The problem bitcoin solved

Digital cash was not a new idea in 2008. Cryptographers had been trying to build it since the early 1980s, and they had already solved the parts that sound hard. Unforgeable signatures: solved. Private transfers: solved. What defeated every attempt for a quarter of a century was something that sounds trivial by comparison — stopping someone spending the same money twice.

Understanding why that was so difficult is the fastest route to understanding why bitcoin behaves the way it does: why you wait for confirmations, why a payment cannot be reversed, and why running your own node is worth the trouble.

A single banknote held taut at both edges by two different hands pulling gently in opposite directions, shot tight against a plain dark background so neither hand is winning yet.

Image to come

1Digital things copy perfectly

Physical cash works because a note is a thing. Hand it over and you no longer have it. That property is doing enormous quiet work: it makes spending the same twenty dollars twice a physical impossibility rather than a rule anyone has to enforce.

Digital files have the opposite property. Sending a file does not move it — it copies it. So a "digital coin" that is simply a file with a signature on it can be sent to a shop in Halifax and a shop in Vancouver in the same minute. Both receive something perfectly valid. Both have no way to know about the other.

This is the double-spend problem, and notice what it is not. It is not a forgery problem; both copies are genuine. It is not a signature problem; both signatures verify. It is a question about order: which of these two equally valid transactions happened first, and who gets to decide?

2The old answer, and its price

Every pre-bitcoin attempt answered that question the same way: appoint someone to keep the list. A central server records that the coin moved to the Halifax shop, so when the Vancouver transaction arrives it is refused. Simple, fast, and it works.

It also quietly reintroduces everything digital cash was supposed to remove. Whoever keeps the list can edit it, freeze it, be hacked, go bankrupt, be bought, or be compelled by a court. Every early digital cash system that reached real users died at that single point — not because the cryptography failed, but because the company holding the ledger did.

The double-spend problem is easy to solve if you are willing to trust somebody. The whole difficulty was solving it without that.

Which turns the question into something harder and much more general: can a group of strangers, with no leader and no reason to trust each other, agree on a single shared record of events? That question already had a name.

3The Byzantine Generals Problem

In 1982, Leslie Lamport, Robert Shostak and Marshall Pease published a paper describing the difficulty as a story.

Several divisions of the Byzantine army are camped around an enemy city, each under its own general. They can only communicate by messenger. They must agree on one plan — attack together or retreat together — because a coordinated attack wins and an uncoordinated one loses. And some of the generals are traitors, actively sending contradictory messages to make sure the loyal ones disagree.

Strip out the story and the question is precisely the one digital cash needed answered: how do independent participants reach agreement when some of them are lying? A general receiving "attack" from one colleague and "retreat" from another cannot tell which is the traitor. Neither can a shopkeeper receiving one version of a payment while a shop across the country receives another.

Computer scientists made real progress on this. By the late 1990s there were working algorithms for Byzantine agreement, and they came with a hard requirement: you had to know who the generals were. The maths depends on counting participants — a fixed roster, of known size, where you can establish that more than two thirds are honest.

4The wall: counting is free to fake

On an open network, that requirement is fatal, and the reason is worth sitting with because it is the real obstacle bitcoin had to clear.

If anybody may join, then "one participant, one vote" means nothing. Creating a new identity online costs nothing — so an attacker wanting a majority does not need to convince anyone or compromise anything. They simply run ten thousand copies of the software and vote ten thousand times. This is called a Sybil attack, and it makes headcount-based agreement worthless the moment membership is open to all.

So the field was stuck between two options. Know your participants and get consensus, but need a gatekeeper deciding who is admitted. Or admit everyone, and lose the ability to count anything. Digital cash needed the second setting and the first result, and for decades nobody had a way to get both.

5Bitcoin's move: make voting expensive

Bitcoin's answer is not a better way to count participants. It is a decision to stop counting participants at all.

Instead of one vote per identity, votes are attached to something that cannot be conjured for free: computation. To propose the next batch of transactions — a block — a miner must find a number that makes the block's cryptographic fingerprint fall below a target. There is no clever route to that number. You guess, astronomically many times, burning real electricity on real hardware until you find one.

That is proof of work, and its usefulness is entirely in what it costs. Identities are free, so an attacker can have as many as they like. Energy is not, so influence over the ledger has a price list, payable in the physical world, that scales with how much of it you want.

• Nobody grants permission. There is no roster and no admission process. Anyone may mine, exactly as intended.
• Faking participation gains nothing. Ten thousand instances with no hashpower produce ten thousand nothings — the Sybil attack simply stops working.
• Influence is bought, not claimed. Half the say over new blocks requires roughly half the world's mining capacity, running continuously.

6Which is how the order gets settled

Now return to our double-spender. They pay a merchant, and at the same time build a competing version of history where that same coin went back to their own wallet instead. Both versions are validly signed. Both are real candidates.

Every node follows one rule: treat as real the valid chain carrying the greatest total proof of work. The attacker's alternative history is not rejected for being fraudulent — nothing in it is malformed. It loses because less work went into it, and the moment the honest chain is ahead, the attacker's version is simply the one that fewer resources vouch for.

It is usually called the "longest chain" rule, which is a useful shorthand and slightly wrong. What is compared is accumulated work, not block count — a chain of fewer, harder-won blocks beats a longer chain of easier ones.

So the ordering problem that defeated digital cash for thirty years is answered without a referee. Nobody adjudicates which transaction came first. The version of events that cost the most to produce becomes the version everyone keeps building on, and the alternative is abandoned.

7Which is why you wait for confirmations

This design buys something real, and it charges for it in a currency you have already noticed: time.

A transaction that has just been broadcast is a proposal. Once it is included in a block it has one confirmation, and each block built on top adds another. Nothing flips from "pending" to "permanent" — instead, reversal gets steadily more expensive, because undoing a transaction buried under six blocks means rebuilding all six faster than the entire network is extending the real chain.

• Zero confirmations is not settlement. It is a credible promise, which is fine for a coffee and not fine for a car.
• One confirmation is enough for ordinary amounts. The coin is in the chain and reversing it now costs real money.
• Six confirmations — around an hour — is the long-standing convention for amounts you would be upset to lose, and is why exchanges make you wait.
• Waiting is the product, not a defect. Instant reversible payments already exist; you can get them from any bank. The hour buys you the property that no one can take it back.

A phone face-up on a café table showing a wallet screen with a transaction marked as one confirmation, beside a half-finished coffee going cold. Ordinary, unhurried, slightly boring.

Image to come

8What it does not solve

Being precise about the limits is more useful than the usual claim that bitcoin "solved" Byzantine agreement outright. It did not, quite.

Classical Byzantine agreement, once reached, is final. Bitcoin's is probabilistic: the chance of reversal shrinks with every block but never becomes mathematically zero. In exchange, it works in the open setting where the classical result cannot be applied at all. That is the trade, and it is a good one — but it is a trade, not a clean win.

The well-known limit is the 51% attack. An entity controlling most of the hashpower can rewrite recent history, reverse their own recent transactions, and block transactions from confirming. It is spectacularly expensive and self-harming — the attack devalues the asset the attacker's hardware exists to earn — but it is possible, and it is why "wait for more confirmations" scales with the amount at stake.

What matters just as much is the list on the other side, because it is where the limits stop:

• A majority attacker cannot spend coins whose keys they do not hold. Mining power is not signing power, and no amount of hashrate substitutes for your private key.
• They cannot create bitcoin out of nothing, pay themselves a larger block reward, or raise the 21 million limit. Blocks breaking those rules are invalid, and invalid blocks are discarded no matter how much work sits behind them.
• They cannot force those rules to change, because the rules are not enforced by miners. They are enforced by every full node independently checking every block — which is the entire argument for running one.

That last point is the practical takeaway hiding inside the theory. Proof of work decides the order of valid transactions. It has no say over what counts as valid. That judgment sits with the nodes — and if you run one, some of it sits with you.

The short version

Digital money's obstacle was never secrecy or signatures. It was agreement: getting a network of strangers, some of them hostile, to concur on a single ordering of events without appointing anyone to decide. Classical computer science could do it only among known participants. Bitcoin sidestepped the counting problem entirely by making influence cost energy, so history is settled by what was expensive to produce rather than by who claims to be present.

Everything you experience as a user falls out of that one decision. The wait for confirmations is the cost accumulating. The irreversibility is the guarantee being delivered. And the reason nobody can reverse a payment on your behalf is the same reason nobody can reverse one against you.