Bitcoin

The root problem with conventional currency is all the trust that’s required to make it work. The central bank must be trusted not to debase the currency, but the history of fiat currencies is full of breaches of that trust. Banks must be trusted to hold our money and transfer it electronically, but they lend it out in waves of credit bubbles with barely a fraction in reserve.

— Satoshi Nakamoto

In this famous quote, Satoshi elegantly identifies the two great problems of the current monetary system: the creation of new money by the central bank (“the history of fiat currencies is full of breaches of that trust”) and the creation of new money in the form of credit by commercial banks through the fractional reserve system (“they lend it out in waves of credit bubbles with barely a fraction in reserve”).

The Problem

The task of launching a new decentralised electronic monetary system seems like a mission impossible for two reasons. First, how can one make something digital scarce¹ without relying on a trusted third party to prevent double-spending? Second, if such a thing can be achieved, how does one convince people to use it as money --- that is, to accept the new invention as payment? Satoshi achieved both objectives with three key ideas that improved upon the designs of Szabo, Dai, and Finney:

• Grouping transactions into blocks and requiring PoW for a block to be valid, rather than for a token to be valid, and chaining blocks of transactions together via hashes.

• The difficulty adjustment algorithm, which resolves the long-standing problem of ever-increasing ease in creating tokens, and makes the rate of issuance of new bitcoin entirely predictable.

• Digital scarcity, by establishing a coin issuance schedule in which the quantity of coins issued in each block decreases over time, such that a total of just under 21 million coins will ever be produced.

Through the first of these, he managed to eliminate the need for trusted third parties. The proof-of-work blockchain serves as the source of truth, and it is a network of peers that reaches consensus on which blockchain is the valid one. With the difficulty adjustment algorithm, he resolved the problem of ever-increasing ease in issuing tokens. And with the fixed issuance schedule, he created digital scarcity and, more importantly still, an incentive to get in early --- an incentive that meant that this time, something aspiring to be money actually managed to spread, overcoming the enormous invisible barrier that any new invention must surmount in order to be used as money.

Writing a description of this thing for the general public is really hard. There’s nothing to relate it to.

— Satoshi Nakamoto

The invention is of gigantic proportions, and describing it in terms that anyone can understand is no simple task, as Satoshi himself noted. This absence of analogies is the key to the difficulty.

Analogies

Nobody understands quantum mechanics.²

— Richard P. Feynman

Nobel Prize-winning physicist Richard Feynman made this statement in one of his lectures to explain that what we call understanding is the act of drawing an analogy with some model that is already familiar to us --- and since there is nothing in the macroscopic world we know that behaves like subatomic particles, we cannot truly understand their behaviour. We can only accept that subatomic particles behave in this strange way, nothing more.

Something similar happens with Bitcoin when we try to grasp the behaviour of subatomic particles. Bitcoin does not behave like anything that exists today or has ever existed previously in human history. Every shortcut to understanding it comes with problems.

• It shares some characteristics with gold: it is scarce, it cannot be created from nothing, and extracting it from the ground (mining it) is costly. But it also differs in important ways: it is not physical, it moves across the internet, it can be transported to the other side of the planet in a second, and it is unconfiscatable.

• It has characteristics similar to PayPal or Visa in that it is a global electronic payments network, but unlike all of them it has its own currency embedded in the network and has no central entity governing the network and handling payment processing. Furthermore, payments do not use the payer’s identity, as current payment networks do.

• It is an internet protocol like FTP, SMTP, or HTTP, but also very different from all of them in that it does not merely transport information --- it also transports value.

• It has a monetary issuance policy, as a central bank does, but unlike the central banks of the fiat system, nobody controls the issuance. The rate of Bitcoin issuance is fixed and is not subject to anyone’s decisions.

• It is also like the cash we use, in that we can exchange it directly between people without needing a third party to authorise the transaction, but unlike banknotes and coins, it can be used for electronic payments over long distances. The payer and payee need not be in the same physical location. Another difference is that transactions are not completely anonymous but pseudonymous, and they are recorded permanently on a public blockchain.

There is no royal road to geometry.³

— Euclid

Legend has it⁴ that King Ptolemy wanted to learn geometry and asked Euclid whether there was an easy method for doing so, to which Euclid replied with this phrase, meaning that there is no special path for kings, no shortcut. Something similar applies to Bitcoin. There is no easy shortcut to understanding it. It is something different from everything previously known to human beings, and therefore if we seek to understand it through shortcuts --- drawing analogies with something familiar in order to draw conclusions based on the analogy --- we are very likely to reach wrong conclusions, given that all analogies break down at some point.

The Multifaceted Nature of Bitcoin

Bitcoin is an internet protocol implemented in open-source software. It is also the network of nodes that speak this protocol, and also a new form of money. Bitcoin is many things at once. If one had to define it in a short phrase, I can think of no better way than the very title Satoshi gave the white paper: peer-to-peer electronic cash. That is, cash (money), electronic (non-physical), peer-to-peer (without a trusted third party). Bitcoin is a giant leap in the field of computer science. It is an invention⁵ that cannot be uninvented.

One of the reasons we find it difficult to understand Bitcoin is that it does not fit neatly into any single area of knowledge. In today’s society we are very accustomed to the compartmentalisation of knowledge and specialisation. Economists do not usually study cryptography, philosophers do not usually study software engineering, and mathematicians do not usually study philosophy. There are not many people with deep knowledge across all the fields that intertwine in Bitcoin: cryptography, game theory, computer science, telecommunications, economics, and philosophy.

Bitcoin makes intensive use of two basic cryptographic primitives: digital signatures and hash functions. Understanding these two concepts is absolutely essential to understanding how Bitcoin works.

In Bitcoin, no one’s permission is required. Bitcoin is software that anyone can run on their computer, and analogously, anyone can mine. It is therefore essential that the most profitable strategy is always to follow the consensus rules. Game theory is the branch of mathematics that studies, given a particular decision, what the optimal choice is for an individual when the costs and benefits of each option are not fixed but depend on the choices of other individuals. In Bitcoin, each participant in the network acting in their own interest benefits the network, while anyone who tries to cheat is at a disadvantage.

since Bitcoin is ultimately software, understanding it in detail also requires knowledge of computer science and programming. The consensus rules that allow all nodes on the network to independently arrive at the same view of the transaction history are not written in English, nor in any formal specification language. They are written in C++.⁶

Bitcoin runs on TCP/IP⁷ and uses, among other things, the DNS service⁸ for the bootstrapping process of a node. Optionally, it also uses TOR, the The Onion Router service, for encrypted communication between nodes. This knowledge is necessary to understand, among other things, resistance to possible denial-of-service attacks and decentralisation.

At the end of the day, Bitcoin is money --- a new form of money --- so a knowledge of economics is necessary. In fact, when falling down the Bitcoin rabbit hole, it is very common to also start learning about the history of money and the Austrian school of economics, and in doing so, the fallacies of Keynesianism and the problems of the fiat system gradually become apparent.

Being a system in which no one can censor transactions, it fits very well with libertarian philosophy, grounded in the Non-Aggression Principle, from which it follows that all exchanges must be voluntary for both parties. Free Software is also at its core a philosophical movement, as Richard Stallman had described when publicly declaring why he was going to write GNU. The Cypherpunk movement was also a philosophical movement that promoted the search for internet-native money, due to the importance its members placed on privacy for achieving a truly free society. But philosophy is not only necessary for reflecting on and understanding the importance of privacy or Free Software. Have you ever thought about how fiat money is created? If you knew how it is created, have you ever asked yourself whether it is ethical? Most of us have never asked ourselves this, at least not until encountering Bitcoin. When falling down the Bitcoin rabbit hole, it is almost impossible not to end up questioning things of this kind --- and, worse still, things we had wrongly taken for granted. Curiously, the book The Ethics of Money Production[@TheEthicsofMoneyProduction], by Jörg Guido Hülsmann, a German economist of the Austrian school, was published in October 2008 --- the same year and month in which Satoshi published his white paper.

The Early Years

Since Bitcoin is multidisciplinary and multifaceted, it is even difficult to know where to begin studying it --- and as if that were not complicated enough, it is also something that keeps changing. Bitcoin today is not the same as it was in 2008 when it was born. When Satoshi announced the Bitcoin white paper[@SatoshiWhitePaper] on 31 October 2008, Bitcoin was an idea set out in a document hosted on the website www.bitcoin.org. When Satoshi mined the genesis block on 3 January 2009 and started the software he had developed to implement the idea, Bitcoin was also the software on Satoshi’s computer --- but it could not yet be called a network. When on 11 January Hal Finney ran the software on his computer and their nodes connected to each other, it began to be a network. Later, more people voluntarily joined and started the program on their computers, with the nodes connecting to one another. Being a network, it then became possible to transfer “certain amounts” from one node to another. It cannot be said that value was being transferred at that point, since those numbers were worth nothing.⁹ Nearly a year would pass before the first transaction exchanging bitcoin for dollars took place. It was Martti Malmi, one of Bitcoin’s first developers, who sold 5050 bitcoin for $5.05 to New Liberty Standard. The exchange rate at which they valued bitcoin was 1000 bitcoin per dollar.

Approximately six months later, on 22 May 2010, Laszlo Hanyecz paid 10000 bitcoin for two pizzas. A few days earlier he had posted a message on the forum saying he would pay 10000 bitcoin to whoever delivered two pizzas to him (costing approximately $30), and it was on 22 May that another forum user (jercos) accepted the deal. At that moment, two people had valued two pizzas (including delivery) at 10000 bitcoin. By then, there was already a website where bitcoin could be bought and sold --- www.bitcoinmarket.com --- at which the price of bitcoin was $0.0041. At that point it could be said that the network was already transferring value, at least for some users, and that at least one payment had been made (the two pizzas). As more users joined, the network became more useful, which was reflected in the bitcoin “price”¹⁰, which appeared on the first exchanges that emerged throughout 2010 and 2011. In February 2011, bitcoin reached parity with the US dollar --- something unthinkable barely two years earlier, when it was nothing but numbers in a new piece of open-source software.

During its first two years, Bitcoin continued to be developed mainly by Satoshi, who added Linux support in version 0.2 and MacOS support in version 0.3. In July 2010, to make the network more resistant to denial-of-service attacks, Satoshi capped the maximum block size at 1 megabyte --- a limit that would become part of the Consensus Rules in September 2010. He also fixed several bugs in the code, such as the overflow bug exploited by a user on 15 August 2010, who constructed a transaction that was included in block 74638. That transaction created 184 billion bitcoin, and the nodes, due to the bug, considered it valid. Satoshi fixed the bug within a few hours, the nodes updated their software to version 0.3.10 which corrected it, and they reorganised the chain from the block prior to that transaction.

Almost two years after its launch, the network was still very fragile, and Satoshi was very much aware of this when the US government had just blocked donations to WikiLeaks by freezing its accounts and connections with the payment networks of the traditional financial system, and WikiLeaks was searching for new ways to receive donations.

No, don’t bring it on. The project needs to grow gradually so the software can be strengthened along the way. I make this appeal to WikiLeaks not to try to use Bitcoin. Bitcoin is a small beta community in its infancy. You would not get more than pocket change, and the heat you would bring would likely destroy us at this stage.¹¹

— Satoshi Nakamoto

On 5 December, Satoshi tried to discourage WikiLeaks from using Bitcoin, but just five days after his message, the magazine PC World published an article with the headline: Could the WikiLeaks Scandal Lead to a New Virtual Currency?

The following day, Satoshi wrote on bitcointalk.org:

WikiLeaks has kicked the hornet’s nest, and the swarm is headed towards us.¹²

— Satoshi Nakamoto

One day later, on 12 December 2010, he published his last message on the forum, announcing version 0.3.19, and disappeared --- closing the first chapter of Bitcoin’s history, which can be considered a manual of instructions for decentralisation. In this respect, decentralisation, no other cryptocurrency comes even remotely close. Hence the famous “There is no second best” by Michael Saylor¹³.

Internal Workings

It is possible to try to understand Bitcoin solely from its properties, without understanding how it works internally or knowing its history. But if we do not understand its internal workings or know its history, we need to trust someone who does understand it to assure us that its supposed properties are real. For example, we can accept that the limit of $21$ million cannot be changed and reason about a currency with such an absolute cap. But if we do not understand how it works internally, we might also think: “this is software and the developers can change it.” We do not know why it cannot be changed; we have to trust that whoever says so is correct. By contrast, understanding its internal workings and knowing its history allows us to deduce those properties that make it so special --- and we do not need to trust anyone, because we are able to see it with our own eyes. After all, the essence of Bitcoin is the elimination of the need to trust a third party. Hence the mantra: Don’t trust, verify.

The good news is that understanding how it works is something we can do at different levels of abstraction. For example, we can understand public-key cryptography conceptually --- that is, understand the relationship between the public and private key --- without needing to know the elliptic curve mathematics over finite fields underlying ECDSA signatures. It is also possible to understand that a hash function is deterministic (for the same input it always produces the same output) but unpredictable, without delving into the internal details of SHA-$256$. Having learned the history of its birth and early years --- so important for understanding the property of decentralisation --- we will now attempt to explain the essence of how it works in simple terms, without using advanced concepts from mathematics or cryptography, but also without resorting to shortcuts or analogies that might lead us astray.

First and foremost, there is a fundamental fact that must be internalised: Bitcoin serves to exchange value. It is very important to reflect on this point. Bitcoin does not transfer (only) information --- it also transfers value, and unlike information, in order for value to be transferred, the person transferring it must cease to possess it. In the material world it is obvious that if Alice hands a banknote to Bob, Bob now has the banknote and Alice no longer does. It is so obvious that we do not even stop to think about it. But what happens in the digital realm, where everything can be copied as many times as we wish? When Alice gives Bob the digital equivalent of the banknote --- since any digital object is a sequence of ones and zeros --- how does Alice cease to possess the ones and zeros? We cannot trust her to delete them, and if she does not delete them she could give them to someone else. How are we to make that banknote behave like money if it can be spent an infinite number of times? Something like that could never be used as money.

Before Bitcoin, this was resolved with trusted third parties: banks. Alice and Bob had accounts at a bank, and an electronic payment from Alice to Bob was a message from Alice instructing the bank to send €10 to Bob. The bank would then subtract €10 from Alice’s account and add €10 to Bob’s account. If Alice and Bob held accounts at different banks, messages between the banks were required, but the matter is essentially the same. With trusted third parties that maintain users’ account balances, the problem simply does not exist. Bit Gold, b-money, and RPOW all attempted to eliminate trusted third parties, but none succeeded, since certain “servers” that had to be trusted were always needed for everything to function.

But, with digital money and no trusted third parties, if Alice gives ten coins to Bob, how do we prevent her from also giving them to Carol? This is known as the double-spending problem, and before 2008 many believed it was an unsolvable problem, given the infinitely copyable nature of digital information. Although the authenticity of messages and proof of ownership of coins was a problem already solved by public-key cryptography --- known since the 1970s --- this was not sufficient to resolve the double-spending problem, since Alice can create two messages: one sending the coins to Bob and another sending them to Carol. Both messages are correctly signed, both are authentic, coming from the owner of those coins, and there is no authority to decide which payment is the genuine one and which is the attempted double-spend. Taking the decision based on the moment at which the network sees each of the two transactions would not work either, since some nodes might see one message as coming first while other nodes see the other.

But although some nodes may see one transaction first and others may see the other, the solution does involve ordering transactions chronologically: somehow a decision must be made as to which is the first transaction (which will be considered valid) and which is the second (which will be considered an attempted double-spend). The core of Satoshi’s invention was to enable the network of nodes itself to reach consensus on the chronological order of transactions. With all nodes on the network agreeing on the order, the first transaction is valid and the second is not, and all nodes will reject it. Put this way it sounds simple, but the problem remains --- we have merely renamed it. The new name is: how can this consensus on the chronology of transactions be reached in a decentralised manner? This could not be done based on transaction timestamps, as we have seen. It was also not possible to resort to timestamp servers, because that would reintroduce the problem of trusted third parties --- precisely the problem we are trying to avoid.

Bitcoin’s solution is that the transactions that “actually take place” and the order in which they occur are those included in a block with sufficient proof of work, which is added to the blockchain. A block is simply a set of transactions with a valid block header pointing to the previous block, thereby forming a chain of blocks stretching back to the first block, or genesis block. Hence the name blockchain. But continuing with our example… which transaction is the “valid” one --- the one sending the coins to Bob or the one sending them to Carol? And furthermore, who decides? Since both are valid transactions from the standpoint of the protocol, and both are correctly signed by the owner of the coins, it seems that an arbitrary decision must be made by someone, and others must agree with it. And indeed it is an arbitrary decision, made by the miner who creates the block in which they include one of the two transactions. The miner decides which is the payment and which is the invalid double-spend attempt.

But… who are these miners who have the privilege of deciding? Did we not say that in Bitcoin everything is peer-to-peer, that there are no special nodes? Why do these miners have this privilege? In reality, there is no privilege. Anyone can be a miner. There is no licence to apply for from Satoshi or from any institution, and the code is free. This answer leads to another question: if there are many miners, which one is it that creates the block?

Here lies another of the key pieces of the puzzle, without which Bitcoin would not work: Proof of Work. As we saw in the previous chapter, it was Adam Back who had devised Hashcash, and in fact Hal Finney, Wei Dai, and Nick Szabo had all already used it in their proposals to create money tokens. Unlike them, Satoshi’s idea was to use Proof of Work as the mechanism for mining blocks rather than for creating the value tokens themselves, thereby resolving the problem of selecting which miner creates the block and chooses the transactions to include in it.

Mining a block means attempting to find a number called a nonce such that, by applying the hash function to the block header (of which the nonce forms part), the result is a sufficiently small number --- specifically, smaller than a value called the target. The target is a $256$-bit number that determines whether a hash is valid or not. A hash greater than the target is invalid; a hash smaller than it is valid.

A hash function is irreversible and unpredictable. It is not possible to determine what input is needed to produce a desired output, or even to produce output with a certain appearance. A minimal change in the input value --- a single bit --- produces a completely different output. Therefore there is no way to determine what form the block header must take for the hash function to produce a small number. This property of hash functions means that the only way to find a valid nonce is to try one’s luck over and over again. Try an arbitrary nonce, calculate the hash; if the result is greater than the target, change the nonce and try again. Even at the beginning of the network, billions of hashes were needed on average to mine a block.¹⁴ Hence the name “Proof of Work”.

If you don’t understand Proof of Work, you don’t understand Bitcoin.¹⁵

— Gigi

The nonce is the proof. It is proof that the work has been carried out, because there is no other way to find the nonce. The fact that any computer can independently verify in under a millisecond that the work has been done is the key to achieving distributed consensus in a network of equal nodes.

Continuing the explanation of the solution to the double-spending problem, there are still important questions and pieces of the puzzle to place before the whole thing works. So far we have established that a miner decides which transaction is the payment and which is the forgery, thus preventing double-spending. But this introduces another problem: miners must perform an enormous number of calculations, which entails an energy cost. Why would there be any miners? There is no NGO or company providing funds for miners to exist, and if there were no miners, there would be no blocks and no transactions. On the other hand, where do the coins come from? Who has them, and how are they distributed?

The next piece of the puzzle answers both questions at once. In each block, new bitcoin are created, and when miners mine a block they assign themselves the newly created bitcoin in that block. This reward is the necessary incentive for miners to exist, and it also provides the mechanism for currency issuance. How many new bitcoin are created in each block? During the first 210000 blocks, this amount (called the subsidy) was 50. In the next 210000 blocks it was 25. At the time of writing it is 3.125. Every 210000 blocks --- which occurs approximately every four years --- the subsidy is halved, an event known as the halving. With this, Satoshi achieved three things:

• An incentive for miners to exist.

• A decentralised currency issuance. At the start of the network there were zero coins. Satoshi did not assign any to himself (unlike the vast majority of altcoins). Bitcoin is created gradually as the network operates.

• Digital scarcity: a maximum supply capped at 21 million¹⁶.

With these three pieces, Satoshi finally managed to solve the double-spending problem in a decentralised network of equal nodes --- something that had seemed impossible until then.

There is, however, one more important detail to understand about how it works. Earlier we mentioned that approximately 210000 blocks will be found every four years, but we still need to understand why this is so --- that is, what prevents them from being found much more quickly as technological improvements allow ever more hashes to be computed per second. In other words, how did Satoshi solve the problem that Nick Szabo had identified in his own design, which implied that creating money would become increasingly easy over time? Although the halving prevents the total quantity of money created from growing indefinitely, without a safeguard against this ever-increasing ease of computation, all bitcoin would have been generated years ago, since blocks would have been appearing faster and faster.

Satoshi solved this problem with the difficulty adjustment algorithm. Every 2016 blocks, each node’s software calculates how much time has elapsed during the production of the last 2016 blocks. If more than two weeks have passed, that means the average time between blocks is greater than ten minutes, and the mining difficulty must be lowered. If less than two weeks have passed, the average time between blocks is less than ten minutes, and the difficulty must be increased. This adjustment is proportional to the calculated deviation --- that is, if blocks have been appearing 10% faster, the difficulty is increased by 10%. During periods of technological advancement --- such as when in 2010 some users began mining with GPUs,¹⁷ or in 2013 with the appearance of the first ASICs,¹⁸ or simply when more miners join the network --- blocks temporarily appear more frequently, but as soon as the difficulty is adjusted, they return to appearing every ten minutes. This difficulty readjustment is what keeps the network producing on average one block every ten minutes. In this way, Bitcoin’s issuance schedule is independent of technological progress and entirely predictable. We know with certainty how many bitcoin will be created in 2070, 2090, or 2115, and furthermore nobody can do anything to change it. By contrast, we have no idea how many dollars will be created this very year --- nor any year. A few privileged individuals will decide according to their own political agenda.

There are many more details that make Bitcoin work perfectly --- such as the bootstrapping system for a node to find other nodes to connect to, the accounting system based on UTXOs,¹⁹ the various address schemes, the embedded scripting language for transaction validation, how network fees work --- but we will not go into them here, as they are not the subject of this book. For many years there have been excellent books explaining the internal workings in great detail, such as Mastering Bitcoin[@MasteringBitcoin] by Andreas M. Antonopoulos and Grokking Bitcoin[@GrokkingBitcoin] by Kalle Rosenbaum. Programming Bitcoin[@ProgrammingBitcoin] by Jimmy Song goes even deeper into certain internal aspects such as elliptic curve mathematics, digital signatures, and the execution of Script --- the scripting language embedded in Bitcoin --- for the various address types. The aim of this chapter was to explain the essence of the invention in simple terms, so as to be able to approach the subsequent parts of the book.

Conclusion

If I have seen further, it is by standing on the shoulders of giants.²⁰

— Isaac Newton

As Newton did in his day, Satoshi also stood on the shoulders of giants in order to create Bitcoin. And just as Newton’s contributions to mathematics and physics were of monumental proportions, so too is Satoshi’s invention of monumental proportions --- both for the brilliance of the invention itself and for its profound implications for life in society. The more one studies Bitcoin, the harder it becomes to imagine how one person (if indeed it was one person) was capable of conceiving and programming Bitcoin. And even more so, to have been aware of the implications it would have, to have done it anonymously, and then to have disappeared.

For some, it is the greatest invention since the emergence of the internet. Others go even further and suggest it is the greatest since the invention of the printing press. Although at first glance these comparisons may seem exaggerated, Bitcoin has the capacity to profoundly transform the reality of today’s society, making it freer, fairer, more prosperous, and more civilised --- just as the printing press forever changed the reality of the Middle Ages, making possible the emergence of the Renaissance and the Enlightenment.