Bitcoin

Bitcoin is peer-to-peer electronic cash without a mint: a protocol that settles the ownership and ordering of payments through a public, hash-linked proof-of-work chain rather than a trusted intermediary, and that issues new coins on a fixed, programmed schedule converging on a maximum of 21 million. It matters because it is the first design to make a digital object verifiably scarce — joining the finality of physical cash to a money supply that no single party can inflate.

The trusted-third-party problem

Satoshi Nakamoto’s Bitcoin: A Peer-to-Peer Electronic Cash System (2008) defines its problem as one of trust, not transport. Internet commerce relies on financial institutions acting as trusted third parties to process, reverse, and mediate payments; this makes truly non-reversible payments impossible, loads every payment with mediation costs, and cuts off the smallest casual transactions. Physical currency avoids the intermediary in person, but before Bitcoin “no mechanism exists to make payments over a communications channel without a trusted party”.

The deeper obstacle is double-spending. Digital signatures can prove a chain of ownership, but they cannot by themselves show that a prior owner has not already spent the same coin elsewhere. The conventional fix is to introduce “a trusted central authority, or mint, that checks every transaction for double spending” — and then “the fate of the entire money system depends on the company running the mint”. The whitepaper sets the requirement that the rest of the design answers:

“What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”

— Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System

This is the monetary instance of the cypherpunk thesis that trusted third parties are security holes: every intermediary is an added point of failure, surveillance, and control over the payment. The design’s central move is to convert double-spending into an ordering problem — if the whole network can agree which spend of a coin came first, it can reject every later spend without a mint.

Transactions and double-spending

The whitepaper defines an electronic coin as “a chain of digital signatures”. Each owner transfers a coin by digitally signing a hash of the previous transaction together with the next owner’s public key and appending it to the coin, so any payee can verify the chain of ownership back through prior owners — the signature logic treated under public-key cryptography. What signatures cannot reveal is whether one of those owners also signed an earlier transfer of the same coin. Confirming the absence of such a competing transaction requires being “aware of all transactions” — which, without a mint, means every transaction must be publicly announced and all participants must agree on a single order in which transactions were received.

Proof of work and the longest chain

To order transactions without a mint, Bitcoin uses proof of work, a cost function modeled on Adam Back’s Hashcash. Each node gathers new transactions into a block and searches for a nonce so that the block’s SHA-256 hash “begins with a number of zero bits”. The average work is exponential in the number of required zeros, while verifying a finished solution costs a single hash. Once the work has been spent, “the block cannot be changed without redoing the work”, and because each block commits the hash of its predecessor, rewriting a past block means redoing it and every block chained after it.

This converts raw computational cost into a voting rule:

“Proof-of-work is essentially one-CPU-one-vote. The majority decision is represented by the longest chain, which has the greatest proof-of-work effort invested in it.”

— Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System

Tying the vote to CPU power answers the Sybil problem that a simpler design could not: one-IP-address-one-vote “could be subverted by anyone able to allocate many IPs”, whereas one-CPU-one-vote binds influence to a scarce physical resource. The security of this scheme rests on an explicit assumption built into the mechanism: “The system is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes.” An attacker who wants to reverse a transaction must redo the proof of work of its block and all later blocks and then overtake the honest chain; the whitepaper models the race as a Gambler’s-Ruin walk and shows that, given an honest majority, “the probability drops exponentially as the number of blocks the attacker has to catch up with increases”. Dropped network messages are not fatal — a node that sees a later block can request the ones it missed. To hold the block interval steady as hardware speed and participation change, “the proof-of-work difficulty is determined by a moving average targeting an average number of blocks per hour”.

Issuance and incentives

The same proof of work also distributes the coin. By convention the first transaction in each block creates new coins owned by the block’s maker, which rewards the work and “provides a way to initially distribute coins into circulation, since there is no central authority to issue them”. Nakamoto draws the analogy directly:

“The steady addition of a constant of amount of new coins is analogous to gold miners expending resources to add gold to circulation. In our case, it is CPU time and electricity that is expended.”

— Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System

Issuance can also be funded by transaction fees, and “Once a predetermined number of coins have entered circulation, the incentive can transition entirely to transaction fees and be completely inflation free”. The reward doubles as a security argument: a miner who assembles more power than all honest nodes combined should still find it “more profitable to play by the rules” — rules that already pay him more new coins than everyone else — than to defraud people and destroy the validity of his own wealth.

The supply schedule: hardness and absolute scarcity

Saifedean Ammous’s The Bitcoin Standard (2018) reads Bitcoin through Austrian monetary theory, in which a money’s ability to hold its value over time turns on its hardness — the difficulty of expanding its supply, measured by the ratio of existing stock to annual new flow. A high stock-to-flow ratio lets a good hold its value over time; a low one invites producers to flood the market and expropriate savers. Bitcoin fixes its issuance schedule by protocol. The block reward began at 50 coins and halves every 210,000 blocks (roughly every four years), so the supply grows at an ever-decreasing rate, “asymptotically approaching 21 million coins sometime around the year 2140, at which point there will be no more bitcoins issued”. Each coin divides into 100 million satoshis, so a fixed terminal supply still leaves room for ever-finer units of account.

What makes the schedule binding is difficulty adjustment. As demand and price rise, more miners compete and add hashpower, which would shorten block times; the protocol responds by raising the difficulty of the proof of work so that blocks still arrive about every ten minutes. Effort spent mining therefore cannot increase the number of coins — it is absorbed entirely as security. This inverts the dynamic of every prior money, in which a sustained rise in value pulls in more production:

“Bitcoin is the hardest money ever invented: growth in its value cannot possibly increase its supply; it can only make the network more secure and immune to attack.”

— Saifedean Ammous, The Bitcoin Standard

Because a transfer removes a coin from the sender rather than copying it, Bitcoin is “the first example of a digital good whose transfer stops it from being owned by the sender” — digital scarcity, and the root of its cash-like finality, since settlement no longer depends on an institution’s later promise to honor an account entry. And because the cap is set by protocol rather than by the cost of extraction, Ammous argues it reaches a kind of scarcity no physical commodity ever had:

“Beyond digital scarcity, Bitcoin is also the first example of absolute scarcity, the only liquid commodity (digital or physical) with a set fixed quantity that cannot conceivably be increased.”

— Saifedean Ammous, The Bitcoin Standard

These properties are the basis of Bitcoin’s standing as hard money and an instance of unforgeable costliness carried to its limit.

That same inelasticity carries a cost. Because supply cannot respond to demand at all, every shift in demand is absorbed by price; Ammous accordingly expects Bitcoin to be volatile, its volatility deriving from a supply that is “utterly inflexible and not responsive to demand changes” and most erratic in the early stages, when demand “varies very erratically from day to day”. A predictable supply is therefore not the same as a stable purchasing power: he treats store-of-value adoption, payment use, and eventual unit-of-account use as stages a maturing money might pass through, not settled facts.

Verification, not trust

Removing the mint removes the operational dependence on any single party. Every full node independently validates every transaction and block against the protocol rules; a miner who tries to commit an invalid block simply has it rejected and forfeits the reward, at almost no cost to anyone else. Ammous makes verification the design’s organizing principle — “the central operational feature of Bitcoin is verification, and only because of that can Bitcoin remove the need for trust completely” — and states the point as a slogan:

“Bitcoin is built on 100% verification and 0% trust.”

— Saifedean Ammous, The Bitcoin Standard

Nakamoto frames the same consensus from the node’s side, describing honest nodes as “expressing their acceptance of valid blocks by working on extending them and rejecting invalid blocks by refusing to work on them”.

Light clients and scale

Full verification is neither free nor universal. The whitepaper describes Simplified Payment Verification (SPV), which lets a lightweight client confirm that a transaction sits in a block by holding only block headers and a Merkle branch rather than the entire chain. That convenience buys a weaker security model: SPV is reliable only so long as honest nodes control the network, and an attacker who can overpower the network can fool a lightweight client with fabricated transactions. The same constraint shapes throughput. Every fully validating node must receive and check every transaction, so raising base-layer capacity raises the cost of running a node and erodes the decentralization that makes verification meaningful. Ammous argues that Bitcoin’s comparative advantage is therefore not cheap retail payment but high-assurance final settlement, long-distance digital cash, and a scarce reserve asset — with exchanges, custodians, payment channels, and Lightning Network-style layers absorbing everyday volume while the base chain settles.

Privacy

Because the network depends on announcing every transaction publicly, Bitcoin cannot conceal transactions the way a bank does. It relocates privacy instead: “privacy can still be maintained by breaking the flow of information in another place: by keeping public keys anonymous”. Ownership is assigned to public addresses rather than names, and the whitepaper recommends a fresh key pair for each transaction. The base layer is therefore pseudonymous, not anonymous, and the design states the limit plainly: “Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner.” If a key is ever connected to a real identity, that linkage can expose the holder’s other transactions. Stronger anonymity than this base-layer pseudonymity is a separate problem, addressed above the ledger by on-chain techniques such as CoinJoin.

Forerunners: b-money and bit gold

Bitcoin completes a line of cypherpunk proposals, two of which it most closely resembles; the whitepaper cites the first by name.

In b-money (1998), Wei Dai set out to give the crypto-anarchy of Tim May a working economy — a world in which, as Dai described it, “in a crypto-anarchy the government is not temporarily destroyed but permanently forbidden and permanently unnecessary”. Cooperation, Dai noted, requires “a medium of exchange (money) and a way to enforce contracts”, and he described “a protocol by which these services can be provided to and by untraceable entities”. In b-money, “Anyone can create money by broadcasting the solution to a previously unsolved computational problem”, and “The number of monetary units created is equal to the cost of the computing effort in terms of a standard basket of commodities”. Transfers are signed broadcasts that every participant applies to a shared record of balances; in a second, more practical protocol those balances are kept by a subset of bonded servers who must periodically publish their databases, while contracts specify a maximum reparation per party and an arbitrator. b-money thus supplied proof-of-work issuance and signed, broadcast-ordered accounts — but left open how independent record-keepers would stay synchronized and agree on a single history, the consensus gap Bitcoin closes.

Nick Szabo’s Bit Gold (2005) sketched essentially the structure Bitcoin took:

“Thus, it would be very nice if there were a protocol whereby unforgeably costly bits could be created online with minimal dependence on trusted third parties, and then securely stored, transferred, and assayed with similar minimal trust.”

— Nick Szabo, Bit Gold

In his seven-step scheme a public challenge string seeds a proof-of-work computation; the result is securely timestamped in distributed fashion; the challenge, proof, and timestamp are filed in a distributed property-title registry; ownership rests not on holding the bits but on a holder’s lead position in “the unforgeable chain of title (chain of digital signatures) in the title registry”; and the last-created string of bit gold supplies the challenge bits for the next, so the record self-chains. (Hal Finney built a variant, RPOW, around reusable proofs of work.) Szabo also named the weak spot Bitcoin’s difficulty adjustment would later blunt: because “proof of work schemes depend on computer architecture”, a producer who finds a cheaper hardware path “might be possible to be a very low cost producer (by several orders of magnitude) and swamp the market with bit gold”. What bit gold lacked was a single consensus rule binding the timestamp services and the registry together — the gap Bitcoin’s longest-chain rule fills. Szabo’s underlying aim was monetary: “all money mankind has ever used has been insecure in one way or another”, most perniciously through inflation, and “Bit gold may provide us with a money of unprecedented security from these dangers”.

Significance

Stated as the whitepaper concludes, Bitcoin is “a system for electronic transactions without relying on trust” — the first to make payment finality, ordering, and issuance hold together without a mint, an issuer, or any trusted intermediary whose compromise would control the payment system. Bit gold had proof-of-work money, distributed timestamping, and a title registry; b-money had pseudonymous money creation, signed transfers, and contract enforcement; what Bitcoin added was the working public ordering rule with incentives that binds them into one mechanism — miners paid to extend the valid chain, users able to verify the rules for themselves, and attackers forced to spend real resources to rewrite history.

For Ammous the consequence is at once monetary and political: as the first form of digital cash, Bitcoin’s foremost value is “giving anyone in the world access to sovereign base money”, so that “Any person who owns Bitcoin achieves a degree of economic freedom which was not possible before its invention”. Its broader significance is that it extends to money the permissionless quality the cypherpunks had already won for messages, and that it does so by combining two things neither b-money nor bit gold held together: trustless digital cash and an absolutely fixed supply. It is the design that closed the digital-cash lineage running from Hashcash and reusable proofs of work through b-money and bit gold — where earlier digital money either reintroduced a trusted issuer or specified the parts without a consensus rule to join them.

The honest limits belong in the same breath. Bitcoin makes the monetary base publicly auditable, hard to inflate, and transferable across distance without a bank’s or a state’s permission; it does not abolish custody risk, exchange and custodian intermediaries, the privacy tradeoffs of a public ledger, the volatility of an inflexible supply during adoption, or the plain need for software competence to hold a key safely. What it changed is narrower and more durable than simply putting money on the internet: it is a protocol-level monetary system — a peer-to-peer ledger, a proof-of-work security market, and a fixed-supply digital commodity fused into one design.

Sources

Bitcoin: A Peer-to-Peer Electronic Cash System - Satoshi’s whitepaper: peer-to-peer electronic cash, the double-spending problem, the proof-of-work timestamp chain and longest-chain rule, one-CPU-one-vote consensus, the honest-majority assumption and attacker-catch-up calculation, the coinbase incentive, Simplified Payment Verification, and the Section 10 privacy model
The Bitcoin Standard (Full Text Aggregate) - Ammous on hardness and stock-to-flow, difficulty adjustment, digital and absolute scarcity, the issuance schedule toward 21 million coins, verification-not-trust, supply inelasticity and price volatility, settlement-layer scaling, and sovereign base money
Bit Gold - Szabo’s protocol for unforgeably costly bits, distributed timestamping, a property-title registry, the unforgeable chain of title, and the hardware-architecture caveat that Bitcoin’s difficulty adjustment addresses
b-money - Wei Dai’s proposal for proof-of-work money creation, signed broadcast transfers, server-maintained account databases, and contract arbitration as the economic substrate of crypto-anarchy

Galtland Index

Explorer

Bitcoin

Bitcoin

The trusted-third-party problem

Transactions and double-spending

Proof of work and the longest chain

Issuance and incentives

The supply schedule: hardness and absolute scarcity

Verification, not trust

Light clients and scale

Privacy

Forerunners: b-money and bit gold

Significance

See Also

Sources

Graph View

Table of Contents

Backlinks