The "proof" part of proof of work used by Bitcoin is a small piece of information that proves that a lot of work has been done. An invalid proof can be easily c

The "proof" part of proof of work used by Bitcoin is a small piece of information that proves that a lot of work has been done. An invalid proof can be easily checked by other nodes and ignored. In the case of Bitcoin the proof is a set of alphanumeric characters as input to the hashing algorithm (SHA256 I think) that produces a hash with certain properties (some number of leading zeros depending on the current difficulty). Other nodes can verify the proof by taking the input supplied by the miner, combining it with a predetermined nonce and computing the hash and checking that it has the properties required. Computing a single SHA256 is easy compared to figuring out which input to the hash produces a particular output. The next mined block will be appended to the longest valid blockchain the node can see. It's in their interest to append to the one that others will believe, because they get paid the reward only on that chain and thus it only exists in their wallet if others accept it by appending further blocks to it. So generating invalid blocks just doesn't work - they get immediately rejected by other nodes and there is thus no reward. One genuine problem is mining a valid block but adding no transactions to it, to grind transaction throughput to a halt. I think Bitcoin might have some mitigations for this but I don't actually know. If a sufficiently well funded organisation or nation tried to take down Bitcoin this might be the way to do it.