Getting strangers who do not trust each other to agree on a single truth, with no arbiter and over a channel where messages get lost or forged, is a problem decades old. Bitcoin solves it, and its value lies there.
A problem, before a currency
Bitcoin is almost always discussed for what makes it controversial: the price going up and down, the freedom it promises or the energy it consumes, the economic, monetary, geopolitical implications. Legitimate topics, but here they stay outside the door. Because beneath the currency there is something different and just as interesting: a problem that for decades was held, in that form, to have no solution. And Bitcoin, before being a currency, is the answer to that problem.
In this telling, it is worth starting there, from the problem, and getting to the currency only at the end. Because it is by looking at the problem that one sees where the value of this technology really lies.
There is no shortage of lenses to read it through, each with its own consequences: the libertarian and cypherpunk one, the economic one, the monetary one, the geopolitical one. All legitimate, and each catches something true. But they come later, and they stand only if they rest on what precedes them: the technology, and the problem it solves. Forming an opinion about the implications without having understood the mechanism means building it on a foundation never examined.
Let it be said plainly: Bitcoin, the protocol and not the token, cannot be understood in passing. It demands study, time, attention, and a gaze at once critical and open, as far from the faith of those who treat it as a bet as from the dismissal of those who write it off without ever having read it. The journey through everything this technology has since set in motion is too long and varied for a single piece of writing, and it has only a glancing connection with "cryptocurrencies". What matters here is the starting point: to understand Bitcoin, one can start here.
The generals around the city
The problem has a name that sounds like it came out of a tale: the Byzantine generals problem. The scene is this. Several armies surround a city, each with its own general, camped on different slopes. They can win on one condition only: attacking all together, at the same moment. If a few attack while the others retreat, they are driven back and lose.
So they must agree on one single thing: attack at dawn, or retreat. But there is no commander-in-chief; no one has the authority to impose the decision on the others. And the only way to communicate is to send messengers on horseback, who must cross enemy territory to reach the other camp. A messenger can be captured; the message can get lost along the way, arrive late, even arrive altered.
It gets worse. Some of the generals might be traitors. A traitor does not merely fail to cooperate: he can send "attack" to half of the allies and "retreat" to the other half, on purpose, to split the front and make everyone lose. From the outside he is indistinguishable from an honest general.
The question is blunt: can the loyal generals reach a common decision, despite the unreliable messages and the traitors among them?
The same problem, everywhere
Strip away the scenery of the armies and a pure problem remains, and a surprisingly common one. Whenever many parties that do not trust one another must agree on a single version of the facts, without an arbiter they all accept and over a channel where messages can get lost or forged, they fall back into the same problem as the generals.
It is not a picturesque metaphor: it is a precise problem, studied by computer science since the early 1980s, and it has carried that very name ever since. It concerns anyone who must keep a shared, truthful ledger among parties that have no reason to believe one another. Who owns what. Who spoke first. Which of two conflicting versions is the true one. All questions taken for granted only because, usually, they are delegated to someone.
The shortcut: an arbiter to trust
The solution society has always used is one and the same: putting in the middle a third party everyone trusts. A bank keeps the ledger of who has how much. A notary certifies. A central server holds the one good copy and has the final word. It works, and it works well.
But looked at closely, this solution does not solve the problem: it goes around it. It does not overcome distrust, it delegates it. The generals have not reached an agreement among themselves; they have simply accepted a king who decides for everyone. And that king has a cost. He can err, he can be corrupted, he can decide who is in and who is out, he can be unreachable the day he is needed. All the trust that peers do not exchange among themselves ends up concentrated in a single point, which also becomes the single point where everything can break.
And yet computer science had found a solution without an arbiter: protocols have existed for decades that let the loyal generals reach agreement, provided the traitors are not too many. But they all rest on the same condition: the participants are known and counted in advance, each with an identity, and the truth emerges by putting the honest in the majority. On an open, anonymous network that condition collapses: if joining costs nothing, anyone can show up with a thousand identities of convenience and win any count single-handedly. Among anonymous parties counting heads is useless, because heads can be manufactured. This is why, in that form, the problem was long considered unsolvable: trust could be moved around, not removed.
Bitcoin's move: making lies expensive
In 2008 a different answer arrives. The idea, stripped to the bone, is elegant: if the problem is that no messenger and no identity can be trusted, then the agreement is made to depend not on who is speaking but on something that cannot be faked cheaply. That something is work: a new name costs nothing; work does.
To add a page to the shared ledger it is not enough to declare it: real work must be spent, a large amount of computation, like brute-forcing a puzzle that costs time and energy. Once the effort has been made, anyone can verify in an instant that it has been made. And everyone follows a single rule: the valid history is the one carrying the most accumulated work.
From here everything follows. To rewrite the past, to make a false version believed, a traitor would have to redo all that work and, on top of that, outrun everyone else combined. It would cost him more than he could gain. The certainty born of this is not that of a theorem, which forbids once and for all: it is a cost barrier, and every added page raises it. So lying is not forbidden: it is made unprofitable. Behaving honestly becomes the cheapest strategy.
There is a detail in this construction that gives back more than it seems to. Every page carries within it the fingerprint of the previous one: the ledger is not a pile of sheets, it is a chain with a direction, and a page cannot be slipped out or wedged in without redoing all the work that comes after it. So the agreement does not only fix who owns what: it fixes what comes before and what comes after. Not a clock that tells the hours, but an arrow that puts events in line; and the question "who spoke first" is answered by construction. Not by chance, in the earliest code the chain was called the time chain, and in the nine pages that introduced Bitcoin to the world the word blockchain never appears: what appears instead, from the abstract onward, is a distributed timestamp server.
There is no commander-in-chief, there is no messenger to trust, there is no need to know who the other generals are or to call the roll of the honest. The chain with the most work behind it is the agreement. And this is the true efficiency: a problem that seemed to have no way out turned into a simple economic rule, where incentives do by themselves the work that once fell to a central authority. What stands watch is not a king; it is self-interest.
There is one more layer, beneath the self-interest. The work spent is not the value itself: it is what ties the agreement to something physical. The information written in the ledger carries weight because it cost energy, and it is that cost that makes it hard to rewrite. Where there seems to be trust, on a closer look, there is energy. That information has a physical weight is not Bitcoin's invention: it is a fact of nature, and it deserves a discussion of its own.
Two dilemmas that brush against each other
It is worth pausing for a moment, because at this point two different problems risk overlapping. They are distinct, and they must be kept apart.
The prisoner's dilemma. Two accomplices end up in handcuffs and are questioned in separate cells, unable to talk to each other. Each is offered the same deal: whoever accuses the other gets the lighter sentence. If both keep silent, they get off lightly; if one accuses and the other keeps silent, the accuser walks free and the silent one pays for both; if they accuse each other, they both pay dearly, more than they would have paid by keeping silent together, but less than the one who keeps silent alone. Do the arithmetic: for each of them, whatever the other does, accusing always pays a little more than keeping silent. Each reasoning for himself, they betray each other and both lose, knowing perfectly well how things stand. The information is complete; what is missing is the payoff for cooperating. It is a problem of will.
Game theory, which has made this dilemma its textbook example, gives precise names to its outcomes. The outcome in which both accuse is a Nash equilibrium: neither of the two, changing his move alone, would improve his lot, and for this reason it is the stable outcome, the one the game settles into by itself. The outcome in which both keep silent is instead a Pareto optimum: there is no other that improves one's position without worsening the other's. They are two different measures, and nothing says they agree: the equilibrium says what holds, not what serves everyone; the optimum says what would serve everyone, not what holds. The whole dilemma lies in this gap: the only stable outcome is the worst one, and the good one does not stand on its own, because each has an incentive to slip out of it.
The Byzantine generals. They are the ones from before: many allies who already want the same thing, to win together, yet cannot agree on a single move because the channel loses or alters messages and someone lies on purpose. The common will is already there; what is missing is reliable information to agree upon. It is a problem of truth.
The difference that matters is not how many the protagonists are, but what is missing: there, the incentive; here, the certainty. One asks why to cooperate; the other, on what.
There is also a difference of origin, and it is worth stating because it helps keep them apart. The prisoner's dilemma is a classic object of game theory: rational players, a stake, a choice that pays or does not. The generals problem was born elsewhere, in the computer science of distributed systems, where traitors are not players chasing a payoff but faults assumed to do, in the worst case, any damage whatsoever. Two disciplines long kept separate. And it is at the exact point where they meet that Bitcoin's move sits: making honesty the rational choice shifts the generals problem from the terrain of faults to that of incentives, that is, into game theory.
Above all, the two must not be confused because, in the story of Bitcoin, they enter at two different moments and in this order:
- The starting problem is the generals. Bitcoin faces a question of truth: getting many strangers to agree on a single ledger, despite the unreliable channel and the liars.
- The move is converting it into incentives. Classical solutions make the truth emerge by counting the honest and putting them in the majority, but among anonymous parties, as seen above, the count does not hold. Bitcoin counts no one: it shifts the question from "who is telling the truth?" to "who profits from lying?".
- At that point it is a prisoner's dilemma, but a rigged one. Among selfish strangers cheating would be the individually convenient move, the usual trap. Bitcoin rewrites its payoff matrix: with work to be spent and a reward for following the rules, cooperating becomes the choice that pays for the individual. In the terms introduced earlier: the Nash equilibrium is shifted onto the good outcome, and what is stable and what is desirable come to coincide. The dilemma is not won, it is defused: change the payoffs, and it is no longer a dilemma.
In this move there is also an underlying preference, and it says much about the design. Among anonymous strangers only what sustains itself counts: an optimum that is not also an equilibrium is a hope, not an agreement, because the first one to deviate undoes it. This is why the protocol never asks participants to choose the outcome best for everyone: it works so that the outcome best for everyone is the one each chooses for himself. And when stability and efficiency cannot be had together, the choice falls on stability.
Here too, though, the earlier caution applies: it is a cost barrier, not a theorem. The literature has put it to the test. In 2014 Eyal and Sirer showed that a group of miners, as the actors who supply the computing power and do the labor of adding pages to the ledger are called, holding a large enough fraction of the total (under certain conditions a third is enough, in theory even less) could earn more than its share by deviating from the intended strategy: withholding the blocks it finds and publishing them at the right moment to make the others' work worthless, a strategy known as selfish mining. Strictly speaking, then, honesty is not an exact Nash equilibrium under every condition: it is one as long as no one concentrates too much power, which is the same condition everything else depends on. The design does not promise that cheating is impossible; it makes cheating costly enough, and unrewarding enough, that for almost everyone, almost always, it is not worth the trouble.
So the two brush against each other without overlapping. The generals are the problem Bitcoin inherits; the prisoner's dilemma is the form into which it translates it in order to untie it. The group's agreement is not born of good will, but of the fact that, for each one, following the rules pays more than breaking them.
Where the value really lies
Usually Bitcoin is measured by the price of its token. But if for a moment one removes the price, and with it all the discussions that stay outside here, what remains is the thing that was actually invented: a way to get strangers who do not trust each other to agree on a single truth, with no one in command and over a channel no one controls.
For the first time, and at scale, trust was manufactured where there was none, without having to entrust it to a third party. The Byzantine generals problem, in its most hostile form, the one among anonymous parties that cannot believe one another, has stopped being unsolvable.
Money is only the first application of this capability, the most visible and the most talked about. After all, the nine pages that introduced it to the world are titled "Bitcoin: A Peer-to-Peer Electronic Cash System": there is no hiding that this is the end it was conceived and built for. But the value, the one resting at the bottom, is in the problem the protocol solved: if space on that ledger is precious, it is precisely because of this; if the token that buys that space and changes hands is worth anything, it is precisely because of this.
Before closing, an honest objection must be faced. The ledger is software, and software can be copied: anyone can open another one tomorrow morning, with freshly minted tokens. It can be done, and it has been. But the copy takes the rules, not the agreement: a newborn ledger has behind it neither the accumulated work nor, above all, the strangers who treat it as the one version of the facts. And an agreement of this kind is worth something precisely because it is one: scattering across many ledgers means going back to the starting problem, many truths and none, and it pays none of the participants. The same holds for the rules of the game, including the one that fixes once and for all how many tokens will ever exist: scarcity is not someone's promise, it is written into the protocol, and whoever rewrites that line does not change the agreement, they leave it, ending up on a ledger of their own with the burden of convincing everyone else to follow. The convenience that guards the ledger's past also guards its oneness and its rules.
There is one last thing to note, and it is the very way this piece has arrived here. This telling has described the foundations of the protocol, the framing, the principles, without touching a line of cryptography, of mathematics, of engineering detail. That is not a gap: it is a confirmation. Bitcoin is first of all a design, an arrangement of rules that hold with no one to enforce them, rules without rulers, as a formula dear to those who study it goes. The technical details all matter, and they deserve the study spoken of above; but they serve the design, and the design can be approached, as was done here, without starting from them.
What remains is trust made possible among those who do not trust. Everything else, including the implications left untouched here, comes after, and starts from there.
References
- Leslie Lamport, Robert Shostak, Marshall Pease, "The Byzantine Generals Problem", ACM Transactions on Programming Languages and Systems, vol. 4, no. 3, 1982, pp. 382–401.
- Satoshi Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System", 2008.
- Satoshi Nakamoto, pre-release Bitcoin source code, November 2008, published by Ray Dillinger ("Cryddit"), "Bitcoin source from November 2008", BitcoinTalk, December 23, 2013.
- Merrill Flood, Melvin Dresher, formalization of the prisoner's dilemma, RAND Corporation, 1950; formulation and name due to Albert W. Tucker.
- John F. Nash, "Equilibrium Points in n-Person Games", Proceedings of the National Academy of Sciences, vol. 36, no. 1, 1950, pp. 48–49.
- Vilfredo Pareto, Manuale di economia politica con una introduzione alla scienza sociale, Società Editrice Libraria, Milan, 1906.
- Ittay Eyal, Emin Gün Sirer, "Majority is not Enough: Bitcoin Mining is Vulnerable", Financial Cryptography and Data Security (FC 2014), Lecture Notes in Computer Science, vol. 8437, Springer, 2014, pp. 436–454.
- Amitanand S. Aiyer, Lorenzo Alvisi, Allen Clement, Mike Dahlin, Jean-Philippe Martin, Carl Porth, "BAR Fault Tolerance for Cooperative Services", Proceedings of the 20th ACM Symposium on Operating Systems Principles (SOSP), 2005.