Bitcoin Primer

Written by Jeffrey Emanuel on 1/11/2018

Part 1: How Bitcoin Works

In this section, we will give a brief background/primer on Bitcoin (“BTC”), along with various arguments for its long term potential as an investment. It is essential to fully understand and buy into the bitcoin value proposition before one should even contemplate buying “altcoins” such as Ether and Litecoin.

Bitcoin Basics:

• World’s first decentralized, 100% peer-to-peer, secure digital currency based on proof-of-work and cryptographic digital signatures, introduced in early 2009 by Satoshi Nakamoto.
• Currently, 17mm BTC exist, with a maximum of 21mm that can ever exist.
• Currently, just 1,800 new BTC are created by the network each day through the mining process (explained below) — the only way in which new bitcoins can ever be created. The number of bitcoins created by mining per day is cut in half every 4 years, so that in the year 2020, just 900 new BTC will created each day for the entire world.
• The Bitcoin network is entirely decentralized, and would be nearly impossible to stamp out by any government, similar to the way governments are effectively helpless to prevent the internet piracy of Hollywood movies on peer-to-peer networks such as Bit-Torrent.
• As long as the internet exists, and as long as internet users can send short messages to one another, the bitcoin network can function successfully while retaining its security characteristics.

Mining Process:

• Bitcoin transactions (e.g., the BTC address 18nJ9bxLTZL5VxSbtfLw12uxtJsooYBhSi sending 3.41 BTC to the BTC address 1E4f8Exg8rtuW1EdDVFw7qkX4MELLBcrqd) are announced to the decentralized network of machines running the bitcoin software in a fully peer-to-peer manner, with no central authority or trusted 3rd party acting as an intermediary.
• The way this works is that each machine in the network has a list of IP addresses of other nodes that it can directly communicate with to compare the state of the network.
• Given the “6 degrees of separation” phenomenon, it takes a surprisingly small number of direct peer-to-peer connections to indirectly wire up every machine to every other machine in the global network.
• Transactions accumulate in a pool of pending transactions (i.e., ones that have not yet been included in a block), called the mempool.

Here, full nodes (we will use this term interchangeably with the shorter “nodes”) on the bitcoin network, which are simply computers that have the entire bitcoin blockchain history stored locally on disk and can trace transactions through their entire history, verify that transactions in the mempool are valid. A transaction is valid if and only if the following requirements are met:

• That the transaction for a given bitcoin address is signed with the sender’s private key, representing a promise that cannot later be repudiated by the sender, similar to a physical signature on a legal document.
• That the sending bitcoin address actually contains the required unspent BTC (this is verified by tracing the history of each coin through the entire blockchain history) and those coins are not involved in a pending transaction in the mempool.
• Bitcoin miners, which are generally different machines than the full nodes, begin the mining process by generating a file containing the specific details of hundreds of valid transactions, adding more transactions to the file until they have reached the current limit of 1 megabyte worth of transaction data.

Miners then do a series of repetitive calculations using a hash function:

• Hashes, which are a central idea in bitcoin that underpin the whole system, are a kind of secure “one way function” which can generate a fixed length hexadecimal number as output for any given length of input data.
• That means that it doesn’t matter whether the input data is the string “Bitcoin is cool” or a single text file containing all of the text in the Library of Congress — you will always get as the output a 256 bit hexadecimal number.
• What makes a hash function secure is that it is easy to compute the output of the hash function for a given input (called simply the hash of that input), but it is nearly impossible to recover the input data that would lead to a specified hash (i.e., the output of running the hash function on that input data).
• The bitcoin system is built using the SHA256 hash function.
• To illustrate what this hash function looks like, the following is the SHA256 hash of the input data represented by the string “Bitcoin”:

b4056df6691f8dc72e56302ddad345d65fead3ead9299609a826e2344eb63aa4

If we were to change even a single letter — say we add an “s” to the end of “Bitcoin” — then this is the new SHA256 hash that results for the string “Bitcoins”:

aa0921d24d095df038a0c0a32eb0d644f1882e3a0a3d8814175c4e1cebbf84fb

Notice that the hash has completely changed despite the minor change in the input. This phenomenon, known as the avalanche effect, is the whole point of a hash function: that it is easy to calculate the hash in one direction (i.e., to compute the hexadecimal numbers above), but it is virtually impossible to go in the reverse direction — that is, to come up with the input data that will result in a specified hash. Because of this property, hash functions are also sometimes called “trap door” functions — it’s easy to fall through the trap door, but very tough to get back out the same way!

The reason why it is so hard to find the input data that corresponds to a given output hash is because as soon as you change one thing in the input data, the resulting hash has changed completely, thus preventing you from making any progress in matching the desired hash.

Indeed, the only way to find input data that will result in the desired hash is to try lots and lots of different inputs and then compute the hash of them and check to see if the hashes match the hash you are looking for.

• Note that there is not a 1-to-1 correspondence between input data strings and hashes: because the input data can be of any finite length, while the output is always of a fixed 256 bit length, there are necessarily multiple inputs that will lead to the same output.
• This is known as the pigeon-hole principle in mathematics: if you have N pigeon holes, and greater than N pigeons, and every pigeon needs to go into a hole, then there must be at least 1 hole with more than 1 pigeon in it.

Hashes are one of the critical components of the Bitcoin mining process, which works as follows:

• Miners first generate a file of valid transactions as described above, which is called a block.

You can imagine a block as being like a spreadsheet, with each row representing a unique transaction and the various columns representing the different fields of the transaction, such as:

• The timestamp the message was first communicated to the bitcoin network;
• The IP address of the node first reporting the transaction;
• The sender’s BTC address;
• The receiving BTC address;
• The quantity of BTC transacted;
• The transaction fee specified (which goes to the miner of the block in which the transaction was included).

In addition to these normal transactions, you can think of a block as also containing some special rows which we will describe below: the nonce and the hash of the previous block in the chain of blocks (this chain of blocks is usually referred to as the blockchain).

• The nonce is just some whole number that is appended to the list of valid transactions. Generally, miners set the nonce equal to 0 and then continually increment the nonce by one, replacing the old nonce with the new nonce. After updating the nonce, the miner then calculates the SHA256 hash of the entire block (in practice, this is done twice in a row, taking the “hash of the hash”) to check if it results in a “valid” hash (we will describe next what valid means in this context). The computed hash might look like this, for example:

8a5f808da37e6d7363d729f33ae51576df3d00cc1f6ac48ee1f31d36874fc3cb

Based on the bitcoin protocol that all nodes on the bitcoin network adhere to by voluntarily running compatible versions of the bitcoin software implementing this protocol, a block is deemed to be valid if and only if:

Every transaction included in the block is valid, in the sense described above.

The hash of the block begins with a certain number of zeros.

• Given the unpredictable nature of hashing functions, most nonces appended to the end of a block of transactions will result in a hash that will not begin with “0” (~90% won’t start with a zero) — and even fewer will begin with “00”.
• A truly microscopic number of nonces will result in hashes for the proposed block that begin with a large number of zeros; if the required number of leading zeros is high (say, like 25), then the chances of finding a nonce that will result in such a hash become vanishingly small — to the point where, even if one is able to check billions of hashes per second, it will still take a huge amount of time and resources to find a nonce that works. This is the one part of the process that can’t be “faked” or “gamed” in any way — only lots of computing power and electricity can find these nonces!

Assuming a miner is able to discover a nonce that works — that is, a nonce that results in a block hash that begins with a sufficient number of zeros — then the block that includes that nonce is communicated by the discovering miner to other nodes on the bitcoin network in a peer-to-peer manner, where it is then verified. The nature of hash functions makes it quick and easy for the other nodes to verify that the hash of certain input data has specific properties (e.g., that it begins with 25 zeros).

Once enough other nodes verify that the block is valid, it is added to the end of the chain of previous blocks, which finalizes the transaction in the bitcoin ledger. Because nodes on the bitcoin network always defer to the longest chain (the chain with the largest number of valid blocks in it), it becomes increasingly difficult for a malicious node to offer an alternative history to the network, since that bad node would have to compute hashes faster than the rest of the network combined.

• That’s because, before the malicious node can get his invalid block attached to the chain, it likely already has had several more blocks appended, so the attacking node would need to generate several more blocks before the rest of the network combined can add new blocks to further the lead of the already longest chain.
• One way to think about why this process should be secure is that it is taking advantage of a property of networks of agents that can send messages to each other directly: information — say, a rumor of a corporate takeover, or a digital file of the new Star Wars movie currently in theaters, or a nude photo of a famous Hollywood actress — spreads with lightning speed through the network, but once the information is out there, it is very difficult to suppress or expunge (just ask Jennifer Lawrence!).

As a reward for discovering a valid block, the miner of a valid block creates the first transaction in the block, sending that miner 12.5 BTC out of thin air — the only way in which new BTC can be created in the bitcoin system. These generated coins are known as the block reward, which is currently set at 12.5 BTC per valid block mined. As described below, the block reward is cut in half every ~4 years in a process known as the halving.

• Because there is no reliable concept of “wall time” (i.e., an objective time, measured in seconds elapsed since a specified date in the past) in a distributed system, all calculations done by the bitcoin network are performed in terms of numbers of blocks rather than in days/months/years. So, for example, the block reward is cut in half after a certain number of blocks are added to the blockchain, which roughly corresponds to ~4 years of wall time.

We left one critical step out of the explanation above of the mining process, which is that a proposed block of transactions must also include the hash of the previous block in the blockchain:

• This step is essential because it tells you the order of the blocks: one block uses as input the output of the previous block, thus acting as a time-stamp that proves which block was added first.
• This clever trick makes the chain of blocks into something called a Merkle Tree.
• It is this idea that makes it a sounds strategy for nodes to always defer to the longest chain on the bitcoin network when comparing all the chains that competing to are competing to be deemed the “official” version of history.

Why? Because this requirement prevents an attacker from calculating lots of hashes “off-line” and accumulating an “inventory” of valid blocks that they can attach to the chain to make their version of the chain the longest one.

How is that? Because you can’t generate blocks in a parallel manner — they must be done sequentially in order because of the serial dependency introduced by including the hash of the previous block in the next block of transactions.

• This is one of the other ideas that made bitcoin revolutionary — no one before bitcoin had combined a Merkle Tree with hash based proof-of-work.

From the miner’s standpoint, he is committing real world resources in order to generate bitcoins in this manner: capital, in the form of the computers or special-purpose mining equipment he is using, and work, in the form of the electricity he is consuming to run the mining computations:

Unless the miner is stealing power somehow, this electricity is the critical link to the real world that proves that resources were “burned” or consumed in the process.

• This proof is the result of basic physics; i.e., any mining computers will generate a lot of heat, and the transition from the highly organized form of energy that is 220v electrical current to the chaotic entropy of dissipated heat energy is a one-way street.

Thus the miner faces economic decisions, where he must compare the number of bitcoins he is producing per day/week/month, and his perception of the value of those coins, to the amount he must pay for electricity and to the amortized cost of the capital equipment he uses for mining.

Clearly there is some subjectivity in the process, in that each miner may have his own view of the value of the bitcoins he is generating through mining. But once a market price for bitcoin has been established through an exchange, there are some practical limits imposed on the miner: he must cover his power bill, so unless he has a lot of fiat currency saved up or fiat income from other sources, he will be forced to sell at least some of his generated bitcoins for dollars/euros/yen in order to pay the utilities.

Thus a miner can readily estimate his run-rate mining profit/ROI, and if this is negative, presumably he will realize that he should turn off his mining equipment — or at least relocate it to a location with lower-cost electricity, which would improve his ROI.

• Note that even if our miner is a true believer in bitcoin, he is still better off not mining at a loss, since he could take the money that he is spending on power and instead buy even more bitcoins on an exchange.
• One caveat to the above is that the miner may have an interest in the privacy/secrecy benefits of mining versus purchasing on an exchange, which might require Know-Your-Customer and Anti-Money-Laundering (“KYC/AML”) disclosures; we will ignore these secondary considerations in this analysis.

Suppose the price of bitcoin rises in a 24-hour period. Now, whatever financial math the miner was doing before to estimate his ROI, the picture is now clearly better. Perhaps he will decide to plug in some older generation mining equipment that is less efficient and which previously had a negative ROI but now is in positive territory. Or perhaps he will decide that the returns from mining are so compelling at these prices that he wants to purchase more mining equipment. Or consider a scenario where, after years of intense development, a previously unknown mining equipment company releases a specialized mining machine that can compute 10 times more hashes per second per watt of power consumed than the next best machine on the market.

In all these cases, the hash rate of the Bitcoin network — that is, the sum total of the hashing power of all miners in the network (known as the network hash rate), will increase over its previous level.

What are the implications of this to the generation of new bitcoins? Will this lead to the market being flooded with a huge amount of new bitcoins, since a hash with N leading zeros will be uncovered faster on average?

This is perhaps the most ingenious part of Bitcoin’s economic formula, and what makes it different from other assets/securities/commodities in economic history: Bitcoin has what is called a difficulty retargeting algorithm, which works as follows:

• Full nodes on the bitcoin network running the bitcoin software agree (again, by running compatible software following the same rules) that a new block on the bitcoin blockchain should be generated through the mining process approximately every 10 minutes, known as the block creation time.
• Note that this block creation time is approximate in practice because of the lottery-like aspects of the mining process, whereby a miner could get lucky and stumble on a working nonce much sooner than expected given the probabilities. Alternatively, a miner could get extremely unlucky and be forced to mine for much longer than might be expected before finding he can find a working nonce.
• In a steady state, the bitcoin network should add N new blocks per day, where
• N = (24*60)/ 10 = 144 (put differently, there are 144 ten-minute segments in a 24 hour period).
• At the current block reward of 12.5 BTC per block, this means that only 12.5*144 = 1,800 BTC are created worldwide each day at the moment.
• But this this will reduce to 900 BTC per day after the next halving process, when the block reward will be cut to 6.25 BTC per block — scheduled to happen roughly every 4 years (in the bitcoin code, it happens after a certain number of blocks have been added to the bitcoin blockchain, which roughly corresponds to 4 years). The next halving will take place in the year 2020.

Here is the key idea of the difficulty adjustment algorithm:

• Roughly every 2 weeks, each full node on the bitcoin network checks to see how many blocks have been added to the blockchain. Recall that the desired target is to have a new block created through the mining process every 10 minutes.
• Suppose that, because the network hash rate has rapidly increased (say, because new/faster mining equipment is plugged in and begins contributing hash power to the network), that the average block creation time over the previous 2 weeks was actually only every 8 minutes.
• Then, each full node automatically changes its definition of what constitutes a valid block: if before the nodes required a hash with 25 leading zeros, now they will require some higher number — say, 26 leading zeros.
• Of course, a hash with 26 leading zeros is much rarer than one with 25 leading zeros, so this increases the difficulty of mining a new block in the future.
• The specific increase in the difficulty rate — that is, in the number of required leading zeros — is selected by the full nodes so that, at the new run-rate hash power of the network, the new block creation time will be restored to roughly once every 10 minutes.
• Thus it doesn’t matter how much computing power is represented by the whole network of mining machines — the only thing that matters from a miner’s perspective is their percentage share of the global network hash rate.
• Of course, the more the total hash power of the network increases, the more secure the system gets for all users — it’s just that the miners don’t individually benefit from this general “rising tide” of the network hash rate: only their relative positioning compared to other miners in the global computing power pecking order can influence the number of coins they can generate through mining.

We have now explained the essence of how bitcoin works at a technical level, and so now turn our attention to the investment merits of bitcoin.

Part 2: The Investment Case for Bitcoin:

The key arguments for why the invention of bitcoin is so unprecedented in human history stem directly from an understanding of how the bitcoin system is designed and how the network operates in practice.

Thus, a full understanding of the above narrative is not simply “nice to have” as a potential bitcoin investor, but rather is critical to an acceptance of major aspects of the investment thesis. The reader is urged to read the background section closely so that everything is clear.

There are many ways to make the case for bitcoin as an investment. In this section we will provide many of these. The first argument begins with a simple demonstration that bitcoin deserves a non-zero price in the marketplace, and much of it is attributable to a speech given by Eric Voorhees at an early bitcoin conference in 2013; the talk is highly recommended to readers of this document, and can be found here.

First of all, bitcoin is inherently useful. Those who would maintain that bitcoins are worthless because they aren’t backed by anything tangible — that they are just a Ponzi scheme and the latest “tulip mania” — are perhaps not considering just how useful it is, for the following reasons:

Bitcoin gives anyone in the world with access to the internet the ability to send…

…any amount of value (within reason — say, from $100 to $1 billion) …

…to anyone else in the world…

…nearly instantly (say, within 20 minutes)…

…at relatively low transactional costs (at least if you assume a transaction size of a few hundred dollars or more, the fees for using bitcoin are lower than what most banks charge for wire transfers)…

…without the help or permission of a bank or other government-controlled third party entity…

And also without taking a large risk of detection and confiscation by the authorities:

• Just try taking a few 400 ounce gold bars with you on a flight out of JFK airport to see how hard this is in the physical world.
• Or try asking Citibank to send a $20mm wire transfer to someone living in Pakistan!

…in a way that can preserve the privacy/identity of the transacting parties — at least if the sender and receiver take the proper precautions, such as:

• Generating unique bitcoin addresses for each transaction, so that it is impossible to connect multiple transactions to the same address;
• Acquiring the bitcoins in question through the mining process or though purchasing the bitcoin by meeting a stranger from Craigslist in a Starbucks and paying cash (i.e., by not purchasing the bitcoins through any means that would leak the buyer’s identity, such as the KYC/AML procedures of most exchanges);
• Connecting to the bitcoin network through a secure VPN when they want to broadcast the transaction to the network, thus preventing their actual IP address from being recorded by any nodes;

…in a way where transactions are final and irreversible once they have been confirmed by enough nodes on the network, so that the receiver knows that the bitcoins in their possessions cannot later be rescinded in some way as long as the receiver is able to secure the secrecy of the corresponding private key…

…where the unit of value the parties receive is perfectly durable (like physical gold, as long as you manage to avoid getting robbed, you never have to worry that your gold bars will rot or tarnish or disappear)…

…where that value can be easily subdivided and recombined to facilitate convenient transactions…

…where the transacting parties don’t have to worry that the network will cease to function for any number of reasons, such as:

That the company operating the payment network stops operating:

• See the case of the Whoopi Goldberg endorsed Flooz currency during the 1999 tech bubble, where Flooz.com went bankrupt and ceased to exist.
• Or say the government raids the offices of the company operating the payment network and forces them to shut down, similar to what happened to the E-gold company that attempted to issue a digital currency backed by physical gold bullion.
• Remember, there is no company or central party in bitcoin — each node operates on its own, according to the rules of the protocol.

That the machines that provide the security of the payment network, for whatever reason, cease to have an incentive to operate:

• Recall that miners are incentivized to mine from the block rewards paid out in the mining process, as well as from the transaction fees of all the transactions included in whatever blocks they mine.
• This natural profit motive, combined with the “zero sum” nature of bitcoin mining (where, if you are the only miner left standing, you get the full block reward) ensures that there will always be someone, somewhere who is happy to keep the network secure.

That the government decides to ban and/or confiscate the unit of value of the payment network (in the case of bitcoin, BTC itself):

• Even if the government were to know about the existence of a specific bitcoin address containing some number of bitcoins, they would have no way — assuming proper precautions are taken by the transacting parties — of connecting that bitcoin address to a person or entity, or even a rough geographical location.
• Furthermore, the government would have no way of cracking the digital signatures (i.e., the private keys for a bitcoin address) that provide the power to control the bitcoins residing in that address.
• If we assume for hypothetical purposes that the government possesses radically advanced quantum computers that are able to crack the discrete elliptic curve cryptography that underpins Bitcoin’s digital signatures, then essentially all known cryptography is compromised, and the world would be unable to securely do things like online banking or buying things securely on Amazon — in short, we would have much bigger problems than just bitcoin not working!

As we have seen in the section describing the mining process, in addition to being useful, bitcoin is extremely scarce. We have already quantified the numbers: that currently only ~17mm BTC exist in the world, and that the most that will ever be created is just 21mm. But what are the implications of this?

First, observe that while ~17mm BTC have been created since 2009, we know that some portion of these coins has been permanently lost:

• In the early days of bitcoin, it was an interesting technical curiosity. Anyone could download the open-source software and run it on a $1,000 laptop computer, and thereby generate over 50 BTC per day.
• It took a couple years before BTC had an established “market price” in USD terms — before that, all BTC trades were done in over-the-counter exchanges with no price discovery. The first recognized price of BTC was something around one third of a penny — so basically worthless.
• As a result, many early users, at a time when the bitcoin inflation rate — in both absolute and percentage change terms — was much, much higher than it is today, acquired vast amounts of coins that they didn’t care much about at the time.

Many of these coins were permanently lost in various ways:

• The wallet file was accidentally deleted and overwritten, preventing recovery.
• The hard drive or laptop containing the bitcoins was given away or thrown in the trash.
• The private key for the bitcoins was written down on a piece of paper and then lost, forever trapping the coins.
• The bitcoins were accidentally sent to an invalid BTC address, permanently “burning” the coins (early bitcoin wallet software was buggy).
• Perhaps the owner died without disclosing the private keys to his heirs; this probably hasn’t happened that much historically, but could be an increasing problem in the future.

Various estimates have placed the number of “lost coins” at between 3 and 4 million coins, or ~20% of the current number of total coins. So let’s assume for argument’s sake that 3mm coins have been lost forever in this manner, placing the effective total number of accessible bitcoins that exist today at ~17mm - 3mm = 14mm.

One criticism of bitcoin is that early adopters were rewarded disproportionately compared to later users of the system. While one can argue both sides of this debate (those disproportionate rewards were required to create the incentive of early users to “spread the gospel” of bitcoin and to contribute to the early development of the software and ancillary services), the fact remains that vast sums of bitcoins are controlled by a relatively small number of individuals. Some famous bitcoin fortunes include:

• Satoshi Nakamoto, the pseudonymous creator of Bitcoin. Whether Satoshi is a lone developer or a consortium of people, the Satoshi entity is believed to control a whopping 1 million bitcoins — 7.1% of the approximately 14mm bitcoins that we are assuming exist today in accessible form. We know from looking at the bitcoin blockchain that none of these 1mm coins has ever been “spent” (i.e., sent to another bitcoin address).
• Roger Ver, also known in the community as “Bitcoin Jesus,” parlayed a ~$100k investment in Bitcoin into a stash that has been estimated at 250k BTC.
• The Winklevoss twins of Facebook fame are said to control well over 100k BTC between the two of them.
• Erik Voorhees, the inventor of the first provably-fair bitcoin gambling website, Satoshi Dice, is reported to have sold the site for ~ 126.3k BTC, worth ~$12mm at the time.

What is the point of discussing the concentration of bitcoin wealth? Well, all of the individuals described above are true believers in the bitcoin experiment (you can read about them online and decide this for yourself, but it is not a particularly controversial claim).

• While some have undoubtedly taken “chips off the table” over the years, most are believed to retain the vast majority of their BTC holdings, and one would assume that they are in no big rush to unload these.
• The fact is, if one buys into the concept of bitcoin, there is no need to convert your bitcoins into “real money” like the US dollar: the bitcoin already is money — indeed it is the best money/store-of-value that the world has ever known.

In any event, the point of discussing this is that, while the bitcoin held by these original “BTC whales” is technically part of the circulating supply of bitcoin, it is mostly not available for sale to the public at large. That is, it is not part of the public float of bitcoin. If we assume that ~2mm bitcoins can be characterized in this way, then this implies that the total number of existing, accessible bitcoins that are available for purchase by the public is just 14mm - 2mm = ~12mm.

We have thus established that bitcoins are both useful (at least to some non-trivial segment of the global population) and also very scarce. Basic economic theory, of the kind that would be instantly recognizable to Adam Smith or David Riccardo, tells us that bitcoin should thus attract some non-zero price on the market. Indeed, the only way for the price of bitcoin to go to zero, as pundits are fond of hypothesizing, would be for bitcoin to stop being useful or scarce. Since this seems unlikely, bitcoin is highly likely to continue to have some value in the global marketplace.

• The only “bitcoin goes to zero” scenario that seems even somewhat plausible would be if Bitcoin were to be superseded by an even “better” new decentralized crypto-currency.
• As we will argue below, this is an unlikely scenario for various reasons; and even in that scenario, bitcoin would still retain some value.

So bitcoins should have some value.

So what? We will now argue that the price of Bitcoin should continue to increase, as it has from its inception — with the occasional severe price correction to be sure — from well under 1 penny in 2010 to over $15,000 per bitcoin, as shown in the chart below on a logarithmic axis:

The price of BTC in USD terms, plotted on a logarithmic axis.

Let’s start out in the way that you would start out the analysis of any commodity: an analysis of supply and demand, and how that supply and demand is likely to change over time.

First we begin with the demand side:

Bitcoin is desired and valued by a certain type of person — one with a libertarian mindset who is fundamentally distrustful of human institutions and governments. The intersection of this mindset with certain technical skills (software development, network security/encryption) characterizes the “cypherpunk” movement that permeated the early days of the bitcoin project.

• While this might capture only a tiny fraction of people in the world, the fact is that these people are vastly overrepresented in the present ownership of bitcoin to an almost absurd degree, and their continued belief in the project is a source of sustained demand for bitcoin.
• This demand is backed by the vast resources of these people from their already highly appreciated holdings and their realized profits to date.

The media’s favorite example of bitcoin users — hackers and criminals (e.g., drug dealers, people selling guns, fake IDs, hacking tools, credit card numbers, etc.). While this may have been a large part of the early usage of bitcoin (say, for sites like the Silk Road marketplace), most of these nefarious users have long since moved on to newer crypto currencies that feature strong privacy protections, such as Monero and Z-cash. Furthermore, these users are increasingly dwarfed by the bitcoin purchases of normal, law-abiding investors at both the retail and institutional level.

• One important remaining category of demand, however, comes from victims of so-called “ransomware,” which is spread through computer viruses and encrypts a user’s files on their computer. If the user doesn’t have a backup of these files and needs them, the user is forced to send some number of bitcoins to an address controlled by the hacker, after which the user will receive the decryption key so he can access his files. Many large European and Asian businesses learned this the hard way from the Wanna Cry worm, which could have been far worse.

A foreign national living in the West who wants to send remittances home to his family. If the family lives in a developed country, then such payments can be sent with relatively low frictional transaction costs. However, if you have ever tried to directly send a payment to a freelancer living in Pakistan (to cite one example of many), you know that your options are highly limited to services such as Western Union.

• These services heap fees upon fees, and offer customers egregiously bad foreign exchange rates when converting currencies. It is not uncommon for 30% of the total transaction value of remittances to certain developing countries to be lost to payment providers such as Western Union.
• Compare that to the cost of sending bitcoin, where fees rarely exceed a couple percent of the total value unless you are sending a small amount of BTC. Note that the sender can specify a much lower fee, but this could greatly extend the time required to confirm the transaction on the blockchain.

Those living in authoritarian regimes or in dysfunctional societies which fail to provide the basic requirements for life; think of places like Venezuela under Maduro, or Zimbabwe under Mugabe. The citizens in these countries can turn to bitcoin, which they can mine in a decentralized way (assuming they have some access to electricity) and which they can freely spend without the knowledge or permission of their oppressive government.

Nation states that are currently prevented from fully participating in the global financial system as a result of trade sanctions could use bitcoin to skirt these sanctions. For example, Russia has been very limited in its ability to transact with foreign banks in many countries. While Russia will no doubt think of various clever schemes to evade these sanctions, such as the one they hatched with HSBC to do a series of back-to-back stock market trades to move money, the bitcoin network offers these nation states a much better method that makes detection and mitigation of the scheme much harder because it is trustless and doesn’t rely on unreliable people and their ability to keep a secret.

One of the biggest categories of potential bitcoin demand comes from people living in countries that have strict capital controls preventing the flow of money out of the country:

• While China might not be as dysfunctional as Zimbabwe, it’s still not a great place relative to other countries in the world to be very wealthy: the rich in China live in fear of confiscation of their wealth by the all-powerful Communist party, which can arrest them on the pretense of corruption and hold them indefinitely without trial.
• Or take the case of the wealthy princes in Saudi Arabia who are currently being held against their will by the Crown Prince, who is attempting to shake them down for billions of dollars.

So how might someone in China or Saudi Arabia actually go about using bitcoin to evade capital controls? Certainly, if a billionaire in China controls a multi-national empire of companies, there are lots of clever schemes to get around capital controls.

Suppose a Chinese citizen received a large payment for whatever reason (say, a Chinese civil servant is paid a large bribe from a real estate developer in exchange for granting a dubious building permit; remember, we don’t have to like the use case for it to exist), and this person didn’t have access to a web of offshore entities and relationships with overseas bankers. How would that person be able to flee China with his money in tow and go to live in, say, Vancouver, BC?

One relatively easy way to get a lot of money out of China would be to use bitcoin. There are a couple ways you could go about doing this:

• If you know someone who owns a lot of bitcoins, you could pay cash for the bitcoins and have them sent to your “paper wallet” that you generate, where you can control the bitcoins simply by knowing the private key to the wallet’s bitcoin address. In this case, you could even memorize this number (or carve it into the inside of your leather belt, break it into pieces and give the pieces to your friends, or any number of clever ways that would obfuscate the number while giving you the ability to retrieve it later) and get on a plane to Vancouver. Once you are there, you can find people to purchase these coins for cash, or simply hold on to them (they are money already, after all!).
• If you don’t know or trust anyone to sell you a lot of bitcoins for cash, you can instead generate the coins through mining. Simply purchase a business in some rural part of China with access to cheap coal-fired power that uses a lot of electricity — say, for example, an aluminum smelter, or a steel mini-mill using electric-arc furnaces. Then you purchase some mining equipment for cash and set them up in the basement, connecting to the bitcoin network through a VPN (or even using satellite internet connection to avoid any detection by the authorities) and configure the mining machines to send the block rewards directly to your paper wallet. When you have enough bitcoins in your paper wallet, get on a plane to Vancouver as in the previous example.

If we compare the bitcoin method of evading capital controls to some other common methods, we see that bitcoin has numerous advantages:

• It doesn’t require you to trust anyone who may betray you out of greed or because they were coerced into cooperating by the government.
• The loss to frictional transactions costs are miniscule, especially compared to the losses from traditional money-laundering techniques, which can cost upwards of 20% of the amounts laundered.
• It can be implemented entirely domestically without arousing suspicion, so that the perpetrator does not need to have access to foreign travel until the very last step, when they get on the plane to freedom with their private key safely in their possession.

Finally we get to the biggest category of demand of all, and the one that is most likely to lead bitcoin to new heights of value: the greed of speculators and the strong desire of the public to participate in a “get rich quick” scheme — especially after they witness first-hand their friends or family making obscene amounts of money in a matter of months. We will return to this category later in this document, because it deserves a detailed exploration of the sustainability and long term trajectory of this speculative demand.

We have discussed several of the major categories of demand for bitcoin. What about the supply of bitcoin?

Analyzing the Supply Side of Bitcoin

Bitcoin is perhaps the easiest commodity in human history to analyze from a supply standpoint, since bitcoin’s emission schedule (i.e., the chart showing how many bitcoins will exist for each day/month/year over the next 100+ years) is clearly laid out in the computer code that runs the bitcoin network and cannot be changed by any central party, so that it can be relied upon to persist into the future.

Before we go any further, let’s address a common objection that arises at this point; once we have covered this, we can proceed with the analysis and assume that the future bitcoin emission schedule is known today with a high degree of certainty.

The objection is “Why couldn’t the nodes that run the bitcoin network all decide independently to change the protocol that they follow?”

• Of course, this is technically possible, but any such change would fly in the face of economic self-interest of the various parties in question — the miners, the nodes, the investors, etc.
• Indeed, the way the bitcoin network has evolved to deal with this sort of network-wide consensus issue is to have miners signal their preference upon submitting valid blocks to the blockchain; this mining-centric viewpoint is partly what gives bitcoin such strong security characteristics, because it makes it a pure meritocracy based on the sustained contribution of external economic resources.
• Presumably, any party submitting large quantities of valid blocks will have a large financial stake in the value of bitcoin, and would be unlikely to do anything that would permanently impair that value, such as opening up the inflation schedule to be 2% perpetual growth to “keep up with the growth of the population and global economy.”

Even if some degree of perpetual growth in the money supply (i.e., inflation) is a valid or desirable goal of a money system from a global societal standpoint — and that is far from a settled debate — the individual economic actors who are in a position to influence events in the case of bitcoin are far more likely to be motivated by self-interest over any altruistic ideals about the social ills stemming from deflation. After all, they have huge electricity bills to pay!

This is a critically important point, and it’s the reason why proof-of-work is the only known method of creating a secure and decentralized crypto-currency: there is an ongoing, real-world cost to acting irrationally when it comes to bitcoin.

Other systems that rely on so-called “proof-of-stake” are vulnerable to a wide range of potential attacks, such as Sybil attacks, where an attacker is able to create the illusion of consensus on the network through the attacker’s control of hundreds of “sock puppet” accounts and large quantities of the coin in question. Because the costs of mounting such an attack are one-time in nature, they are much easier to pull off because they require only modest computational and financial resources.

Indeed, the US government could have “learned its lesson” about bitcoin by having a policy whereby it purchases at low cost on the open market (or creates through mining or other means) a large portion of the outstanding coins for each of the major crypto-currency projects soon after each is announced:

• If it got started with this early on, when the total value of all the major crypto-currencies of today with any history was under $1 billion, it wouldn’t even cost that much to do.
• If any of these crypto-currencies rely on proof-of-stake, the government would be able to trivially hijack the supposedly decentralized network consensus process and direct the coin to ruinous consequences.
• While this may sound like a paranoid fantasy, crypto-currency obviously represents a fundamental challenge to the economic sovereignty of nation-states, which are known to jealously guard their seigniorage rights of issuing currency.

The reason why proof-of-work is resistant to these kinds of inexpensive attacks is because of the difficulty re-targeting algorithm and because of the thermodynamics/physics that make computing hashes a valid proof of resource consumption/burn.

To see why, consider a state-level actor like the US government with vast resources attempting to subvert or corrupt the bitcoin network today. At a minimum, the government would need to:

• Invest billions of dollars to essentially double the total computational resources currently dedicated by the rest of the world to mining bitcoin — which is itself a moving target, since:

1. New mining equipment is manufactured and plugged in each day all over the world;
2. Semi-conductor technology advances to increasingly smaller scales that can compute far more hashes per second per watt consumed.

Note that the capital invested in mining equipment will become worthless if the attack is successful, representing a permanent loss of billions of dollars of capital — a very important distinction to make, since the US government can easily marshal vast financial resources on a temporary basis. Thus, if an attack were possible that allowed the equipment to be re-deployed, and its value preserved — say, because the government found some alternative use for it — it be would far easier for the government to pull it off.

• Spend a huge amount daily on electricity — an ongoing expense that cannot be amortized because it must be incurred constantly, in a way that can’t be “faked” because it is verifiable by other participants in the network (i.e., other nodes can quickly check that the government’s submitted block is valid, and if it’s not, the submission would be ignored just like any other invalid block submission).

We can even estimate the cost of this electricity by making a few simplifying assumptions. Here is one simple way to get a rough sense of the amount of electricity being used globally by the bitcoin network:

• As of 1/11/2018, the total hash rate of the bitcoin network is approximately 16 million tera-hashes per second (a tera-hash is 1 trillion hashes)
• The most popular bitcoin ASIC miner in the world is Bitmain’s Antminer S9, which can compute 13.0 tera-hashes per second while drawing approximately 1,300 watts of power.

That means that it would require

16,000,000 ÷ 13.0 = 1,230,769 Antminer S9’s

• …to double the hash rate of the network — the minimum hash rate required to attack the bitcoin network.

At this point it is important to point out that, while such an attack would represent a clear compromise of the bitcoin system’s security promise, it would NOT result in a catastrophic situation — at worst it would allow the attacker to perform a “double spend” which would erode confidence in the system.

• What do we mean by a catastrophic situation? One that fundamentally destroys the system so that it cannot be relied upon at all. For example, consider a different class of vulnerability — one that bitcoin is not even theoretically exposed to, but which could impact some other crypto-currencies, such as Z-Cash — that would allow an attacker to generate counterfeit coins out of thin air, without anyone in the network being able to realize that the number of coins was being inflated (presumably they’d realize something was wrong because the price would start crashing as the counterfeiter sells his fake coins!).
• Or consider a vulnerability that would allow an attacker to steal coins held in other peoples’ wallets — even so-called paper wallets not connected to the internet.

Thus we can look at the cost of purchasing and running 1,230,769 Antminer S9’s to get a rough sense of the cost of the attack. The current wholesale price of an Antminer S9 on Alibaba was originally around USD $1,600 (because of the current high ROI and resulting shortage of these devices, the price as of 1/11/2018 is more like $3,500!). That means it would cost the attacker a minimum of

1,230,769 x $1,600 = ~$2 billion

for the hardware. You would probably need to add at least 40% to that to that number to account for the real estate and cooling infrastructure to accommodate over a million ASIC miners.

Suppose the attacker has access to very cheap electricity at a cost of $0.06 per kilowatt hour (for some context, the cost of power in NYC is about $0.22/kwh, and the average across the US is around $0.10/kwh, while the average cost in Germany is over $0.35/kwh; some estimates put the cheapest coal-powered Chinese plants at around $0.035/kwh).

A single Antminer S9 draws a constant load of 1.3 kilowatts, or

24*1.3 = 31.2 kWh per day,

which, at an assumed cost of $0.06/kwh would amount to $1.87 of power per day. A conservative estimate of the other variable costs, including:

• The cost of housing and maintaining large numbers of miners.
• The cost of cooling the miners, which generate tremendous heat…

…would add at least another 30% to this variable cost, so call it $2.43 of variable cost per Antminer S9 miner running per day. That means the attacker would have to spend

1,230,769 x $2.43 = ~$2.99mm per day, or ~$1.1b per year

…to even be able to theoretically pull off a double-spend attack, which isn’t even a fatal attack to the bitcoin system. Furthermore, as the price of bitcoin continues to increase, the cost of this electricity will continue to increase, roughly tracking the percentage growth in the price of bitcoin.

As an aside, we can now make an educated guess about the market-wide average profitability of mining assuming the costs are as above:

• We know that 1,800 bitcoins are currently mined each day on average (though this will fall to 900 in the year 2020).
• At the current price of bitcoin — $13.5k as of 1/11/2018 — that is a total of 1,800 x $13.5k = $24.3mm worth of bitcoin generated each day if it were sold at the market price.
• Now we must consider the transaction fee component of mining revenues. At an average fee of around 0.001 BTC, and assuming an average transaction size of $500 = 0.037 BTC, the average fee as a % of the transaction value is 0.001 / 0.037 = 2.7%, so this would add another
  $24.3mm x 0.027 = $650k of daily mining revenues.

The tricky part here is to estimate the useful life of the miner. This comes down to how long the miner could profitably keep the miner plugged in and running. Bitcoin mining hardware from just a few years ago is already unprofitable to run unless you have access to free electricity. If we assume a useful life of 2 years for the Antminer S9s, that implies a daily equipment cost of $1,600 / (365*2) = $2.19 per day per Antminer S9.

Thus the total estimated daily cost per Antminer S9 is $2.43 (i.e., the power cost) plus $2.19 (i.e., the amortized equipment cost), for a total estimated mining cost of $4.62/day per Antminer S9. This implies an estimated total mining cost for the network of

1,230,769 x $4.62 = $5.68mm per day ($2.1b per year!)

Note that this $5.68mm per day is likely a conservative lower bound for the true cost, since many miners are still running less efficient, older equipment, and many miners are paying much more than $0.06/kwh for power. The true cost is likely at least 2x this amount. If that 2x is right, then the effective total estimated cost of all mining is ~$11.4mm per day. This implies a gross margin on mining of

($24.3mm — $11.4mm) / $24.3mm = 53%

…which is certainly an attractive ROI! But of course, whatever the mining ROI may work out to today, remember that this ROI will be cut in half on the day in the year 2020 when the block reward gets cut to 900 BTC per day — that is, unless the price of bitcoin were to double in reaction to the cut in the supply growth.

In fact, this sort of price behavior has been empirically observed in bitcoin after the previous 2 halving processes, from the original 50 BTC reward, to 25 BTC, and then to the current level of 12.5 BTC.

We have now wandered far from the original goal of this section: estimating the supply of bitcoin. Luckily, we are basically done now, because it’s incredibly straightforward:

• In fact, you already have most of what you would need to estimate this: it’s the current number of bitcoins (~17mm) plus the 1,800 new ones mined per day — with that 1,800 reducing to 900 sometime in 2020, and reducing by half again every 4 years after that — until the very last bitcoin created is mined in the year 2140, when we will reach the 21 millionth bitcoin.
• At that point, bitcoin will continue to exist, but the incentive for mining will be comprised solely of the transaction fees that senders of BTC pay to incentivize miners to include their transactions in the next block that the miner submits.
• This transition to purely fee based mining incentives will not present some huge problem whereby miners won’t have any reason to run their hardware: as the chart below shows, long before the mining block rewards stop, they will become a negligible portion of total mining revenues.
• The supply of newly created bitcoins, both now and in the future, is summarized completely by the following chart:

If you look up where we are today in 2018, you can see that most bitcoins have already been mined.

So we have now painted the picture of the supply/demand dynamics for bitcoin today and in the future:

• Robust and increasing demand for bitcoin, given the bitcoin network’s usefulness in various scenarios, such as the evasion of capital controls, the avoidance of trade sanctions, its use as a payment method for “ransomware” cyber-attacks, and most importantly, the speculative greed of the public at large.
• Tightly controlled supply of new coins, where the percentage growth in the new coin supply declines exponentially over time. That is, most of the bitcoins that will ever exist already do exist, and the growth in new coins is declining dramatically.

But what does this really imply? Why is this situation so unusual?

Claim: The invention of bitcoin in 2009 introduced the world to a financial instrument with unique and unprecedented properties that have never held for any instrument up to that point in economic history:

That is, a commodity with “money-like” attributes…

• Fungible: Each bitcoin is identical to any other in terms of value; this is similar to dollars and gold and shares of stock of the same company, but is different from rubies or diamonds, which vary in terms of their cut/clarity/color/etc.
• Durable: Your bitcoins won’t rot or vanish if you are careful with them; this is similar to gold, but different from soybeans — which eventually decompose — and from dollars, which depreciate over time as a result of perpetual debasement by the government; the value of the Federal Reserve Note has declined by over 96% since its introduction in 1914.
• Transportable: Bitcoin is almost uniquely good in this regard: gold can be difficult to transport because it is a physical object that can be easily detected by security guards at the airport, and dollars can be difficult to transmit because of AML/KYC laws and other government restrictions.
• Easily Divisible and Recombinable: Bitcoin is even better than dollars in this sense, since 1 bitcoin can be split into 100,000,000 pieces, called Satoshis. And bitcoin is ludicrously better than gold in this sense; even though gold can be fairly easily melted down and reshaped compared to other metals, it is almost absurd to imagine someone snipping pieces off the corner of their gold coin to pay for a purchase.
• High Value-to-Weight Ratio: Bitcoin also shines in this department, as it has zero weight, being made out of pure information!

…that does not have any supply response in reaction to changes in price!

The old saying that “The cure to high prices is high prices” has always been about as close as it gets to an ironclad economic law.

• It doesn’t matter if you are talking about soybeans, chickens, Swiss Francs, shares of Facebook stock, and, yes — even gold — if the price of something increases by a large enough amount, then someone, somewhere in the world will eventually find a way to produce more of it.
• Indeed, if history is any guide, well-functioning free markets will ensure that the creative energies of large numbers of clever entrepreneurs and financiers across the world will be focused on finding ways to produce so much more of whatever product it is that they will likely end up upsetting the supply/demand balance that attracted them to the product in the first place, causing the price of that product to decline or even crash.

Let’s take the example of gold. Gold is uniquely rare in the world for something that has so many other good money-like attributes: the amount of earth that must be dug up and filtered to produce one ton of gold is truly staggering. Thus it is no surprise that gold literally was money for most of the world during much of recorded history.

• The easy-to-find gold in the world has largely been extracted already, leaving the remaining deposits of gold in structurally higher cost mines, such as Donlin Creek in Western Alaska, which contains an incredible 33.8mm ounces of gold worth ($44.6 billion of gold at the current market price).
• The problem with Donlin Creek is that it is in the middle of nowhere and requires a huge investment in infrastructure to create the roads, railroads, power, water pumping, and other requirements for a functioning mine.
• This sharply increasing marginal cost of production is what makes gold a good store of value, and is why the supply of total gold reserves in the world has grown since the year 1900 at a compound annual growth rate of just ~1.3% (in 1900, there was about 40,000 tons of gold in the world, and today there is around 180,000 tons — an amount that would fit inside a single Olympic sized swimming pool, as illustrated in the visualization below).
• The following chart shows the supply of gold since 1900 — notice how different the shape is from the chart of bitcoin’s future supply growth:

A chart of the total supply of extracted gold in the world over the past century.

A visualization of the total extracted gold in the world. Source

• This slow supply growth explains why gold traded for just $20.67/ounce in the year 1900, and presently trades for $1,320/ounce — a compound growth rate of 3.6%. Perhaps not surprisingly, if one subtracts the CAGR of the gold supply from the CAGR of the gold price, you get 3.6% - 1.3% = 2.3%, which is probably a reasonable proxy for global real GDP growth since 1900.
• Thus it is not so much that gold is a great investment, but rather that the dollar is an almost uniquely bad store of value: what you are seeing in the upward trajectory of the gold price is really the debasement of the dollar because of money creation by the government, magnified by the fractional banking system.

So what’s the point of dwelling on gold for so long? Well, let’s try a thought experiment: suppose that all the world’s billionaires — Bezos, Slim, Zuck, etc. — all decided to quickly invest the majority of their wealth into gold bullion. This would cause the price of gold to skyrocket, since supply growth is relatively constrained in the short run. Suppose their actions caused the price of an ounce of gold to go to some extremely high level, like $100k/ounce in 2018. What would happen?

• It might take a few years, but eventually, vast new deposits of gold — including many that didn’t make economic sense to develop at the $1,320/ounce gold price — would come online, as entrepreneurs and financiers would be irresistibly drawn to the eye popping project-level IRRs offered by gold mine development projects.
• Eventually, the supply/demand dynamic of gold would be adversely impacted, sowing the seeds for a future decline in the gold price as the market attempts to reach a stable clearing price (i.e., as the market reaches equilibrium).

Here is where you should start to recognize what is so special and unprecedented about bitcoin:

No matter how high the price of bitcoin goes, the world cannot produce any more of it. The only “relief valve” for balancing supply and demand is the price of bitcoin, which logic suggests will increase significantly as the market attempts to clear.

• Note that it is plausible for the price of bitcoin to reach almost any level (obviously, the market value of all available bitcoins must be some fraction of the total wealth of the world) while still retaining all its desirable money-like attributes because each bitcoin can be subdivided into so many parts, which means that even poor people will be able to own some tiny fraction of a bitcoin (whether they could affordably transact with it at a level that make sense for them given the fees is another question).

How can we be so confident that there is a fundamental structural imbalance between the future supply and demand of bitcoin?

Here is another easy thought experiment that quickly suggests that this is the case:

• There are roughly 7 billion people living in the world today. Of course, most of them have very little in the way of wealth. So, for now, let’s ignore them entirely and focus only on the global 1% — the richest 70 million people in the world today.
• Suppose that, as the price of bitcoin goes up at eye-popping rates, these richest people decide that it’s sensible to purchase just 1 bitcoin as a potential hedge to protect some of their wealth in the event that bitcoin takes over from other stores of value.
• That certainly doesn’t sound like much, right? It would be a very cheap hedge — at current prices, such an amount would represent at most a tiny percentage of the wealth of these global “one percenters.”

And yet, the supply of bitcoin will always be woefully inadequate to service such demand in aggregate:

• Recall that, while there are ~17mm bitcoin technically in existence, perhaps just 12mm of these are available for purchase by the public at large.
• That means that each of these one-percenters can own on average a maximum of:

12mm / 70mm = 0.171 BTC

• Of course, many people who wouldn’t make it into the list of the richest 70mm people in the world already own bitcoin, further reducing what is available to these richest people.
• Clearly, the only way left to ration this inadequate supply is a much higher price, one that will make even the ownership of 0.1 BTC a respectable amount of capital.

Bubble Popping

Next, we can assume for argument’s sake the claim that bitcoin is currently in a “bubble phase,” and then compare it to other historical bubbles to see how it might differ from these past examples. To begin with, ask yourself: what causes bubbles to eventually pop?

The answer of course is that supply and demand get out of whack for whatever reasons — say, there is a sudden rush of people who want to sell, and not many buyers are willing to step up on such short notice to provide liquidity to the market, causing the price to gap down until sufficient numbers of brave/greedy speculators rush in to fill the gap in the market. But what causes this imbalance in the first place?

• The most obvious way such an imbalance can happen for a fungible commodity is that there can either be a sudden increase or decrease in demand, or a sudden increase or decrease in supply — this is of course tautological. But observe that:
• We have already demonstrated that bitcoin is protected from at least one of these forces: since the supply grows at a prescribed schedule, we only have to concern ourselves with demand for bitcoin.
• In the short run, the price of bitcoin is just as driven by short term swings in demand as the gold market or egg market; but we would suggest that the scarcity and usefulness arguments made above make a plausible case for secular growth of bitcoin demand, especially as awareness and adoption of the system continues to grow. So, although bitcoin can be dealt setbacks — say, from the fears around bitcoin bans in Korea and China — over time it should recover from these as the demand re-bases and returns to growth.
• This last idea, that the value of the bitcoin network is proportionate to square of the number of users of that network, is known as Metcalfe’s Law and has been cited by some as a key element in the bitcoin investment thesis.

What about stock market bubbles?

Clearly, not all bubbles are the same, and stock market bubbles operate according to different dynamics than “naturally produced” fungible commodities such as gold or eggs.

Claim: Stock market bubbles tend to pop because they fail to deliver on the promises they made to investors, leading to surprise and disappointment which causes some owners on the margin to decide to sell.

Some examples of this dynamic from the dot com bubble — the most analogous recent bubble to compare with — are given below:

• Pets.com didn’t even need to make promises about profits or even revenues — user growth alone would have pleased investors. Yet they still failed miserably to deliver on this metric because they were simply too early: not enough people were online to make the economics work. Investors gave up when they saw the hopeless unit economics, sending the price to zero.
• Webvan.com was right about their revolutionary distribution model, but they could barely give away their service at massive losses. All it took for the model to work was a huge increase in customer route density and some robotics, as demonstrated by Amazon. But it was too late for Webvan, leading to big disappointment and the stock going to zero.
• Flooz.com, mentioned earlier, was a terrible idea that would never work, because as soon as it got big, the government would move in to shut it down. Indeed, Flooz became a prime target of hackers, with as much as 20% of all transactions being fraudulent.

Claim: Bitcoin can’t disappoint investors in this way because it makes no intrinsic promises other than continuing to exist as bitcoin and continuing to have good security properties (e.g., impossible to counterfeit or confiscate); in this way it is similar to gold.

A common argument for why bitcoin “must be worthless” is that it isn’t “backed by anything tangible”; that is, because no person or entity is there to back up the promise, or because there is nothing physical changing hands (say, a bar of gold in your pocket that you can feel), that bitcoin can’t have value.

There are many ways to rebut this argument. The first, while valid, is perhaps not illuminating. That is to argue that we have already proven by reductio ad absurdum that bitcoin has value from the scarcity/usefulness argument above; that argument, in short, goes:

• The only way for something to be worthless is for it to either be useless or readily abundant (i.e., not scarce):
• We can easily see that BTC is demonstrably scarce relative to the human population;
• We can argue that BTC is useful to various large groups in the world that control vast resources outside of bitcoin.
• Furthermore, we can point to the mounting empirical evidence that this principle has already been vindicated by the increase in the price from under a penny to ~$15k over the course of ~8 years.

But let’s think of some other rebuttals against this argument:

• First of all, as we have already discussed, it is wrong to suggest that there is nothing tangible backing up bitcoin.
• The constant discovery through the global mining process of “rare” nonces that result in extraordinarily high numbers of leading zeros in the block hashes is in a sense tangible;
• More importantly, these nonces represent the irrefutable proof of work in the physics sense of the term.
• That is, if a bitcoin cannot be created in any reasonable amount of time for less than $2,000 worth of electricity, then that seems to be backed by something very tangible.

Just because the result of this electricity/work only derives value from its significance to a specific group of economic actors (in this case, the miners and full-nodes of the bitcoin network), it doesn’t make the value any less “real.”

Some investors love certain aspects of bitcoin — the fact that you can send it over a wire, the fact that it has relatively low transaction fees and that anyone with internet access can transact — but bemoan the lack of any link to the physical world. Many of these have proposed hybrid structures, where you have some kind of crypto currency, but it is also backed up by physical gold in a vault, or some claim on other real assets or services (say, royalty rights to stock photography images, or generic GPU hashing power on a mining pool, to use a couple recent real-world examples).

Claim: Investors who want to bridge the physical divide with crypto-currency are fundamentally misunderstanding why bitcoin is special: it is impossible to back anything with real world resources without introducing counterparty risk; that is, “backing requires a backer.” The backer can be suborned and controlled by the government without the public even realizing it, dooming the investment prospects of the coin.

Put differently, bitcoin having no link to the physical world is a feature and not a bug:

• That’s what allows a bitcoin user to simply get on an airplane with a number recorded in their mind or on a slip of paper, and yet still transport vast sums of money anywhere with limited fear of discovery.
• That’s what allows different bitcoin users, who have never met in real life, and who might even hate each other if they did meet, to transact nearly immediately over vast distances in a way that preserves their secrecy (assuming they take the proper “operational security” precautions) because no one was required to hand over a passport or driver’s license to anyone — the system is “permission-less.”

The fact that bitcoin exists in units that are entirely abstract creates an additional argument for why bitcoin is fundamentally different from all historical financial bubbles:

Claim: There is nothing that tethers the price of bitcoin to the “real world,” a rare property for an asset to enjoy, and one that creates special dynamics.

What do we mean by this? Let’s compare bitcoin to some other financial products:

Shares of Facebook stock:

No one can deny that Facebook (“FB”) controls an increasingly valuable segment of our digital lives, and that this position — a result of network effects, first mover advantages, worldwide scale, great product execution, etc. — is extremely valuable. And yet, there are still a lot of real world ways in which the valuation of FB stock is constrained:

• To see why, first suppose for argument’s sake that we ignore the poor users of Facebook living in third world countries and focus only on the more affluent “Western” users living in developed markets.
• Whatever that number is — supposes it is 400mm people in total — we can then take the enterprise value of Facebook and divide it by this number of Western users.
• Suppose you do that and come up with a value of $400 per Western user.
• This per user valuation is intuitively appealing, since one could easily see how the sum total of all the advertising revenue that Facebook earn from a Western user in a whole year might run to $50 per user. After all, that is a tiny amount when spread over each advertiser, and it would only take a few hundred dollars of spending by a given user to make it rational for advertisers to pay that much to reach that user.
• If Facebook can make a high enough margin on that $50 of revenue per Western user, and if FB trades in the stock market at a high enough multiple of those earnings, it’s not hard to see why investors might feel confident holding Facebook shares as an investment.

Now, here is the critical part: suppose that there is a massive stock market bubble, and that 6 months from now, the price of Facebook shares implies a valuation of $4,000 per Western user.

We see immediately that such a valuation, at least in the short run, can never “pencil out” — there simply isn’t enough value in the value chain for it to make sense for the various parties. Advertisers as a group could never justify spending $500 per user on average, since most of those users wouldn’t even spend enough on purchases for there to be enough margin left over for the advertiser.

In this way we see that there are some practical limitations on the price at which FB shares can rationally be valued, at least in the short run.

Shares of Tesla:

Similar to the FB example, shares of Tesla (“TSLA”) are ultimately limited by certain assumptions stemming from real world considerations:

• The number of total cars purchased globally;
• An estimate for the total market share that Tesla can realistically capture of the global car market;
• The average selling price and profit margin that Tesla can realistically earn on those car sales.

While some investors today argue that it will be difficult or even impossible for Tesla to “grow in” to its current valuation, which appears to discount a small probability of failure, it’s certainly the case that at 10x the current share price, the long case for TSLA shares would be even more unconvincing.

Most commodities, such as cotton, iron ore, oil, etc.:

Although the method of argument is a bit different, one can readily see that the price and implied market value of all the existing stocks in the world of a given commodity has some upper limit:

• Even if that commodity is very scarce, ultimately it has some “value in use”.
• If all the existing stocks of that commodity are put to their “highest and best use,” then the sum total of all those supplies, taken at a price commensurate with that highest use, puts a practical ceiling on the total value of existing stocks.

For example, if the value of all uses of cotton in the world (e.g., for making clothing, bedsheets, rope, etc.) is worth approximately $X billion, then the value of all the stocks of cotton would have to be less than $X billion, otherwise there would be no value left in the chain for the downstream users of that commodity.

If you now step back and consider it, no such argument can ever apply to bitcoin. That’s because it is “useless” other than as a medium of exchange and store of value. Put differently, that which has no “use” can never be irrationally valued relative to that use.

Indeed, we can go even further:

Claim: Not only does bitcoin not have a practical upper limit that puts a ceiling on its valuation — other than the obvious limitation of not exceeding the sum total of the world’s wealth, whatever that is — it is unusual in that, the higher its valuation, the more useful bitcoin becomes, which creates a virtuous cycle.

Before we address this claim, we will turn to the question of what makes one crypto-currency more attractive than another crypto-currency. I will argue that there are 3 main attributes which can help explain the relative attractiveness of a crypto-currency. Although this is obviously an overly simple mental model, it explains a lot about the observed values of various crypto-currencies today (with a few glaring exceptions, such as Ripple, which is hideously over-valued by these criteria):

Security:

By security we mean two things:

• A history of demonstrated security, whereby users of the system who take the proper operational security precautions don’t have to worry about getting their coins stolen. That is, that the underlying security model and encryption method and hash functions are all provably secure. Bitcoin boasts the longest and most proven track record of security in this sense compared to all other crypto-currencies.
• The amount of electricity and resources going into the network every day to keep it secure, as discussed above. Clearly bitcoin is unparalleled in this regard.

Decentralization:

As we explained above, no one is in control of the bitcoin network. And unlike other projects, such as Ripple and Ethereum, there is not even a recognized “leader” or, in open-source terms, a “benevolent dictator for life” in the way that Linus Torvalds is for the Linux project.

By staying anonymous and exiting the scene early enough in the history of Bitcoin, Satoshi Nakamoto created a “power vacuum” for the bitcoin project that has pushed it to much higher levels of decentralization: there is no “inventor” to defer to on questions about the project’s direction.

Contrast this with the case of Ethereum:

• The fact that Vitalik Buterin (the creator of the project) is alive and well, and touring around the world to speak to packed audiences about the project (not to mention tweeting daily), creates a degree of centralization that is hard to even estimate.
• What would happen if Vitalik were secretly approached by powerful governments and “strongly encouraged” to introduce certain changes to the ether protocol rules?
• If Vitalik could make some reasonable sounding excuses for these changes, chances are that most of the world would just take his words as gospel and update their implementations of the protocol to comply.
• Thus, by this measure of decentralization, Bitcoin is the most attractive crypto-currency.

Liquidity:

Now we get to the reason why we brought this question up at this point in the narrative, which is liquidity: the ability for economic actors to transact in large sizes without unduly impacting the price of the coin is critical for any crypto to truly be useful and to have any chance at replacing gold as a store of value.

By this measure, Bitcoin is the clear winner, with the total value of all trading pairs on 1/16/2018 exceeding $17.5 billion in a 24-hour period.

The reason we brought this up here is because as the price of bitcoin increases, it becomes more liquid. Since liquidity is one of the 3 major reasons why a crypto-currency might be considered more attractive than another, this creates a virtuous cycle, wherein the “excessive valuation” of bitcoin in the short run actually has a reflexive effect on the intrinsic usefulness of bitcoin as a means of exchange and store of value.

Quantifying the upside:

How can we get a first-order approximation of the what the bitcoin price could reasonably go to in the next several years?

• One analytically simple yet fairly persuasive argument is to suppose that Bitcoin “takes over” from gold as the new best store of value. What would that imply?
• If we take the ~180,000 tons of gold said to exist in the world at the current market price of gold, that would amount to roughly $7,500 billion dollars ($7.5 trillion).
• If we divide that $7.5 trillion by ~17 million coins that exist today (although some of these are lost), you get to $441k per BTC.

What about the risks?

You don’t have to look very far to find any number of articles that will tell you about the risks of investing in bitcoin. While many of these risks (such as hacking) come down to operational security, and can thus be mitigated by being careful, some of the risks are structural and cannot be avoided.

Probably the biggest risk of all is governmental regulation. We discussed previously why governments might be particularly hostile to bitcoin, but let’s elaborate on those reasons:

• It’s a loss of control for them, since they are used to controlling most aspects of the money supply (directly, through the Federal Reserve, and indirectly, through the regulation of fractional reserve banking in the US).
• It allows terrorists and criminals to avoid the banking system while still transacting in size over the internet.
• It makes it impossible to completely track various things that governments like to track, such as political donations, donations to hot-button political causes like Wikileaks, payments from foreign nations to people residing in the US, etc.
• It makes it a lot easier to avoid paying taxes, both on a person’s crypto gains, but also for any other kind of illicit income: converting that income into bitcoin gives the tax dodger a powerful way to keep their income “off the grid.” It also makes it easier to move money out of the country, which is highly undesirable for certain governments such as China.
• The government is used to being able to reach into a person’s US bank account and freezing it or taking the money. If you lose a court judgement to the IRS, or even in a civil suit (such as failure to pay child support), the government might as well own your money, because Chase or Citi is certainly not going to tell them they can’t touch the money because it belongs to you. With bitcoin, if it is stored on a paper wallet that is kept secret, there is no way for the government or anyone else to extract it from you (except through torture or other extremely coercive means).
• Governments like being able to agree with each other through the United Nations and other organizations that certain other countries should be treated as economic pariahs. Since this is generally implemented through banking regulations, it is easily circumvented through the use of bitcoin.

So, governments have a lot to lose, so it’s no wonder they generally hate bitcoin. Indeed, it is actually quite extraordinary just how permissive the US government has been, to the point of allowing bitcoin futures contracts to trade in the public markets.

So what happens when government starts to crack down?

First of all, it’s important to remember that bitcoin is global. Unless every big country in the world is able to coordinate on a unified, comprehensive crackdown on crypto, the prohibited activity will tend to just move to where it is legal. So South Korea can try to ban crypto, but if investors in South Korea still have access to exchanges in the US or Japan, then it’s very difficult to enforce.

Furthermore, if someone already owns bitcoin or other crypto in a paper wallet, then the government is in one of two positions:

There is a paper trail:

Assuming the person bought the crypto from an exchange, and the exchange followed the legal requirements for KYC/AML (e.g., getting a name, phone, address, passport scan, driver’s license scan, etc) then all of those transactions are available to the government.

• Whether the government is currently getting those records, as in the case of Coinbase versus the IRS, is another matter, but one should assume that all of that information is available).
• Even if the person subsequently sends the crypto to another address (say, a paper wallet), there is some real degree of personal accountability.

The coins are “off the grid”:

We already discussed earlier how one might go about getting off-grid coins through mining them or purchasing them for cash from a stranger on Craigslist. Obviously there are many more ways; for example, a criminal could steal cars and receive payment in bitcoin from the fence.

What are the options of the government in this scenario? In short, they don’t really have many! It’s not hard to see why: you can’t control what you don’t know about!

Governments tend to avoid making new laws and regulations when they know they have no way of enforcing them (although this is pretty rare, since they can enforce a lot!), since it undermines the rule of law and can lead to a general erosion of respect for authority if laws are being openly flouted with impunity.

The implication here is that government regulations in the crypto space are much more likely to take place at the level of exchanges, rather than the direct targeting of individual citizens, similar to how police usually go after prostitution rings rather than targeting the individual Johns. This isn’t at all surprising though, since the main vulnerabilities to a decentralized system will always be those “centralized bottlenecks” like exchanges.

By targeting exchanges, where the bulk of the fiat-to-crypto volume is occurring, governments can cut off much of the flow of capital into crypto — at least temporarily. Needless to say, such an intervention would be devastating to the bitcoin price.

From the Ashes

But eventually — once the last, panicked sellers dump their coins before they are locked out of their exchange accounts — the bitcoin market will begin to clear again, and we will be back in a similar situation to the early days of bitcoin, when it was largely an over-the-counter market with no centralized exchanges.

In time, the supply/demand situation for bitcoin would stabilize enough for the positive price characteristic of bitcoin to re-emerge: the usefulness (despite being illegal, bitcoin won’t become less useful for some segment of the population) and the scarcity will lead to the price going up, especially in any markets where it remains perfectly legal.

It’s not unreasonable to suppose that people will take notice of the resurgent price and be tempted to participate, despite the lack of an easy-to-use service such as Coinbase or the fear of legal consequences. After all, we have a pretty good analog to bitcoin in the form of illicit drugs. Despite making it a top priority for the country and spending billions of dollars, drugs continue to be readily available in every major city in America.

Indeed, drugs are a potentially instructive example in understanding the price implications of a widespread legal crackdown on bitcoin. Most observers would conclude that a bitcoin crackdown would cause the price to crash, and this is likely true in the short run because it would create a large and sudden change in the supply/demand balance.

But after some time to adjust to the new equilibrium, it’s not so hard to believe that bitcoin could rise to even higher price levels. Why? Ask yourself what happens to drug prices when drugs are made illegal. It’s simple — they go up! And what happens when drugs are suddenly made legal? Recent history suggests that, while legalization may lead to higher unit volumes and revenues, it has a decidedly negative impact on unit price, which is what we care about here since bitcoin volume (i.e., inflation) is fixed/limited.

There is another option to consider as well, and that is the advent of decentralized exchanges. While there have been some important strides in creating true decentralized exchanges, these are currently not competitive with centralized exchanges in terms of speed, liquidity, fees, etc. But in a world where all centralized exchanges are made illegal and shut down, they will seem very attractive compared to the alternatives.

The issue with decentralized exchanges that makes this only a partial remedy to a government crackdown is that they only really work for crypto-currencies: there is no mechanism to include Dollars or Yen, since this requires cooperation with regulated banks. But they do make crypto regulation a cat-and-mouse game, where each new crypto must be banned, and offenders can easily convert to the new coin that is unknown to the authorities.

Clearly, government regulation poses the single greatest risk to the future of bitcoin. Luckily, major governments have already allowed the space to grow to such a large degree that there are now many crypto advocates with vast fortunes who will be trying hard to protect crypto from government intrusion. It also doesn’t hurt that many Silicon Valley darlings, from venture capital shops to startups, are embracing crypto now.

But even if that’s not enough to stop the government from cracking down, it’s critical to remember that there are serious limits to what any government can do to regulate crypto.The genie is out of the bottle, and it’s a genie that was brilliantly engineered to be impossible to control, let alone to get back into a bottle!

The End

Thanks for reading! If you have any questions or comments, I will be reading the comments on Medium and will try to respond to everyone.