% of the total network computing power (a "51% attack"). For Bitcoin, this would require billions of dollars worth of specialized hardware (ASICs -- Application-Specific Integrated Circuits manufactured primarily by Bitmain and MicroBT) and enormous ongoing electricity costs, making it economically irrational. According to crypto51.app estimates, a sustained 51% attack on Bitcoin would cost over $2 million per hour in hardware and electricity as of 2024.
The major criticism of PoW is its energy consumption. The Cambridge Bitcoin Electricity Consumption Index estimates Bitcoin's annual energy use at approximately 150 terawatt-hours -- comparable to the energy consumption of countries like Poland or Argentina. This has driven both environmental criticism and regulatory attention in multiple jurisdictions, and has been the primary motivator for alternative consensus mechanisms.
Proof of Stake
Proof of Stake (PoS), adopted by Ethereum in September 2022 in an upgrade known as "the Merge," replaces computational competition with financial collateral. Validators lock up (stake) cryptocurrency as a security deposit -- Ethereum requires a minimum of 32 ETH (roughly $100,000 at 2024 prices) to run a validator node. Validators are randomly selected to propose new blocks, with the probability weighted by the size of their stake.
If a validator acts dishonestly -- for example, by trying to include fraudulent transactions or by signing conflicting blocks (called equivocation) -- they lose a portion of their stake through a process called slashing. This economic punishment replaces the energy expenditure of PoW with financial risk.
PoS uses approximately 99.95% less energy than PoW, according to the Ethereum Foundation's estimates, validated by independent analyses from the Cambridge Centre for Alternative Finance. The security assumption is different: an attacker must acquire a majority of all staked cryptocurrency, which would be extremely expensive and would simultaneously destroy the value of the currency they acquired.
Critics of PoS raise several concerns: it concentrates power with large stakeholders (the wealthy get proportionally more influence -- a dynamic called "the rich get richer" problem), it has a shorter security track record than PoW's 15+ years, and the "nothing at stake" problem (validators can theoretically vote for multiple conflicting chain forks at no cost) requires additional protocol complexity to prevent. Ethereum addresses the nothing-at-stake problem through its Casper protocol, which imposes slashing penalties for equivocation.
Other Consensus Mechanisms
Delegated Proof of Stake (DPoS), used by EOS and Tron, allows token holders to vote for delegates who then validate transactions. This enables faster consensus (EOS targets 0.5-second block times) at the cost of decentralization -- EOS operates with only 21 block producers, compared to Bitcoin's thousands of miners and Ethereum's hundreds of thousands of validators.
Proof of Authority (PoA) uses a small number of pre-approved, identified validators -- suitable for private enterprise blockchains where participants are known and trusted, but not for public, permissionless systems. It sacrifices decentralization entirely in exchange for speed and efficiency.
Byzantine Fault Tolerant (BFT) algorithms, such as Practical BFT (PBFT) used in Hyperledger Fabric, are efficient for known participants in a consortium setting. They can tolerate up to one-third of participants being faulty or malicious, based on the theoretical bounds proven by Lamport et al. (1982).
Smart Contracts
What Smart Contracts Are
Smart contracts are programs that live on a blockchain and execute automatically when their trigger conditions are met. They are immutable once deployed -- the code cannot be changed (though proxy patterns allow upgradability at the cost of additional complexity and trust). They are deterministic -- every node in the network will execute the same code and reach the same result. And they are trustless -- no intermediary is needed to enforce their execution.
Nick Szabo coined the term in 1994, describing smart contracts conceptually as a digital vending machine: you put in the right inputs (money, trigger conditions) and the machine automatically delivers the output without any human intervention needed. Ethereum, launched in 2015 by Vitalik Buterin, made smart contracts practical at scale by creating a general-purpose blockchain -- essentially a decentralized world computer that anyone can program.
How Smart Contracts Execute
A smart contract is deployed to the blockchain with an address, just like a wallet. Any user can send a transaction to that address, providing inputs and triggering execution. The contract code runs on the Ethereum Virtual Machine (EVM) -- a standardized, sandboxed execution environment that every Ethereum node runs identically, ensuring consensus on the output.
Execution costs gas -- a unit measuring computational effort. Each operation (adding two numbers, storing a value, transferring tokens) has a gas cost. The user specifies a gas price (how much they will pay per unit of gas) and a gas limit (maximum gas they are willing to spend). This mechanism prevents infinite loops and spam while creating a market for computational resources.
An escrow smart contract might work as follows: hold payment from a buyer, verify that a delivery confirmation has been recorded on-chain (or confirmed by a trusted oracle), then automatically release funds to the seller. No escrow agent, bank, or trusted third party is needed. The code is the arbiter.
The Smart Contract Security Problem
Smart contracts are only as reliable as the code they contain -- and unlike traditional software, bugs in deployed smart contracts are often unfixable and catastrophic.
The DAO Hack (2016): The Decentralized Autonomous Organization raised $150 million in ETH through a token sale. A reentrancy vulnerability in its smart contract allowed an attacker to recursively call the withdrawal function before the contract updated its balance, draining approximately $60 million worth of Ether. The Ethereum community controversially executed a hard fork to reverse the transactions, splitting the network into Ethereum (which reversed the hack) and Ethereum Classic (which did not, on principle).
The Oracle Problem: Smart contracts cannot natively access real-world data -- asset prices, weather conditions, shipment status, sports scores. They need external data feeds called oracles (such as Chainlink, which has secured over $75 billion in DeFi value by 2024). These oracles reintroduce centralized points of trust, partially undermining the trustless promise of smart contracts. If the oracle provides incorrect data, the smart contract will execute faithfully but incorrectly.
Audit Economics: The smart contract security audit industry has grown rapidly. Firms like Trail of Bits, OpenZeppelin, and Consensys Diligence charge $50,000 to $500,000+ for comprehensive audits of complex DeFi protocols. Despite this, DeFiLlama data shows that over $7 billion has been lost to smart contract exploits, bridge hacks, and related vulnerabilities since 2020.
Real Use Cases Beyond Cryptocurrency
Supply Chain and Provenance
Blockchain-based provenance tracking allows companies and consumers to verify where a product came from and how it moved through the supply chain. IBM Food Trust, a blockchain platform built on Hyperledger Fabric and used by Walmart, allows the company to trace the origin of a food product to its source farm in 2.2 seconds rather than the previous average of nearly seven days. This capability proved directly relevant during food safety incidents, enabling targeted recalls rather than blanket recalls that waste safe products.
Maersk, the world's largest shipping company, partnered with IBM to create TradeLens -- a blockchain platform digitizing shipping documentation. International shipping involves an average of 30 different organizations and over 200 separate communications per container. TradeLens aimed to reduce this paperwork, though the platform was ultimately shut down in 2022 when it failed to achieve sufficient industry adoption -- illustrating that technological capability alone does not guarantee market success.
Healthcare Records
The fragmentation of healthcare records across providers, insurers, and facilities is a longstanding problem that costs the US healthcare system an estimated $32 billion annually in unnecessary duplicate tests and administrative overhead (McKinsey, 2023). Blockchain-based health record systems allow patients to control access to their records and share them across providers without requiring a central health information exchange.
Estonia's national health record system uses blockchain technology (specifically, a system called KSI Blockchain developed by Guardtime) to provide citizens and healthcare providers a secure, auditable log of who has accessed medical records and when. This does not store the medical data itself on-chain -- the records remain in conventional databases -- but the blockchain provides an immutable audit trail that detects any unauthorized access or tampering.
Digital Identity and Credentials
Self-sovereign identity (SSI) systems use blockchain to allow individuals to hold cryptographically verified credentials -- degrees, professional certifications, government ID -- without relying on centralized databases that can be hacked or go offline. The individual holds their own credentials in a digital wallet and presents them directly to verifiers who can check validity against the blockchain without contacting the issuing institution.
The World Wide Web Consortium (W3C) published the Decentralized Identifiers (DID) specification as a recommendation in 2022, providing a standards-based framework for blockchain-anchored identity. Several governments, including those of South Korea, Canada, and the European Union, are piloting blockchain-based digital identity systems.
Decentralized Finance (DeFi)
DeFi applications use smart contracts to replicate financial services -- lending, borrowing, trading, yield generation -- without traditional intermediaries. Protocols like Uniswap (decentralized exchange), Aave (lending/borrowing), and MakerDAO (stablecoin issuance) collectively processed hundreds of billions of dollars in transaction volume through 2023-2024.
The total value locked (TVL) in DeFi protocols peaked at approximately $180 billion in November 2021, crashed to roughly $40 billion during the 2022 bear market, and has since recovered to approximately $90-100 billion by late 2024 (DeFiLlama data). The space has also suffered numerous exploits and protocol failures, highlighting both the potential and the immaturity of the technology.
Key Limitations and Honest Assessment
The Blockchain Trilemma
The trilemma of blockchain design, articulated by Vitalik Buterin, holds that it is extremely difficult to simultaneously achieve decentralization, security, and scalability. You can typically achieve two of the three at the expense of the third.
| Approach | Decentralization | Security | Scalability |
|---|---|---|---|
| Bitcoin (PoW) | High | High | Low (~7 tx/sec) |
| Ethereum L1 (PoS) | High | High | Medium (~15-30 tx/sec) |
| Ethereum L2 (Rollups) | Medium | High (inherits L1) | High (1,000+ tx/sec) |
| Solana | Medium | Medium | High (~4,000 tx/sec) |
| Visa (centralized) | None | High (institutional) | Very high (~65,000 tx/sec peak) |
Layer 2 solutions like the Lightning Network for Bitcoin and rollups (Optimistic and ZK-rollups) for Ethereum attempt to address scalability by processing transactions off-chain and batching settlement onto the main chain. These add complexity but represent the most promising path to practical scalability.
Irreversibility
Immutability is both the key feature and a significant drawback. When funds are sent to the wrong address, when a smart contract is exploited, or when a private key is lost, there is no central authority to reverse the transaction. An estimated 3.7 million Bitcoin (roughly 20% of the total supply) are believed to be permanently lost due to lost keys and inaccessible wallets (Chainalysis, 2023). The Ethereum DAO hack reversal required the entire community to agree to a hard fork -- and a minority rejected the fork, continuing as Ethereum Classic.
Privacy Paradox
All transactions on a public blockchain are permanently visible to anyone. While addresses are pseudonymous rather than directly tied to real identities, sophisticated chain analysis firms like Chainalysis and Elliptic can often de-anonymize transactions by linking addresses to known entities (exchanges, identified wallets) and tracing transaction patterns. The US Department of Justice has successfully used blockchain analysis to identify and prosecute criminals who assumed cryptocurrency transactions were untraceable.
For many business applications, this public transparency is unacceptable. Zero-knowledge proofs (used by protocols like Zcash and increasingly integrated into Ethereum Layer 2 solutions) offer a cryptographic solution -- the ability to prove that a transaction is valid without revealing its details -- but add computational overhead and complexity.
Energy and Environmental Concerns
Bitcoin's Proof of Work mechanism consumes approximately 150 TWh annually (Cambridge Bitcoin Electricity Consumption Index, 2024). While a growing proportion of Bitcoin mining uses renewable energy -- the Bitcoin Mining Council's survey of 48% of the global hashrate reported 59% sustainable energy mix in Q3 2023 -- the absolute energy consumption remains large and draws regulatory attention. The European Parliament considered (and narrowly rejected) a de facto ban on Proof of Work mining in 2022. China banned Bitcoin mining entirely in 2021, though operations have partially relocated to other jurisdictions.
Ethereum's transition to Proof of Stake eliminated its energy problem, but Bitcoin's community has shown no inclination to follow suit, arguing that PoW's energy expenditure is the security mechanism and that the comparison should be to the energy cost of the traditional financial system it replaces.
When Blockchain Makes Sense -- and When It Does Not
Blockchain is genuinely useful for specific problems: those requiring a shared, tamper-resistant record among parties who do not fully trust each other and where decentralization is important. For problems that have a natural central authority already, a traditional database is almost always simpler, cheaper, and faster.
A useful decision framework:
- Do multiple parties need to write to the shared record? If only one party writes, use a regular database.
- Do those parties distrust each other? If there is a trusted central party, use a regular database administered by that party.
- Is immutability important? If records need to be editable or deletable (e.g., GDPR compliance), blockchain is a poor fit.
- Is decentralization actually required? Most enterprise "blockchain solutions" are more accurately described as distributed databases with cryptographic signing -- and do not require or benefit from the decentralized consensus mechanisms that define blockchain technology.
"You can't understand blockchain's value until you understand that 90% of proposed blockchain use cases would be better served by a PostgreSQL database. The remaining 10% are genuinely revolutionary." -- Attributed to various blockchain engineers, reflecting a widely shared industry view
The most battle-tested use of blockchain technology remains Bitcoin as a store of value and censorship-resistant payment network. Ethereum's smart contract ecosystem is the second most proven, though it has suffered more high-profile failures due to smart contract bugs. Evaluating any blockchain proposal critically -- asking whether the specific properties of blockchain (decentralization, immutability, trustlessness) are actually needed for the problem at hand -- is the most important skill for anyone assessing the technology.
References and Further Reading
- Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System. https://bitcoin.org/bitcoin.pdf
- Buterin, V. (2014). A Next-Generation Smart Contract and Decentralized Application Platform. Ethereum White Paper.
- Szabo, N. (1994). Smart Contracts. Unpublished manuscript. https://www.fon.hum.uva.nl/rob/Courses/InformationInSpeech/CDROM/Literature/LOTwinterschool2006/szabo.best.vwh.net/smart.contracts.html
- Lamport, L., Shostak, R., and Pease, M. (1982). The Byzantine Generals Problem. ACM Transactions on Programming Languages and Systems, 4(3), 382-401.
- The Ethereum Foundation. (2022). The Merge. https://ethereum.org/en/roadmap/merge/
- Cambridge Centre for Alternative Finance. (2024). Cambridge Bitcoin Electricity Consumption Index. University of Cambridge. https://ccaf.io/cbnsi/cbeci
- Merkle, R. (1979). Secrecy, Authentication, and Public Key Systems. Stanford PhD Thesis.
- IBM Food Trust. (2023). Supply Chain Transparency. IBM Corporation.
- Chainalysis. (2023). The Chainalysis State of Crypto Report.
- DeFiLlama. (2024). DeFi Total Value Locked Data. https://defillama.com/
- Christidis, K., and Devetsikiotis, M. (2016). Blockchains and Smart Contracts for the Internet of Things. IEEE Access, 4, 2292-2303.
- Buterin, V. (2021). Why Sharding is Great: Demystifying the Technical Properties. Ethereum blog.
- O'Dwyer, K. J., and Malone, D. (2014). Bitcoin Mining and Its Energy Footprint. IET Conference on Signal Processing and Information Technology.
- Tapscott, D., and Tapscott, A. (2016). Blockchain Revolution. Portfolio/Penguin.
- World Wide Web Consortium. (2022). Decentralized Identifiers (DIDs) v1.0. W3C Recommendation. https://www.w3.org/TR/did-core/
- Hyperledger Foundation. (2023). Hyperledger Fabric Documentation. Linux Foundation.
- Antonopoulos, A. M. (2017). Mastering Bitcoin (2nd ed.). O'Reilly Media.
- Antonopoulos, A. M. and Wood, G. (2018). Mastering Ethereum. O'Reilly Media.
Frequently Asked Questions
What is a blockchain and how does it work?
A distributed ledger replicated across many computers, where records are organized into cryptographically linked blocks. Changing any historical block invalidates all subsequent blocks, requiring majority network agreement to accept the change — making the ledger practically immutable without a central authority.
What is the difference between Proof of Work and Proof of Stake?
Proof of Work requires computationally expensive puzzle-solving to add blocks (Bitcoin, 7 tx/sec, high energy). Proof of Stake requires locking up cryptocurrency as collateral — validators are randomly selected proportionally to their stake and can lose it if they cheat (Ethereum post-2022, ~99.95% less energy).
What are smart contracts and how do they work?
Self-executing code stored on a blockchain that runs automatically when trigger conditions are met, without intermediaries. Once deployed they are immutable — code cannot be changed. The 2016 DAO hack ($60M drained) illustrated how bugs in immutable code can be catastrophic.
What are real use cases for blockchain beyond cryptocurrency?
Supply chain provenance (Walmart's food traceability via IBM Food Trust), healthcare records (Estonia's national system), digital identity (self-sovereign credentials), and DeFi (hundreds of billions in peer-to-peer financial services). Many proposed enterprise uses conclude a traditional database is simpler and cheaper for problems that don't require decentralization.
What are the main limitations of blockchain technology?
Scalability (Bitcoin: 7 tx/sec vs Visa: ~1,700), energy consumption (PoW), irreversibility of errors and hacks, limited on-chain privacy, governance difficulty, and the oracle problem (smart contracts can't natively access reliable real-world data without centralized data feeds).
