Bitcoin and anonymous markets: the real revolution in market design


Make no mistake we are witnessing a revolution in economics. Developments in market design are changing the way people interact in the presence of scarce resources and will undoubtably influence the way we think about economics. This is an economic revolution that has been directed by scholarly endeavours, is being driven by the revolutionary zeal of a large number of talented individuals, and has been sustained by the obvious propensity to decentralisation of novel economic systems that are unencumbered by traditional social stratification.

The ideas underpinning the revolution do not seem to have been greatly influenced by the works of professional (academic)  economists. By the by, professional economists have been tangentially engaged as witnesses to this revolution.  I don’t fully understand why this has been the case. A year ago, economics, through the Nobel Memorial Prize in Economics, celebrated its own important achievements in market design, arguably ignoring the greatest achievements in the area: the design of a decentralised fiat currency, its implementation in the Bitcoin currency network, and the emerging ideas underpinning distributed networks featuring anonymous markets for the exchange of goods and services.

In this post I’ll talk about the implementation of the Bitcoin fiat-money and a challenge facing the emergence of  anonymous markets for real goods and services.

The development of crypto-currency and its implementation in Bitcoin can be traced to a number of working papers. The Bitcoin network is a distributed method for storing and verifying transaction history. Essentially it is a decentralised way for preventing double spending of currency by remembering certain details of transactions. In the same year (1998) that Narayana Kocherlakota published his economic theory paper “Money is Memory,”  Wei Dai described an anonymous electronic cash system that he called “b-money,” and Nick Szabo developed his bit-gold system. Both of the latter proposals influenced the theoretical design of Bitcoin, which in a sense implements Kocherlakota’s ideas regarding money. Obviously motivated by the financial crises (indeed the Chancellor of the Exchequer’s  response to the collapse of banks)  the anonymous, now probably very rich, Satoshi Nakamoto published his working paper “A Peer-to-Peer Electronic Cash System” which was rapidly coded in January 2009.  One Bitcoin today is worth around $520 USD:



The main innovation in the Bitcoin decentralised currency system is the network of miners. This is a robust mechanism for governing the Bitcoin network. The mining network plays the role of a decentralised “central” bank, public record keeper, and may eventually have a regulatory role. The network of miners is setup with the idea that anyone can be a miner, but mining is costly, and you get as many votes on the mining “board” as the  amount [of CPU power] that you have invested into mining.

One role of mining in the network is to record transactions between Bitcoin users. Mining is the decentralised memory mechanism for Bitcoins. Transactions between individual Btcoin users are broadcast to the all the network. The broadcasts are recorded by the miners who must solve a computationally difficult problem, with easily verifiable solution, to be able to add records to Bitcoin’s public ledger of transactions (block chain). The successful miner is paid a transaction fee for recording transactions.

The number of Bitcoins in existence will never exceed 21 million. At present the total number of Bitcoins in circulation is around 12 million. Mining (record keeping) also increases the quantity of Bitcoins overtime. In addition to a transaction fee the successful miner is payed a subsidy of new Bitcoins. The marginal cost of “mining” these new Bitcoins is exponentially increasing in time, but given the exponential growth in the dollar value of Bitcoins the dollar profit of mining a Bitcoin seems to be stable. This is not unexpected since presumably the exchange rate of a Bitcoins cannot be greater than the dollar marginal cost of mining it. If it is less than the marginal cost of mining the Bitcoin, then a deflationary process makes mining more lucrative [attrition may effectively decrease supply, for instance neglected wallets or an owner of Bitcoins forgets their password or dies without revealing the password for their wallet or the FBI confiscates a Bitcoins wallet-password.]  As far as I can tell from reading the marginal cost of mining Bitcoins presently is comfortably between $500 and $600, so I don’t expect dramatic increases in the USD value of Bitcoins.*

The Bitcoin public ledger records the history of all transactions. However, transactions in Bitcoins are essentially anonymous. These transactions are made between Bitcoin wallets and a user may generate as many Bitcoin wallets as they need, which is usually done anonymously. The public ledger of transactions records all the transactions made by all wallets and the balance in each wallet is calculated accordingly. A problem for anonymity only arises if a real name is associated with a wallet, for instance if you bought Bitcoins with a dollar-credit card. There are a number of relatively simple solutions for this problem. The easiest of these is to deposit your Bitcoins from the known wallet into a shared wallet (a Bitcoin bank) and then withdraw into a number of new anonymously generated wallets.

Though Bitcoin is by now a mature system that is increasingly well understood, the pressing theoretical challenge is in the development of a decentralised market place for real goods. Presently, the marketplaces that use Bitcoin are centralised in the sense of being owned by a guarantor. In these marketplaces anonymous sellers advertise their goods, the anonymous buyers buy the goods using Bitcoins, and the seller sends the good after the Bitcoin transaction to the buyer. With Bitcoins, transactions are final and there is no facility for transaction reversal. In contrast, if you pay for a book using Paypal and the book does not arrive at your doorstep, then you can request a reversal of the transaction. Presently, the main activity of marketplace guarantor is to implement a transactions escrow system and a process for resolving disputes between buyers and sellers. This kind of escrow system hasn’t worked out well, because there have been numerous instances in which the anonymous guarantor has run off with both the buyer’s and seller’s Bitcoins.  So the challenge now is to develop a decentralised mechanism that facilitates transactions between anonymous buyers and sellers. I can think of a number of simple mechanisms arising from game theory, whereby buyers and sellers are kept honest at the unique subgame perfect equilibrium. However, I doubt that these contrived three step examples are useful in either practice or theory.

*EDIT: I haven’t fully understood the inbuilt relationship between computational difficulty and miner competition. The computational difficulty of mining has jumped recently, and I’m now trying to model this in a formal Bitcoin pricing model. Interesting!

31 Responses to "Bitcoin and anonymous markets: the real revolution in market design"
  1. Ultimately the “value” of money, whatever its denomination, depends on the confidence of those who use it. “Money” per se has no intrinsic value. Its value is entirely extrinsic. One disaster and the value of bitcoin will collapse, as there is nothing standing behind it. An interesting experiment doomed to failure in the long term.

    • Bitcoin has utility, for starters, as a decentralized, verifiable public ledger and contract system. It’s not an arbitrary token. It’s an innovative technology.. a protocol like Internet protocol (IP).

      • > It’s not an arbitrary token. It’s an innovative technology.. a protocol like Internet protocol (IP).

        But one disaster and the value of the Internet protocol will collapse, as there is nothing standing behind it. Doomed to failure in the long term.

  2. Miners will spend whatever it takes to mine bitcoin, mining is a competition. The cost of mining follows the price of a bitcoin, not the other way around. Every new round of expensive mining equipment makes the previous generation obsolete, adding to the cost of starting up again. As in every gold rush, the real profit is in providing the shovels, like ASICs..

  3. Miner profits must surely in the longrun be zero as there is free entry into mining. The same goes for mining equipment manufacturers. At these setup costs:

    I don’t think that miners can afford to make losses for too long. My biggest worry for Bitcoin is that there may be economies of scale in mining, which will mean that two or three large mining coops will eventually be left standing spelling the end of Bitcoin. BTW, I really don’t like the gold rush analogy or the shovel spiel that mining equipment manufacturers seem to be fond of repeating to their investors.

  4. Eric Posner has a nice piece on bitcoins as money, predicting its collapse as the inherent deflationary pressure will lead to hoarding and thus the end of its use as a means of transaction. He points out that there is nothing new about private or decentralised money, with the ancients using seashells and gold. His arguments make a lot of sense to me. ‘Fools gold’ he calls bitcoins.

  5. Yes indeed there is nothing new about private money. What is new about Bitcoin is its design and the economics of its engineering. There was also nothing new about donating kidney’s before the exchange program. But the exchange program introduced implemented ideas from economics that were foundational in the field of economic engineering. By that measure, Bitcoin is very innovative. Of course, it takes a certain amount of effort to study and understand its design; and relate those back to things economists understand.

    As for Posner’s post, I didn’t find it interesting when I first read it in April. At the time I thought that Bitcoin, as a piece of economic design, deserved less lazy histrionics. The article also seems to have been written a life time ago. Before the collapse of Silkroad 1, the emergence of Silkroad 2 (as a proof of concept that anonymous markets are difficult to close), before the Chinese interest in Bitcoin, and before today’s US Senate hearing on the legality of Bitcoin.

  6. As far as I can tell from reading the marginal cost of mining Bitcoins presently is comfortably between $500 and $600, so I don’t expect dramatic increases in the USD value of Bitcoins.

    The equilibrium cost of mining is driven by the market value of Bitcoins, not the other way around. If demand drove Bitcoins to USD$1000 today, the amount of CPU power dedicated to mining would increase, temporarily increasing the block rate (the rate of new Bitcoin production). This would drive the rate governor mechanism to automatically increase the difficulty level, which leads directly to an increase in the marginal cost of mining. If the price were to drop, the reverse would happen.

    The mariginal cost of mining is also related to the cost of electricity – which means that miners with access to cheap or free electricity have a cost advantage. Given that the transport cost of Bitcoins is essentially free, we should expect mining to concentrate in areas of cheap energy in the long term.

  7. kme, I understand that yesterday or the day before, the computational difficulty of mining went up; presumably because of increasing investment by miners, and the anticipation that the US Senate hearing will be positive given Ben Bernanke’s letter. I haven’t fully understood the algorithm connecting miner investment and computational difficulty. So the proof-of-work difficulty increases with miner competition?

  8. I’m not sure I understand the excitement here. In Nakamoto’s working paper he is seeking to establish a means of payment that is almost costless but irreversible. It seems to me this is the type of thing exactly no one would want, and the reason for the success of Paypal as a payment insurance scheme in online transactions.

    Further, even if the payment method is costless, buyers and seller still have access to legal recourse through normal consumer protection laws regardless of payment methods.

    I’d be interested to know exactly what sort of transactions a buyer or seller would prefer to make with Bitcoin instead of any other (slightly more costly) payment system that provides some degree of insurance.

    For example, Bartercard has been around for a while and it seems that their market is limited to a very specialised type of business-to-business transaction where ‘trade dollars’ are earned that can bee redeemed later from other member businesses. While I’m no expert, I believe there must be some tax advantage that makes this attractive to business.

    In general I concur with Paul and Eric Posner. Currency is all about trust, yet the idea of Bitcoin is to sidestep the trust issue by providing a cryptographic proof mechanism… which itself must be trusted!

  9. The excitement is about the distributed nature of Bitcoin as a payment system. You can pay someone:

    1. Reliably.
    2. In a manner that gets quickly verified.
    3. Without needing a mediator.
    4. With almost no transactions cost.

    Quoting Bernanke the innovations “may hold long-term promise, particularly if the innovations promote a faster, more secure and more efficient payment system.” It is certainly more efficient than using a Bankcard, Paypal, Visa mediated transfer. It beats EFTPOS and cash for internet payment. It beats Western-Union hands down for international transfers and payments.
    It is cheaper, more secure, and faster, than all of these systems.

    Importantly, once a payment is verified in the Bitcoin distributed-network, there is actual proof of the payment that is also independent of any mediating party. I can imagine that Walmart, Coles and Woolworths would be interested in such a cheap online payment system.

    The risk of being scammed in any case disappears once there is proof that the wallet you are sending your payment to is owned by Walmart. If there is a role for mediation of transactions, then that role with Bitcoin reduces simply to providing a third party escrow system.

    Further, no single entity controls the network, which, because of its distributive nature, is robust. Bitcoin [and the other emerging distributed-network-currencies such as (the unfortunately named) eMunie] is the most important economic innovation that I know (floating exchange rates used to excite me).

    Of course, there are a number of theoretical and practical issues with distributed-network-currencies that need to be resolved. First, is it possible to design a distributed-network-market for real goods. Second, how does one stabilise the exchange rate of the distributive-network-currencies, in a decentralised way. Third, is it possible to design a distributed-network-escrow system?

    As to longevity of the system, it’s a distributed-network it will last for a long time just like all the other distributed-networks that refuse to die (I think I can still connect to usenet and old P2P networks). This is not QQ currency, even the Chinese government can’t make it go away.

    I encourage professional economists to get involved:

  10. Bitcoin is more traceable than cash – each coin keeps its entire transaction history. Silk Road tried to do something about that by tumbling the coins. You don’t have this kind of protection at a point of sale.

  11. So the bitcoin network has better memory than cash, banks, governments. It has better memory than any third party mediated system. For example you can use the bitcoin blockchain memory to timestamp documents, agreements, contracts, without the need for a trusted third party. I’m playing around with, which can be used to prove that you had a document at time _t_ without revealing the content of the document. This uses the bitcoin distributed memory properties. Nevertheless, there are easy ways to make point of sale transactions anonymous to any third party. These don’t need silkroad or bitfog or any third party mechanisms. Depending on how much you are willing to pay in transactions costs (determined by the bitcoin miner market) you can theoretically make transactions anonymous to the most determined observer. And I don’t think that this is simply a feature of computational complexity.

  12. Rabee Tourky: The computational current computational difficulty is determined by an algorithm based on the number of blocks that have been added to the blockchain in the past two weeks. When more mining investment is made, blocks are added faster than the “par” rate, which eventually results in the required difficulty for new blocks increasing.

  13. kme, I’m gathering information on this for building an economic model (I don’t think that this has been done). So do you have a link detailing the computational complexity adjustment algorithm? A technical (i.e., crypt-maths) link is preferred.

  14. Rabee: The most authoritative source I know is the source code to the reference bitcoin implementation. See here:

    The algorithm implemented by that code is as follows: If the current length of the block chain is not divisible by 2016, then the difficulty bar is the same as for the previous block. Otherwise, set ActualTimeSpan to the time between the generation of the 2016th-to-most-recent and most recent blocks, in seconds. Clamp ActualTimeSpan to the range [302400, 4838400] (this range is a quarter of a fortnight and four fortnights, expressed in seconds). The difficulty bar is the difficulty bar of the previous block, multiplied by ActualTimeSpan and divided by 1209600 (this is one fortnight, expressed in seconds).

    The “difficulty bar” value is a number that the random block hash value must be below in order to be accepted, so it’s like a limbo stick – lower values are harder to pass.

    This algorithm boils down to adjusting the difficulty bar every 2016 blocks, so that the last 2016 blocks would have taken exactly two weeks at the new level of the difficulty bar, with the caveat that the difficulty adjustment is clamped to the range between 4 times easier and 4 times harder. 2016 blocks in two weeks equates to one block every 10 minutes.

  15. I know this is not a completely populist blog, but how about a few links to some of the theoretical back ground, let alone a layman’s summary?. I contrast this impenetrable post with a Klugman article. Are you aware that few readers have the slightest idea what you are talking about?

  16. “So the challenge now is to develop a decentralised mechanism that facilitates transactions between anonymous buyers and sellers.”

    This can already be done now and when Bitcoin 0.9 is released I expect it to be implemented fairly easily (I’m working on something similar now).

    If Alice and Bob want to trade with each other they enlist Charlie, an arbitrator, and create a two-of-three multi signature (escrow) address.

    The address requires two of the three to sign the transactions (to consent) to remove the funds from escrow.

    The way it will work is Bob will send Alice an x.509 signed payment request which will include the terms of the contract and the multisig address. Alice will check to make sure everything looks good then send her funds to the escrow.

    If the transaction goes well, but Alice and Bob sign a transaction releasing the funds from escrow, never involving arbitrator Charlie. If the deal does south, say Alice claims the terms weren’t fulfilled, she refuses to sign and takes the case to Charlie.

    Charlie check the x.509 signature on the signed contract (which tells him exactly what Alice and Bob agreed to) then makes a ruling. If he sides with Alice, he uses his key (and Alice her’s) to sign a transaction releasing the funds from escrow back to Alice.

    All this model requires is one or more trusted Arbitrators.

      • Sure, this is fairly easy to implement in bitcoin right now. I’ve built a little test page for multisig escrow on my laptop to go along with an arbitration service I’m working on.

        The problem is right now the arbitrator doesn’t really have a good way to arbitrate the case. Alice claims Bob didn’t ship the item, Bob says he did. Alice says the wrong item was shipped, Bob disagrees, etc. Without anyway to know what was agreed upon, it’s very difficult to make a ruling.

        In a centralized anonymous marketplace, the administrator has access to the transaction history so he can tell what was agreed to. This, of course, means you need to trust the admin not to run off with the coins.

        The new payment protocol in Bitcoin 0.9 will solve this problem with signed payment requests. So now the arbitrator will be able to determine exactly what was agree to without relying on a centralized operation.

        Since it’s using 2 of 3 multisig, the arbitrator can’t run off with the funds. You only need to trust he will make a fair ruling.

        I suspect it will take some time after the release for the payment protocol to gain widespread usage, however.

  17. Currently, the “marginal cost” of one bitcoin is about $12.20 on the least efficient ASIC (assumptions: power price $0.06/kWh, efficiency: 7.0 J/GH, current difficulty).

    Miners are not operating below marginal cost. However, they may never recover their initial investment, which is a different issue…

%d bloggers like this: