For anyone who was thinking, like me, "If that formula is correct, couldn't you precompute hashes and then subtract Hash(chain) to get the desired nonce", it's

For anyone who was thinking, like me, "If that formula is correct, couldn't you precompute hashes and then subtract Hash(chain) to get the desired nonce", it's more like Hash(nonce + 2^256 * Hash(chain[including with new transactions])) < value Still an oversimplification, of course.