Introduction
I spent a long time thinking about how to explain Bitcoin here in the form of a story — and whether this is even necessary at all, given that there are already so many explanations out there. In the end, however, I decided to write such a story anyway, because I believe I have found an excellent approach to explaining the Bitcoin network in a truly vivid and intuitive way.
The idea is to attempt to implement Bitcoin historically, in a non-digital world. In some sense, this will lead to familiar concepts, such as a book that records transactions, and in that regard many people have already explained Bitcoin in similar ways. However, when you place the whole system into a historical context, you are forced to think through every single detail very carefully — how each part interacts with the others and how the system can actually be functional as a whole.
Along the way, we will work through many core elements, such as cryptography and proof of work. By examining precisely which abstract roles the individual components of the Bitcoin network must fulfill, and then finding historically implementable, non-digital analogues for them, I believe it becomes possible to truly understand every aspect of Bitcoin. Everything remains grounded in the real world; this way, nothing is merely “magic internet money” anymore. Instead, the entire Bitcoin machinery operates within a historical, analog setting, where each component, due to its tangible nature, is easy to grasp and intuitively understandable.
Finally, we will return to the digital implementation and examine how these same ideas are realized in practice. By mapping the historical analogies back onto modern technology, we can clearly see why Bitcoin is designed the way it is, which problems each component solves, and how all of this comes together in the actual network that exists today.
The imaginary historical setting
After a flood of silver and gold from the New World has eroded the value of money and driven up prices all over Europe, causing severe economic disruption, especially in the Kingdom of Spain, a group of powerful merchants decides it is time to take the idea of money away from nature and put it under the control of humans. The money should be issued algorithmically, with an ever-decreasing new supply approaching a fixed amount — no discovery of new land should ever again be able to disrupt trade between people through a massive spike in the money supply.
So they meet and start to design their perfect money, “dinero perfecto”, as they call it. At the core of this system sits a ledger, a book in which all transactions are recorded. The issue, of course, is that one could simply copy such a transaction history and manipulate it; in general, such a book cannot act as a single source of truth. However, they have a genius idea: every person, whether merchant, king or peasant, may have such a book and start recording the transactions, but an intelligent communication procedure ensures that everyone will agree on the same list of transactions — and if somebody deviates from it, it can easily be verified that this is a fraudulent transaction history. But how can it be ensured that all of them record the same transactions — exactly the ones that actually happened?
Adding a sense of effort to the network — proof of work
To address this issue, they first introduce an effort that is required to record transactions in a book. How can this be achieved, you might wonder? Every new page that gets added to the book, containing new transactions, has to fulfill some mathematical condition. Checking whether this condition is indeed met requires little effort; however, finding a page that satisfies the condition requires a tremendous amount of work.
To put something like this into actual practice, they strictly define how transactions should be recorded, so that every word and number appearing in a record follows a strict protocol. Additionally, they define a way to translate all transactions of a page into digits (for example, A → 1, B → 2, and so on). Hence, each transaction list of a page is essentially equivalent to a very long sequence of digits.
These digits are then run through a calculation ritual: a long, precisely prescribed sequence of arithmetic steps that every clerk in Europe carries out in exactly the same way. The ritual works on a single number, the register, which starts from an agreed value and is always written with the same, large number of digits. The digits of the page are fed in one after another, and each time, the register is thoroughly mixed through a whole series of steps: it is multiplied by itself, the new digit is added, the result is divided by a fixed large number and only the remainder is kept, and so on. After the last digit, a few more rounds of mixing follow. What remains in the register is the result of the ritual: a number of fixed length that depends on every single digit of the page — change one letter anywhere, and the result comes out completely different. This result serves as the fingerprint of the page.
The mathematical condition concerns exactly this fingerprint: it must be smaller than a threshold that is written into the protocol. For instance, the threshold might be chosen such that the fingerprint has to begin with at least four zeros. Since the result of the ritual cannot be foreseen, this happens only by chance, on average once in ten thousand cases. Therefore, the last line of each page is reserved for trial digits, which may be chosen freely. The clerks write down a trial number, perform the ritual and compare the result with the threshold; if it is too large, they try the next trial number — again and again, until the fingerprint finally falls below the threshold. Nor does the threshold have to be a round number: if it is halved, a valid page becomes twice as hard to find, so the difficulty can be set with great precision.
Checking a finished page therefore requires performing the ritual just once. Finding a valid page, however, takes ten thousand attempts on average if the threshold demands four leading zeros, a hundred thousand if it demands five, and so on — each of them a laborious piece of arithmetic by hand. The effort required to write one page is rooted exactly in the time it takes to find suitable trial digits.
Everything hinges on the ritual offering no shortcut. If a clever mathematician could foresee which trial digits lead to a small result, he could produce valid pages at will, and the whole scheme would collapse. The merchants' best minds therefore take great care to design the steps of the ritual such that its result can only be learned by actually performing it. As a consequence, every attempt is a fresh throw of the dice: a clerk who has already failed a thousand times is no closer to success than one who is just starting. What matters is not brilliance but the sheer number of attempts — in other words, how much calculating power someone commands.
Additionally, the fingerprint of the previous page is written at the very top of every new page. Since this fingerprint depends on every digit of the previous page, and that page in turn carries the fingerprint of the one before it, all pages are firmly interlinked. This ensures that one cannot simply find one valid page and duplicate it thousands of times to create a full transaction book with very little effort. And whoever changes a single letter on an old page changes its fingerprint, which breaks that page and, through the chain of fingerprints, every page that follows.
To sum up: when a page containing new transactions is to be added, the fingerprint of the previous page is written at its top, followed by the new transactions. Then the process of trial and error begins: a trial number is written into the last line, the whole page is translated into digits and run through the ritual, and the result is compared with the threshold. This continues until the result finally falls below it, creating a valid extension of the transaction book. Only then can the page be added, and only then will it be accepted by the other merchants, each of whom can confirm its validity by performing the ritual a single time.
Now, what have the merchants achieved with this system of making it costly to add a page to the transaction book? No one can fake such a book. If the real book — the set of transactions that everyone agrees on — is already 100 pages long, it is practically impossible for another entity to come up with a fake book of the same size containing manipulated transactions. This is because a single altered transaction breaks its page and all pages after it, so the forger would have to repeat the entire search for trial digits for every one of them. The real book, on the other hand, is sustained by many merchants, each employing dozens of clerks to add new pages, and it keeps growing while the forger is still at work. For a single entity, it is extremely difficult to gather that much calculating power. Trust is therefore built by the size of the book.
In particular, every merchant, guild, king, or whoever wants to participate in maintaining the transaction history of the dinero perfecto will create a copy of the ledger. They collect the transactions that people want to perform and try to create a valid page by searching for suitable trial digits. Whenever a valid page has been found, they send a copy of that page to all other merchants, guilds, or kings they know, who then add it to their transaction book. The book with the greatest size is always the one that is trusted. So, for example, if a merchant in Spain finds a new valid page and sends it to his neighboring merchants, but at the same time, on the other side of Europe in Moscow, the Tsar manages to find two valid pages in a row, the version of the book containing the two pages from Russia will eventually prevail. This is because every participant will favor the version of the book with the greater size.
This procedure ensures that there is always a version of the book that can be trusted and that is extremely hard to manipulate without gaining more calculating power than all other participants combined. The question that arises now is, of course, why anyone should take on the burden of maintaining and extending the ledger. After all, it requires keeping up constant communication with other merchants and, even more crucially, one has to put constant effort into the search for trial digits to produce new valid pages so that new transactions can be recorded.
Economic incentive to maintain a ledger — coin issuance
This is resolved by organizing the issuance of new coins through exactly those entities that put in the effort to find new pages. In particular, for every page one special transaction can be added that has no sender but only a receiver. The receiver can be arbitrary, but the amount of coins sent is fixed. These coins that appear out of nothing control the issuance of new money supply — and they allow the merchant who found the page to collect a reward (although in theory he does not have to send those new coins to himself, in practice this is what will happen).
This raises the question of how many new coins will be introduced with each page. Since the original cause for launching this project was the inflation triggered by the massive new supply of silver and gold from the New World, the merchants aim for a very strict coin issuance policy. In particular, the amount of coins that can be written in this special transaction is cut in half after a fixed number of pages. That means the early pages will be very lucrative, and the thicker the book gets, the less reward there is to be taken. Since halving in fixed intervals creates a geometric series, the total amount of coins of the dinero perfecto will be limited. There will only ever be so many coins.
This procedure also solves the initial issuance of the coins, as the coins come naturally into existence page by page. However, when there is an ever decreasing reward for the merchants who extend the ledger, eventually they will lose the incentive to continue their work, right?
In order to counter that, there is also the option of a fee for each transaction, which can likewise be collected by the creator of that page. This ensures a long-term incentive for maintaining the ledger and putting in the effort to create valid pages. This fee is not mandatory, and its amount is determined by how many new transactions there are and how urgently a person wants a transaction to happen.
In general, however, the decrease in coin issuance is softened by the hard cap on the total supply. Many people will decide to hoard those coins, and some may lose the information needed to prove ownership of their coins — making it impossible to spend them in a transaction ever again. Hence, the value of these coins will probably increase indefinitely.
But speaking of the ownership of coins, how is this ownership actually proven? Can an ordinary peasant just walk up to a merchant and convince them that they have been granted the right to spend the whole treasury of the Holy Roman Empire?
Ownership of transaction entries — public and private keys
The basic idea of proving ownership is to have a pair consisting of a public thing and a corresponding secret. You cannot derive the secret from the public thing alone, but you can produce the public thing from the secret. In particular, with the secret you can produce something that proves you possess the secret belonging to this public thing.
A realization of these abstract requirements could be a seal that is stamped by a certain stamp. The exact shape of this stamp is the secret, and the public thing is the seal. Though, this is of course not an ideal realization, because with enough time and carefulness one might be able to reproduce the exact shape of the stamp from a seal.
That is also why the merchants decide against this simple stamp and seal and instead, once again, come up with a clever mathematical idea that exactly fulfills those requirements.
The scheme rests on a simple asymmetry from number theory: multiplying two large primes is easy, but factoring their product is extraordinarily hard. Each participant proceeds as follows:
1. Choose two large primes \(p\) and \(q\) and compute \(n = p \cdot q\) as well as \(\varphi = (p-1)(q-1)\).
2. Choose a number \(e\) that shares no divisor with \(\varphi\), and find \(d\) such that \(e \cdot d \equiv 1 \pmod{\varphi}\).
3. Publish \((n, e)\) — this is the public key, and coins are sent to it. Keep \(d\) (and \(p\), \(q\)) secret — this is the private key.
To spend coins, the owner first performs the calculation ritual on the transaction text — the very same ritual that seals the pages. Its result is the fingerprint \(m\) of the transaction, a number of fixed length that is smaller than \(n\). From it, the owner computes the signature \(s = m^d \bmod n\), which is written next to the transaction. Any merchant can verify it with the public key alone: he performs the ritual on the transaction himself and checks that \(s^e \bmod n\) equals the fingerprint he obtained. This works because \(m^{e \cdot d} \equiv m \pmod{n}\). Whoever does not know \(d\) has no known way of producing a valid \(s\), and computing \(d\) from the public key is as hard as factoring \(n\) into \(p\) and \(q\). Moreover, as \(s\) depends on the fingerprint, and the fingerprint on every single letter of the transaction, a signature cannot be reused for a different amount or receiver.
Signing the fingerprint instead of the transaction text itself is essential for two reasons. First, the scheme only works for numbers smaller than \(n\), whereas a whole transaction text would translate into a far larger number. Second, the bare scheme has a weak spot: the product of two signatures is a valid signature for the product of the two signed numbers, so a forger could combine existing signatures into new ones. With fingerprints, this trick comes to nothing, because the combined number is practically never the fingerprint of a transaction the forger could write down — the ritual cannot be steered, let alone run backwards.
A toy example: \(p = 61\), \(q = 53\), hence \(n = 3233\) and \(\varphi = 3120\). With \(e = 17\) one finds \(d = 2753\). A transaction with the fingerprint \(m = 65\) is signed as \(s = 65^{2753} \bmod 3233 = 588\), and indeed \(588^{17} \bmod 3233 = 65\).
So the peasant claiming the treasury of the Holy Roman Empire has no chance: he would need the emperor's \(d\), and all he can see is \(n\). This is, at its core, the RSA scheme; real-world implementations add a few further safeguards, known as padding. Bitcoin itself uses a different mathematical lock (elliptic curves) built on the same principle — easy in one direction, practically impossible in the other — but for our historical setting, the primes will do.
Also note that if someone somehow gets hold of the emperor's \(d\), the coins are fully theirs. They can walk up to any merchant who maintains a ledger and present a valid transaction. In practice, if they do this in the emperor's capital, the merchant will probably reject them — a merchant can always do that — but remember: one can go to any merchant one wants, and additionally offer a very high fee, making the economic incentive for including the transaction in a new page candidate extremely high.
The communication network — average block time and consensus
We have now outlined the main components of the dinero perfecto's protocol. Let us now see how they all work together in the network thus established. In doing so, we will also see where the limits of this historical implementation lie and why the probability of something like this actually having happened is extremely low.
Recall that a newly found page is only of use once the other participants know about it. In our historical setting, this knowledge travels by messenger on horseback. From Lisbon to Moscow, or from Naples to Stockholm, such a messenger needs several weeks — if the roads are passable at all. This single fact dictates the rhythm of the entire network. Suppose the merchants set the threshold of the ritual such that a new page is found somewhere in Europe every few days. Then the Spanish merchants would find a page, the Tsar's clerks would find a different one before the Spanish messenger has even crossed the Pyrenees, and both sides would continue extending their own version of the book. By the time the two versions meet, each side has added a dozen pages, and half of all the work ever done is discarded when the shorter book is abandoned. Worse, no participant can ever be sure which book is currently the longest, because the information they hold is always weeks out of date.
The merchants therefore have no choice but to make finding a page far slower than spreading it. A new page must appear rarely enough that, with high probability, the whole of Europe has heard of the previous one before the next is found. With messengers needing weeks, this means a page every three months at the very least — and more realistically, to be safe against bad weather, wars and lost riders, every half year. This is the average time for a new page to appear for the dinero perfecto — or, in Bitcoin terms, the block time.
But also: how can such a rate be fixed when nobody controls how many clerks are searching? If a wealthy guild joins the effort, pages will be found faster; if a plague thins out the ranks of the clerks, they will be found more slowly. The merchants solve this by writing a rule into the protocol: every fixed number of pages — say, every ten — the dates recorded on those pages are compared. If the ten pages took less than the intended five years, the threshold is lowered in proportion: if they took only four years, for instance, the threshold is multiplied by four fifths, so that valid pages become correspondingly rarer. If the pages took longer, the threshold is raised again in the same way. This difficulty adjustment keeps the rhythm of the book stable no matter how much calculating power is thrown at it. Note that this is also what makes the coin issuance predictable in time: the halving of the reward happens after a fixed number of pages, and only because pages arrive at a roughly constant rate does this translate into a fixed number of years.
Even with a half-year block time, agreement is not immediate. When a page is found in Spain and, by bad luck, another one in Russia shortly after, the two versions of the book coexist for a while. Only when the next page is found on top of one of them does that version take the lead, and only after a few more pages does the other one die out for good. A transaction written on a page is therefore not settled when the page is found, but only once it is buried under several further pages, so that reversing it would require redoing all of that work. With one page per half year, a merchant would be wise to wait for at least two or three pages on top — a confirmation time of a year or more.
What does this mean in practice? The dinero perfecto is utterly useless for everyday trade. Nobody will wait a year to find out whether the payment for a barrel of wine has gone through. At most, the system could serve as a bookkeeping layer between the treasuries of great nations, trading companies and banking houses — a way of settling large balances a few times a year instead of shipping chests of silver and gold across the continent. Everything below that scale would remain a matter of coins, bills of exchange and trust in the local merchant. This is the fundamental limit of the historical implementation, and the reason why the probability for that actually having happened is extremely low: the idea requires messages to travel in seconds rather than weeks. Once they do, every part of the machinery described above can be kept exactly as it is — only the network starts to actually function well and becomes very useful. So once the speed of communication reaches a certain level then the probability of this machinery actually being constructed, implemented and also used increases drastically. And since the discovery of electricity and especially after the construction of the world wide web the required speed of communication was definitely there.
The Bitcoin protocol
And that is what brings us to the 31st of October 2008, when an anonymous entity named Satoshi Nakamoto published exactly the kind of protocol we have just discussed above. As history has shown so far, the network has grown substantially and the value of the coins has increased ever since — albeit with a lot of volatility, but that is also what one should expect from something as new and ground-breaking as the Bitcoin protocol. Anyway, the significant impact that Bitcoin has made so far can no longer be denied, and we are now seeing big institutions and even nation states start to show serious interest in hoarding those coins.
But in order not to blow up this story too much, let us leave those repercussions on society and similar topics on the side for now and stick to the protocol itself and on how it implements the various things compared to our historical dinero perfecto.
From pages to blocks
A page of our ledger is called a block, and the book itself is the blockchain. The role of our calculation ritual is taken over by a hash function, in Bitcoin's case SHA-256. Such a function takes an input of any length — a list of transactions, say — and returns a number of fixed size, 256 bits, in a way that is quick to compute but practically impossible to invert or steer: change a single letter in a single transaction, and the resulting number is completely different. This is precisely the abstract role our ritual had to fulfill; SHA-256 is, in essence, such a ritual, designed by cryptographers and carried out by machines.
The condition, too, is the very one our merchants imposed: the hash of the block, read as a number, must be smaller than a given target \(T\), that is \(\mathrm{SHA256}(\text{block header}) < T\). The target is nothing but the threshold of our ritual — the smaller \(T\), the fewer of all possible outputs qualify, and the harder the search. And the search itself works exactly as with our trial digits: the block header contains a freely choosable number, the nonce, which the miner (the modern counterpart of our merchants and their clerks) increments over and over until the condition happens to hold. The header also contains the hash of the previous block — the fingerprint of the preceding page that our merchants wrote at the top of every new one — which is what chains the blocks together and makes it impossible to rearrange, remove or duplicate them without redoing all the work that came after.
Coins and keys
The issuance works exactly as our merchants designed it. Every block may contain one special transaction without a sender, called the coinbase transaction, whose output the miner directs to an address of his choice. The reward started at 50 coins and is cut in half every 210,000 blocks, which corresponds to roughly four years; today it stands at 3.125 coins. Summing this geometric series gives a total supply of 21 million bitcoin, and the same reasoning applies as in our story: as the subsidy fades, the transaction fees that users attach voluntarily to their transactions take over as the incentive to keep mining, with their level set by competition for the limited space in the next block.
Ownership is proven just as described, only with a different mathematical lock. Instead of RSA, Bitcoin uses elliptic curve cryptography: the private key is a number \(d\), and the public key is the point \(P = d \cdot G\) on a fixed curve, where \(G\) is a publicly known starting point. Multiplying \(G\) by \(d\) is easy, recovering \(d\) from \(P\) is practically impossible — the same one-way asymmetry that the factoring of \(n = p \cdot q\) gave us. A signature is again computed from the fingerprint of the transaction, its hash, together with \(d\), and it can be checked by anyone using \(P\) alone. For most address types, the address one sends coins to is not even \(P\) itself but a hash of it, which keeps the public key hidden until the coins are first spent adding an additional layer of safety.
The network at the speed of light
What truly separates Bitcoin from the dinero perfecto is not a single component of the machinery but the messenger. A new block reaches the whole planet in a few seconds, so the rhythm of the book can be set accordingly: Bitcoin targets one block every ten minutes, which leaves a comfortable margin between blocks being found and blocks being known everywhere. The difficulty adjustment that our merchants needed is there as well and works just like theirs — every 2016 blocks, the time those blocks actually took is compared to the two weeks they were supposed to take, and \(T\) is scaled by the same ratio. A transaction is considered settled not after a year but after a handful of blocks on top of it, customarily six, which is about an hour.
One small correction to our story belongs here. We said that the longest book wins, but that is of course only true for a constant difficulty. If we are really splitting hairs here, we of course have to define the length of a book not by the number of pages but by the amount of work that went into this book. The Bitcoin protocol of course takes care of this nuance: the valid chain is the one with the greatest accumulated proof of work, not the one with the most blocks. Everything else about the reconciliation is as we described it — two miners occasionally find a block at nearly the same moment, the network is briefly split, and the fork is resolved as soon as the next block lands on one of the two branches.
Closing thoughts
Looking back at what we have built, there is nothing in Bitcoin that could not have been written down with quill and paper. A book of transactions, a costly condition for adding a page, a fingerprint linking each page to the one before, a reward that halves on a fixed schedule, and a secret that proves ownership without ever being revealed — every single one of these parts is an idea a group of sixteenth-century merchants could have conceived, and we have seen concrete, if clumsy, realizations for all of them. What they could not have built is the messenger. Without communication that is faster than the production of pages, the whole construction collapses into a slow and useless tangle of competing books, which is exactly why no such system appeared until proper ways of communication were developed.
This story was meant to give the whole picture at once, and for that it had to stay on the surface in many places. Each of the components we passed through deserves a story of its own, and that is exactly what I intend to write. How SHA-256 actually turns a block into a number, and what it means for a hash function to be secure. How elliptic curves work, why they replaced RSA, and how a private key becomes an address. What really happens when two miners find a block at the same second, and what an attacker with half the world's hash power could and could not do. How the fee market behaves when blocks fill up, and what the Lightning Network adds on top. We will explore all of these individually, in the same spirit as here — taking one component at a time, asking what abstract role it has to fulfill, and only then looking at how Bitcoin fulfills it.
And with that we come to the end. What I hope this story conveys is that Bitcoin is not some mysterious magic internet money, and not a clever trick that only works because computers are involved. It is an old and rather mechanical idea — a shared book that nobody owns and everybody checks — that simply had to wait for messages to travel at the speed of light before it could be put to work.