ESSAYS ON ISSUES THE FEDERAL RESERVE BANK DECEMBER 2013 OF CHICAGO NUMBER 317

Chicag­o Fed Letter

Bitcoin: A primer by François R. Velde, senior economist

Bitcoin is a digital currency that was launched in 2009, and it has attracted much attention recently. This article reviews the mechanics of the currency and offers some thoughts on its characteristics.

In this Chicago Fed Letter, I explain the claims on some individual or entity digital currency called bitcoin. The cur- transferred between buyer and seller. rent number of bitcoin units is around Nowadays in the United States, base 11.8 million; and, unlike physical money takes the physical form of coins coins, they are divisible to the eighth (tokens issued by the United States Mint decimal place. Bitcoins are traded on under authority of Congress) and notes various online exchanges for other (which used to be circulating claims currencies. At the time of this writing, on the Federal Reserve but are now in the average worth of a bitcoin over the the nature of paper tokens), as well as previous six months had been a little the electronic form of reserves, which over $100. Thus, the total balances held are claims held on the books of the in the form of bitcoins stood at around Federal Reserve by depository institu- $1 billion, compared with $1,200 bil- tions (claims to notes and coins). lion circulating in U.S. currency. There Bitcoin is an elegant Bitcoin is not a claim to a physical object are on average about 30 bitcoin trans- or to a currency; it aims to be itself a implementation of a digital actions per minute (Visa transactions currency and replace the physical ob- currency, but can it truly rival average 200,000 per minute). The ject with a computer file. When a phys- average bitcoin transaction size is about or replace existing currencies? ical object is exchanged, there is little 16, i.e., on the order of $2,000 (the doubt that the giver owns it and the average Visa transaction is about $80). recipient receives it (whether the ob- Bitcoin is thus a relatively small phe- ject is what it seems to be—and not a nomenon, but it has been growing; the counterfeit—has always been a problem value of a bitcoin has increased tenfold for money, but one that is mitigated in since early 2013.1 a variety of ways). A digital file is easily What precisely is digital money? created and duplicated, so how do we avoid doubts about its authenticity as Money is a medium of exchange— currency? The solution is basically re- something that is accepted in exchange cursive. Assume that my ownership of for a valuable good or service, not for the file is ascertained. The bitcoin itself but to be exchanged later for protocol ensures that the transaction another good or service. For thousands by which I cede ownership of the bitcoin of years that medium has taken the form is validated by adding it to a record of of a physical object whose supply is scarce, all transactions. The recipient’s owner- either naturally (precious metals) or ship is now validated. artificially (a token issued by a monop- olist). But it has taken more disembod- A simple method of validating the trans- ied forms as well, such as enforceable action would be to entrust a central record of the transactions to an au- which is costly to extract from the earth, and attributes them to the miner. The thority—as medieval merchants did when “proves” that Ann did not counterfeit first miner to find a solution broadcasts they paid each other by transferring the coin, but this will work only if it is it to the other miners, who verify it. Once sums on a bank’s books or as modern reasonably easy for Bob to check the verified (i.e., accepted by the majority banks do when they settle their trans- gold content. Bitcoin requires a similar of other nodes), the new block is added actions on the books of the Fed. Bitcoin, “proof of work” from the miners, in the to the chain. The fortunate miner now however, does not rely on a single record- following way: A valid addition to the possesses N new bitcoins as a reward keeper. It solves the two challenges of block chain must include the solution to for the effort expended. controlling the creation of a unit of digi- a difficult mathematical problem, which Part of the bitcoin protocol regulates tal currency and avoiding its duplication is costly to find (in terms of computer the values of N and α over time. The difficultyα is adjusted every two weeks so as to keep the rate at which blocks Bitcoin solves two challenges of digital money—controlling are added to six times per hour. Thus, its creation and avoiding its duplication—at once. if more miners join the network or if computing power improves, the diffi- culty increases. The size of the reward at once. Validation is difficult to do, and hardware required, electricity consumed, N was initially 50, and it is halved every those who do it are rewarded for doing and time expended). The problem is 210,000 blocks (i.e., every four years at so by being allowed to create new bitcoins difficult to solve, but the solution is easy the rate of six blocks per hour). This 2 in a controlled way. to verify, as it is difficult to factorize a implies that the total number of bitcoins very large number but easy to verify that in existence will approach but never Creation/validation details a proposed factorization is correct. exceed 2 × 50 × 210,000 = 21 million; Now, to further explain how this process Moreover, the problem is not arbitrary moreover, this time path will be inde- works, I have to be more technical and or irrelevant, but tied to the verification pendent of the size or computing pow- more precise. Consider the following of transactions. er of the bitcoin network. With time, scenario: Ann is the owner of a bitcoin— A final technical concept is needed. A mining becomes unprofitable, but an i.e., a string of zeros and ones whose pre- hash function maps text or numbers of additional incentive is provided to min- cise nature will become clear—stored arbitrary length into a number of fixed ers: Users can offer to pay a transaction in a “wallet” (essentially, an encrypted length. For instance, taking the first fee to ensure inclusion of the transaction computer file), managed by an appli- letter of a word (or summing the digits in the next block successfully added to cation that she has installed on a com- of a number and summing the digits of the block chain; this fee will be allocated puting device. She wants to cede the the result until a single digit is obtained) to the miner who adds that block. bitcoin to Bob, who also has a wallet, maps any word (or number) to a hash managed by an application. The two So, the bitcoin protocol provides an of length one. The problem that miners applications carry out the transaction elegant solution to the problem of solve is roughly the following: Let block (ensuring its safety through the use of creating a digital currency—i.e., how to chain be x, let the proposed added block public and private keys—essentially, a regulate its issue, defeat counterfeiting be y, and let an additional number be way to send someone a padlock with and double-spending, and ensure that it n. The goal is to findn such that the which to lock the item before it’s sent can be conveyed safely—without relying resulting hash function, f (x, y, n), is less while keeping the key to unlock the on a single authority. What, in the end, than a set value α. The hash function is padlock). At this point, the application is this new currency? It is a list of autho- deterministic but so complex that the broadcasts a message to a large network rized transactions, beginning with the output seems random. It is therefore of nodes on the Internet, announcing creation of the unit by a miner and end- nearly impossible to guess n, and the the proposed transaction between Ann ing with the current owner. The currency only reliable method is to try out many and Bob (more precisely, between Ann’s can be exchanged because all potential different values of n (using much com- wallet and Bob’s wallet, each identified recipients have the means to verify past puting power) until the condition is by its public key). Every ten minutes, the transactions and validate new ones, and satisfied. Moreover, the lower the value nodes, called “miners,” gather up the one’s ownership rests on the consensus of α, the harder it is to satisfy the con- 3 proposed transactions that were recently of the nodes. dition. A proposed solution (x, y, n), how- broadcast and attempt to add them to ever, can easily be verified. Part of finding Bitcoin is a fiduciary currency the “block chain,” or the universal led- n involves verifying that no bitcoin trans- ger of bitcoin transactions. Fiduciary currencies—in contrast with acted in the block y has already been commodity-based currencies (such as The key to preventing falsification of spent in the block chain x. gold coins or bank notes redeemable in the block chain is to make the additions The code allows each miner to include gold)—have no intrinsic value, and de- costly. Think of Ann and Bob exchang- in the block y a particular type of trans- rive their value in exchange either from ing a gold coin; the coin’s gold content, action, one which creates N new bitcoins government fiat or from the belief that they may be accepted by someone else. which is both its most ambitious feature concerned itself with money because They are inherently fragile; government and its main vulnerability. The confir- one main function of money is to free orders can be ignored or doubted, and mation that the bitcoin is not being spent a debtor from his or her obligations, a currency that has value only because twice must await validation by the net- tying money to an essential state func- of the belief that it will have value may work, requiring at least ten minutes (al- tion, the administration of justice. have no value at all (for instance, if I though confirmation might be skipped That is why the U.S. Constitution gives believe that no one will accept it, I will for small transactions). Moreover, there Congress the power “to coin Money, reg- not accept it either). have been a few instances of “forks,” mo- ulate the Value thereof, and of foreign ments when part of the network accepted Coin, and fix the Standard of Weights The term “mining” may lead one to one new block as valid while another and Measures.” Bitcoin is free of the think that bitcoin is not fiduciary. It part rejected it and accepted a different power of the state, but it is also outside is true that real resources (computing block. These incidents happened for the protection of the state. How likely hardware and energy) are expended accidental reasons, but a fork could some- is bitcoin to remain so if it gains wide in creating bitcoins. Since entry to min- day be the result of malicious action. It acceptance and the incentives to hijack ing is free, the value of these resources is generally thought that it would be too it grow accordingly? will be the market value of bitcoins pro- expensive for a single malicious user duced (whose number per day does (or group of malicious users) to take Fraud concerns not depend on the size of the network). over more than half of the network; To the extent that the motivations of But once created, the bitcoin has no but if bitcoin were to grow significantly bitcoin’s founder, Satoshi Nakamoto, can value other than in exchange, contrary in value, this calculation could change. be discerned from his original paper, to a gold coin. they revolved around transaction costs, One well-known fork that emerged in which he argued would arise mostly from Bitcoin’s viability as currency March 2013 was due to nodes using two the need to preclude fraud. His proposal Can bitcoin truly rival or even replace different versions of the bitcoin proto- was for a low-cost secure payment system existing currencies—particularly in the col.4 This incident reminds us that the that did not involve a central authority form of cash? A dollar bill in my hand bitcoin protocol is based on open-source or “trusted third party.” The resulting cannot be anywhere else at the same software. Bitcoin is what bitcoin users invention of a state-independent unit time, my ownership of it is undoubted, use. The general principles of bitcoin of value is remarkable but perhaps co- and it can be exchanged immediately and its early versions are attributed to an incidental. Much of the interest in bit- and finally. The many ingenious features otherwise unknown Satoshi Nakamoto;5 coin is inspired by the ideas of Friedrich of bitcoin try to emulate these properties improvements, bug fixes, and repairs Hayek,6 that money should cease to be of cash, but do so at some costs. One have since been carried out by the com- prominent cost is the loss of anonymity. munity of bitcoin users, dominated by Possession of the virtual currency must a small set of programmers. Although Charles L. Evans, President ; Daniel G. Sullivan, be linked to the unique identifier of some of the enthusiasm for bitcoin is Executive Vice President and Director of Research; Spencer Krane, Senior Vice President and Economic the wallet. Admittedly, there is no limit driven by a distrust of state-issued cur- Advisor ; David Marshall, Senior Vice President, financial on the number of wallets one can own rency, it is hard to imagine a world where markets group ; Daniel Aaronson, Vice President, and there are ways to make the wallet the main currency is based on an ex- microeconomic policy research; Jonas D. M. Fisher, Vice President, macroeconomic policy research; Richard hard to trace back to its owner, but these tremely complex code understood by Heckinger,Vice President, markets team; Anna L. require additional efforts. Another cost only a few and controlled by even few- Paulson, Vice President, finance team; William A. Testa, Vice President, regional programs, and Economics Editor ; of using bitcoin is in the speed of the er, without accountability, arbitration, Helen O’D. Koshy and Han Y. Choi, Editors ; transaction. At a minimum, one must or recourse. Rita Molloy and Julia Baker, Production Editors ; wait ten minutes for the proposed trans- Sheila A. Mangler, Editorial Assistant. action to be included in the block chain, The role of the state Chicago Fed Letter is published by the Economic Research Department of the Federal Reserve Bank and for large amounts it is customary A fiduciary currency like bitcoin is use- of Chicago. The views expressed are the authors’ to wait for six blocks, or one hour. These ful only insofar as others accept it broadly. and do not necessarily reflect the views of the Federal Reserve Bank of Chicago or the Federal times are much slower than those to com- As a matter of theory, this broad accep- Reserve System. plete electronic retail transactions in most tance need not rely on the state, and © 2013 Federal Reserve Bank of Chicago other currencies (e.g., a few seconds to history certainly offers several examples Chicago Fed Letter articles may be reproduced in charge a credit card either online or at of currencies used without state support, whole or in part, provided the articles are not reproduced or distributed for commercial gain a physical retail location), not to mention oftentimes because the state-sponsored and provided the source is appropriately credited. the times to make large financial trans- currency was proving deficient. But Prior written permission must be obtained for any other reproduction, distribution, republica- actions on standard networks. throughout most of Western history, tion, or creation of derivative works of Chicago Fed the state has involved itself in money. Letter articles. To request permission, please contact Why this delay to complete bitcoin trans- At a minimum, the state has used money Helen Koshy, senior editor, at 312-322-5830 or actions? It is rooted in the decentralized email [email protected]. Chicago Fed as a coordinating device, usually sup- nature of the bitcoin network (and its Letter and other Bank publications are available porting its value by accepting it in the at www.chicagofed.org. reliance on a sort of majority voting), payment of taxes. The state has also ISSN 0895-0164 a state monopoly and its production of its first-mover advantage, and Hayek systems, particularly for those who have should be left to the competitive private did not address whether currency is a no strong desire to avoid them in the sector. The linkage is misguided. Bitcoin natural monopoly. first place. Nor does it truly embody is indeed free from government (so far) what Hayek and others in the “Austrian but has turned out unlike anything Conclusion School of Economics” proposed. Should Hayek imagined. It is not issued by a So far, the uses of bitcoin as a medium of bitcoin become widely accepted, it is un- private enterprise operating in a com- exchange appear limited, particularly likely that it will remain free of govern- petitive environment, disciplined by the if one excludes illegal activities. It has ment intervention, if only because the market to maintain the stable value of been used as a means to transfer funds governance of the bitcoin code and net- its currency. The bitcoin network is an outside of traditional and regulated work is opaque and vulnerable. That said, automaton, issuing currency at a pre- channels and, presumably, as a specu- it represents a remarkable conceptual and dictable rate, perfectly incapable of pro- lative investment opportunity. People technical achievement, which may well viding “good money” in Hayek’s sense, bet on bitcoin because it may develop be used by existing financial institutions i.e., a currency of stable value. It has, into a full-fledged currency. Some of (which could issue their own bitcoins) moreover, a status of quasi-monopoly in bitcoin’s features make it less convenient or even by governments themselves. the realm of digital currencies by virtue than existing currencies and payment

1 Author’s calculations based data from the 3 Note the difference with the concept of 4 For details, see http://bitcoin.org/en/ Board of Governors of the Federal Reserve “money is memory” of Minneapolis Fed alert/2013-03-11-chain-fork. President Narayana Kocherlakota; in his System, H.4.1 statistical release; Visa fact 5 Nakamoto’s original paper providing model, money embodies information about sheet (http://corporate.visa.com/_media/ bitcoin’s specifications is available at the content of past transactions—not only visa-fact-sheet.pdf); and Bitcoincharts http://bitcoin.org/bitcoin.pdf. (www.bitcoincharts.com). the identity of the parties, but also what was exchanged. See www.minneapolisfed.org/ 6 See F. Hayek, 1976, Denationalisation of Money, 2 To factorize a number means to express it research/sr/sr218.pdf. London: Institute of Economic Affairs. as a product of prime numbers.