Just Because It's Less Difficult, Doesn't Make It Any Easier
When Satoshi published the original implementation of Bitcoin in 2009, it did use block height (count of blocks from genesis to tip) to determine which chain was the main chain. The whitepaper mentioned the "longest" chain.
However, within about a year and a half people realized that this could be exploited to quickly create a new longer chain, but with a small fraction of the compute it took to generate the current main chain. So in July 2010 "accumulated chainwork" became the new consensus standard for determining which chain was the main chain.
Exploiting Block Height
Before I explain accumulated chainwork, you might be wondering "what do you mean it can be exploited?!"
I was curious too, so I put together a simulation to see just what it would take to rebuild a new blockchain from the genesis block. It turns out that 0.1 EH/s or about $1.5 million in ASICs and ~2 weeks of hashing is enough to rebuild your very own consensus-valid chain from genesis, with a longer block-height than the current main chain, with the public tip being stamped with the appropriate epoch.
How? Well, there are a few important things to know:
- Nodes only care that the blockchain tip isn't more than 2 hours into the future, and that any given block is no earlier than the median of the previous 11 blocks. Blocks don't even have to be in time-order to be consensus valid. You can instantly mine against the Genesis block, when difficulty was the lowest possible (1), but stamp each block as if they were exactly 10 minutes apart (thus keeping the difficulty low).
- In 2009, the chain was on-average significantly slower than 10 minutes per block. That means that a modern ASIC farm can nearly instantly recreate that first year, pretending that it was mining at an even 10 minutes per block, and come into "2010" almost 20,000 blocks ahead of the real blockchain in terms of height, but still at 1 difficulty.
- After that point, the modern chain starts to mine slightly ahead of 10 minutes per block, continuing to the present day. The attacker needs to start pretending that its blocks are being mined faster than every 10 minutes to be able to catch up to the existing chain, which increases difficulty and slows the attacker down. However, it still takes it far less than 10 minutes to create each new block, and eventually (like I said earlier, in about two weeks) the attacker chain has surpassed the real chain in block-height: a consensus-valid alternate history of Bitcoin.
Chainwork
So as you can see, block height is trivially exploited by a modestly financed attacker. Chainwork, on the other hand, completely foils this attack.
The key to the block height attack is that the attacker has calibrated their alternate chain so that the difficulty of each block stays as low as possible for as long as possible. The actual amount of total hashing work that went into their chain is a minuscule fraction of what went into the real chain. With chainwork, the difficulty each block was mined at is taken into account and added up across the entire chain, rather than just the number of blocks.
That takes us back to the beginning: When difficulty drops on an alternate chain, it may start producing blocks four times more quickly, but it's also getting 1/4th the credit. Difficulty doesn't save a minority fork; it's falling just as far behind as it was before a difficulty retarget.