I think the premise of the question is not correct. The work is not useless, it secures the transactions. The public hash chain ensures that Bitcoins can only be spent once. The mechanism piles computations on top of legitimate transactions so that the recipient knows that an attacker would need at least as much computing ability to "undo" the transaction.

There is currently no known way to make the work more useful. The problem is that the primary purpose of securing transactions imposes a number of requirements on the work done:

1. The work must be much, much easier to verify than to do. So it pretty much has to consist of searching for something rare, doing billions of searches to test if an input has a particular characteristic. That way the verification simply requires confirming that the input you found has that characteristic.
2. The work must in fact secure the transactions and not be severable from them. If I see that you sent me 10 Bitcoins and then billions of computations are piled on top of that, it must not be possible to remove that transaction and then pile those same computations on top of a conflicting transaction. So you can't use the result of an arbitrary chunk of work to prove work on the Bitcoin chain.

It's hard to imagine any additional useful work that could be accomplished while still meeting these requirements.

The problem is that no one has come up with a proof-of-work system based on useful work that also:

• Generates easily verifiable solutions
• Can have the difficulty of finding a solution adjusted

For example, if the system were searching for prime numbers, the solutions would take a long time to verify as being prime. The difficulty of finding the next prime also can't be controlled, it just continues increasing.

Assume for a second that we found a proof of work algorithm that had all of the good properties of sha256, but was also useful for SETI and maintaining world peace.

Now suppose a group of miners collectively have more than 51% of the hashing power. In which of the following scenarios are they more likely to collude to double spend via a 51% attack:

A) When the proof of work algorithm is something like sha256 and is only useful for securing the bitcoin network

B) When the proof of work algorithm helps find aliens and maintain world peace in addition to securing the bitcoin network.

In Scenario B, if BTC lost all of its value due to a 51% attack/double spend, miners' hardware would still be valuable because although it couldn't mine bitcoin, it could still find aliens and maintain world peace.

In Scenario A, if BTC were to lose its value, miners' hardware would go down with it, due to said hardware's uselessness for anything other than mining bitcoin.

In short, having a "useless" proof of work algorithm (where "useless" just means being able to secure the bitcoin network and nothing else) is a plus (for the bitcoin network,) because miners will be less tempted to trash bitcoin, knowing that their hardware would be worthless if they were to do so.

"Merged Mining" (simultaneously mining on multiple block chains with the same amount of work) may not be useful in a "real-world" sense, but at least it also produces Namecoins or Solidcoins or what have you in the process of producing Bitcoins.

No, because there is a significant advantage in requiring that the work be done on the actual transaction record, and not on any arbitrary problem.

By making the problem include the transaction record data, it makes any changes to the transaction history require providing a new solution, and this prevents a party from slowly 'storing' solutions, and releasing them all at once, since there are always new blocks of transactions being added to the block-chain, which means the required solution keeps changing, depending what the last block of transactions is.

I thought I would give the answer I know to this question, and that is an economic one.

One of the reasons for using proof-of-work (apart from the technical usefulness) is as a way to inherently give the currency value. If the currency value is too high, to the point that it costs less to buy the computing power to counterfeit currency than it does to buy the currency directly, then there is an economic incentive to counterfeit and stabilize the price.

If we use a problem that is not useless, then there is a chance that it will be more useful to some that to others. As an example, solving an instance of problem X might generate income of $Y for person N, and no income for person M. (Say we are folding proteins and person N is a pharmaceutics company that can use this to build a new drug, while person M is a random person). Then, if it costs $K to counterfeit the currency by buying computing time, then for person N it would cost $(K - Y) while for person M it would cost $K. This could lead to a destabilization of the value of the currency.

Thus, if there is a useful problem, it must be equally useful to ALL users of the currency.

Another excellent reason to select an algorithm that is not useful in any other context other than bitcoin alone is so that the infrastructure prepared for the purposes of securing bitcoin alone is only ever incentive-compatible with securing bitcoin.

Consider the recent introduction of numerous altcoins that share the same PoW algorithms, if the work that being done is meaningful in various contexts then miners will not be dedicated to securing bitcoin as there are economic considerations as to what the work should be spent to contribute to. For example, due to Bitcoin Cash and Bitcoin sharing the same SHA256d PoW algorithm, there's been greater volatility in hash-rate in both cryptocurrency which indirectly weakens security as some proportion of work has to be re-directed elsewhere and it also reduces usability experience to due greater variance in block inter-arrival times.