If you're seeing this message, it means we're having trouble loading external resources on our website.

If you're behind a web filter, please make sure that the domains *.kastatic.org and *.kasandbox.org are unblocked.

Main content

Bitcoin: The money supply

The mechanisms by which the supply of bitcoins is controlled. Created by Zulfikar Ramzan.

Want to join the conversation?

  • mr pants teal style avatar for user Nathan Wailes
    Could you make a video discussing what is likely to happen if governments attempt to ban bitcoins? I have friends in finance saying the bitcoin system is sure to be dismantled by governments once they become convinced it threatens their ability to control monetary policy (eg paying their debts by printing more money).
    (13 votes)
    Default Khan Academy avatar avatar for user
    • leaf green style avatar for user Ryan
      I'm sure there are many ways this could happen, but if the government feels threatened they don't necessarily have to dismantle and completely ban it in order to end it as a threat.

      Bitcoin needs to become widely accepted in order to grow. This means getting retailers to accept it as a form of payment. If the government said retailers cannot legally accept it and slapped a large fine on one retailer, it would probably make all other retailers flee. Sure it would still exists, but you couldn't really do much with it.

      Or, they could take a more drastic move and do what they did with online poker and seize all online domains and all assets held on any of the sites.
      (11 votes)
  • blobby green style avatar for user Andreas Profous
    Let's suppose we reached the moment in time where all Bitcoins have been generated (so approximately in the year 2140). Since there is no "generation" part of the transaction that needs to be validated by the bitcoin miners, all miners receive the same input message for their proof of work (right?). Does that imply that simply the quickest computer will always "win" and collect the transaction cost?
    (8 votes)
    Default Khan Academy avatar avatar for user
    • blobby green style avatar for user Zulfikar Ramzan
      All miners will, at the very least, have to tie their own identity into the proof of work (since they will need to specify their bitcoin identity in order to collect the transaction fee). This means that each minor is technically tackling a different proof of work problem. More so, this problem turns out to be essentially random because even if you change a single bit of the input into the hash function, the output will look random and will not resemble the input at all. Whichever miner happens to unearth the proof of work first will win. If a miner has better hardware, then they are more likely to win. However, even a miner with weaker hardware can win since they might just get lucky and find the proof of work in the early phases of the brute-force search (the value that leads to solving the proof of work could literally be anywhere among the answers -- sometimes you'll stumble upon it earlier and sometimes you'll stumble upon it later).

      You can think of coming up with a proof of work as winning a lottery. The more computational power you have access to, the more lottery tickets you have. And the more lottery tickets you have, the more likely you are to win the lottery. Even a weak computer will have some lottery tickets and it may get lucky and beat out a stronger computer -- though on average the stronger computer will win more.
      (18 votes)
  • male robot hal style avatar for user Reinhard Grünwald
    Who has set this upper limit of 21M bitcoins?
    Why was this number chosen and not another one?
    (13 votes)
    Default Khan Academy avatar avatar for user
  • blobby green style avatar for user DJ Nickles
    At , why are we not seeing parallel digital currencies deployed using the same methods?
    (4 votes)
    Default Khan Academy avatar avatar for user
    • blobby green style avatar for user Zulfikar Ramzan
      Thanks for the question! There are some cryptocurrencies that are very similar to bitcoin. One of these is Litecoin. It mainly differs in terms of some of the parameters. For example, the proof-of-work in Litecoin is calibrated so that it takes less time to solve, etc. It is entirely possible that one of these currencies will overtake bitcoin's popularity. Bitcoin's popularity can also be attributed to its "first mover" advantage. At the time that Bitcoin came out, there was nothing out there like it. It built a following in that time and some of the newer approaches (even those that are largely the same as Bitcoin) haven't had a chance to catch up. Part of the value of any payment system will be derived from its popularity (both among users and merchants) as well as any other supporting ecosystem around it. For example, Bitcoin has exchanges like Mt. Gox and also there are other anonymity enhancing services that can be built on top of bitcoin. Some of the other approaches, even though they employ the same techniques, don't have this supporting ecosystem to the same degree.
      (16 votes)
  • blobby green style avatar for user naiemk
    How does the system guarantee that miners stick to the rules. I.e. if a virus introduces millions of miners and bitcoin clients with modified implementation of protocol to favor specific entity, how does the system guard against it?
    To be specific, I am not talking about the double spending problem, or a vicious behavior motivated economically within the bitcoin system. Maybe an effort just to make the system fail from a competitor.
    (7 votes)
    Default Khan Academy avatar avatar for user
    • ohnoes default style avatar for user Tejas
      If a competitor wanted to make the Bitcoin system fail, it would have to spend millions of dollars to outdo the Bitcoin miners who do stick to the rules, that is, more than 50% of computing power in Bitcoin has to belong to this competitor. Then, the value of Bitcoins would fall to 0 since no one would accept them, and so there would be no more Bitcoin. However, there would be little to no economic gain for this, at least in Bitcoins. Of course, someone might not care about this, and that is one of the major weaknesses in Bitcoin.
      (2 votes)
  • blobby green style avatar for user marc.pn.beaupre
    We know:
    1) There is an upper bound on the number of bitcoins.
    2) Assuming that bitcoin catches on, popularity will rise over time.

    This should lead to constant deflationary pressure. As demand increases but supply stays the same, prices should increase.

    As per https://www.khanacademy.org/economics-finance-domain/core-finance/inflation-tutorial/deflation-tutorial/v/deflationary-spiral, deflation can be very bad for an economy.

    What would a world look like with bitcoin as its main currency given that we should expect it to be forever suffering from deflation?
    (4 votes)
    Default Khan Academy avatar avatar for user
    • leaf green style avatar for user Vulndare
      Bitcoin seems to be faced with a unique problem. Whereas most currencies inflate over time, Bitcoin will mostly likely do just the opposite. Time will see the irretrievable loss of an ever-increasing number of Bitcoins. An already small number will be permanently whittled down further and further. And as there become fewer and fewer Bitcoins, the laws of supply and demand suggest that their value will probably continually rise.
      Thus Bitcoin is bound to once again stray into mysterious territory, because no one exactly knows what happens to a currency that grows continually more valuable. Many economists claim that a low level of inflation is a good thing for a currency, but nobody is quite sure about what might happens to one that continually deflates. Although deflation could hardly be called a rare phenomenon, steady, constant deflation is unheard of. There may be a lot of speculation, but no one has any hard data to back up their claims.
      That being said, there is a mechanism in place to combat the obvious consequences. Extreme deflation would render most currencies highly impractical: if a single Canadian dollar could suddenly buy the holder a car, how would one go about buying bread or candy? Even pennies would fetch more than a person could carry. Bitcoin, however, offers a simple and stylish solution: infinite divisibility. Bitcoins can be divided up and trade into as small of pieces as one wants, so no matter how valuable Bitcoins become, one can trade them in practical quantities.
      In fact, infinite divisibility should allow Bitcoins to function in cases of extreme wallet loss. Even if, in the far future, so many people have lost their wallets that only a single Bitcoin, or a fraction of one, remains, Bitcoin should continue to function just fine. No one can claim to be sure what is going to happen, but deflation may prove to present a smaller threat than many expect.
      (4 votes)
  • blobby green style avatar for user chirayu
    Two questions:
    1) At the calibration of the proof of work protocol is mentioned. Is it a P2P protocol or a central node that does this work?
    2) It seems that there is a bank like node who has the 21 million nodes and is charged with disseminating them at a configured rate. Who/How is this behaviour controlled?
    (4 votes)
    Default Khan Academy avatar avatar for user
    • piceratops ultimate style avatar for user Christian Wen
      This behaviour is controlled by the difficulty level. The difficulty level is so that a target time of 10 minutes per block is reached. Across the whole network, lots of processing power is being used to try to find that correct answer. So yes its a p2p protocol and not just one person does the work. When someone find a block they broadcast it to their nodes they are connected to. Usually people are connected to 8 nodes. It quickly gets transmitted across the network. So, its not one person who has a lot of nodes. Bitcoin is decentralized and p2p.
      So, the behaviour is controlled by the difficulty. If blocks are being solved too fast than it means more processing power is being used. So it adjusts to make it a bit harder to find a block.
      (2 votes)
  • male robot hal style avatar for user belbs
    I see a lot of concern with computational power, cryptography, etc when talking about the Bitcoin money supply.
    But I was wondering, were questions like inflation, conversion rates, etc. also taken into account when deciding the rate by which money is introduced in the system (and the amount of awards that the miners receive)?
    (3 votes)
    Default Khan Academy avatar avatar for user
    • piceratops ultimate style avatar for user Christian Wen
      Well, we don't really know. Bitcoin was created 4 years ago by an anonymous coder. We can't be sure about the reason why he chose those certain attributes.
      Currently the rate of production (inflation) is set and can't be changed. It's hard coded into the block chain and enforced by the client.
      Currently people have other ideas for alternate crypto currencies. Still, these will have to stand the test of time. Also, Bitcoin will have to stand the test of time. We'll see where it is 4 years from now.
      (2 votes)
  • blobby green style avatar for user Ramki Sitaraman
    If the # of bitcoins is limited to 21M and post that you cannot generate - wouldn't the value of bitcoin suddenly shoot up ? It is like I have only 1B cash in US and any money has to be transacted with that. The value of 1 Bitcoin goes up and people who bought bitcoins earlier at cheaper rate get benefited. This is more like shares /gold than actual cash ?
    (3 votes)
    Default Khan Academy avatar avatar for user
  • blobby green style avatar for user sydwell
    10 mins to validate a transaction seems a bit long. So if my understanding is correct a supplier of goods or service will need to wait at least 10 minutes to see it the transaction is successful?
    (3 votes)
    Default Khan Academy avatar avatar for user
    • leaf green style avatar for user Andriy Moraru
      If he needs to be absolutely sure, yes. It will take about 10 minutes to incorporate a transaction into a block. On the other hand, the transaction becomes visible to the P2P network almost immediately. There is always a possibility of double-spend, but it will require the malicious buyer to make the second spend in a physically different part of the P2P network. It might be expensive to do this, so if you are selling something cheap, you might decide not to wait for full confirmation (10 minutes) but rather choose to believe the buyer when the transaction becomes propagated inside the P2P network.
      (1 vote)

Video transcript

In the last video, I talked about how Bitcoin transactions are really incorporated into a global and a publicly accessible ledger of sorts that we call the transaction block chain. And this work is actually carried out by nodes in the Bitcoin network that are known as Bitcoin miners. And as a reward for all that effort, especially since some of the computational heavy lifting is done by these Bitcoin miners, they're basically awarded a certain number of Bitcoins for their efforts. And this happens by the miners effectively constructing what's called a coinbase transaction, and then basically assigning themselves Bitcoins within that transaction. So in a sense, then-- and this is kind of intriguing-- Bitcoins are effectively generated almost out of thin air during this process. And of course, if you see something like that, that might raise in your mind the question of whether there is ever an upper limit to the Bitcoin money supply. And fortunately, the answer-- or maybe not so fortunately, depending on your viewpoint-- the answer to that question is actually yes. And the Bitcoin system is actually designed so that there can be at most 21 million Bitcoins ever generated. OK, so that's the maximum number of Bitcoins that can ever come up in the system. Beyond that point, no more new Bitcoins will ever be accepted or generated, or allowed to be generated. And so as a result, nodes at that point-- from that point onward, once 21 million Bitcoins have been generated-- nodes will no longer get a reward for augmenting the transaction block chain. The Bitcoin miners who do all this effort are not going to get a guaranteed award for doing that effort. And keep in mind that, because every transaction in the Bitcoin system is public, and the nodes in the system actually know how many coins have been generated, it's possible to really enforce these limits on the total number of Bitcoins created. Now there are actually two points I want to make regarding this particular limit. So first of all, even after it's reached, we're still going to need nodes to do what Bitcoin mining nodes do today. So that involves things like incorporating transactions into transaction blocks, and incorporating these transaction blocks into transaction block chains, and so on and so forth. But if you think about it for a moment, once the 21 million coin limit is reached, these nodes don't get that automatic reward of Bitcoins for performing this extra effort. And now you might be wondering, well, what incentive is there for these nodes to engage in this additional effort? I mean, why are they doing this sort of thing if they're not going to get Bitcoins as a guarantee for doing that work? And really at this point, the hope is that, when we reach the 21 million Bitcoin limit-- or as we get closer and closer to it-- that actually transaction fees will play a more prominent role in a node's decision to be a Bitcoin mining node. And in particular, the idea here is that we hope the transaction fees will be enough of an incentive, and more and more people will-- in general, I think, hopefully, by this point-- will be using Bitcoin. And so as a result, I think there is an expectation-- or it's not unreasonable to think-- that as more and more people use Bitcoins, there will be more and more transactions, and as a result, more and more opportunity to make money off of transaction fees. And it turns out that in the context of Bitcoin mining, a lot of the heavy lifting is in this proof-of-work piece, not in being able to incorporate all these transactions into a transaction block. So even if there's a lot of transactions in the transaction block, it's not that much more effort for the miners to really incorporate those extra transactions. But if they're getting all these extra transaction fees, then that might be an incentive for them. It's also worth noting that transaction fees are actually set by the payer in Bitcoin. The payer, then, is going to have the onus of setting the fee appropriately, so that the nodes in the Bitcoin network are incentivized to add that payer's transactions to their transaction blocks. So hopefully that makes some sense. The second point I want to make, regarding this limit of 21 million Bitcoins, is that really Bitcoin does allow for fractional coins. And I haven't really talked much about that in this video series. I've really implicitly talked only about the idea of coins being these whole entities, like Alice transferring 10 coins to Bob, or 25 coins to Bob, and so on. But it turns out you can actually have coins that are fractional. And in fact, the smallest possible unit in Bitcoin-- it's a very small number-- it's 0.00000001 Bitcoins. And this is 1/100-million of a Bitcoin. And this actual-- this unit, by the way, just as an FYI-- is known as a Satoshi. And this name actually comes from the name Satoshi Nakamoto. And Satoshi Nakamoto is the pseudonym of the inventor of Bitcoin. Nobody actually is sure that there is somebody actually named Satoshi Nakamoto, but as far as anybody can tell, the only person who's ever taken credit for the invention of Bitcoin is this Satoshi Nakamoto name. And it's unlikely there's actually a person behind that name, but it's more likely maybe some type of a group, or something of that nature. Now, aside from that, there are actually a couple of other additional controls that I want to mention, that are built into Bitcoin for keeping the growth of that money supply in check. So first of all, the reward provided to Bitcoin miners actually decreases over time. And if you were aware-- when Bitcoin began, which was around January of 2009-- at that time, the reward for a Bitcoin miner to do their effort was 50 Bitcoins. Now, the way that the reward structure is set up is that every 210,000 blocks-- so when you get to a 210,000-block period, every time 210,000 new blocks are generated-- the reward size actually gets cut in half. And so what that means is that once 210,000 blocks are generated, the reward goes from 50 Bitcoins to 25 Bitcoins, and from 25 to 12 and 1/2, and so on and so forth. Now, it does take approximately 4 years to generate 210,000 blocks, and I'll talk a little bit later about where this 4 years numbers come from. But as of right now, I'm recording this video-- it's May 2013-- the current reward is actually no longer 50 Bitcoins. The current reward now is actually 25 Bitcoins per mining operation, and it's going to go down half in approximately 4 years. And that's just going to keep happening, until-- the estimate is around the year 2140. So in the year 2140, we will expect that the entire Bitcoin supply will have been generated. So we're not going to-- it's unlikely we'll be generating Bitcoins after 2140. 2140 is the point at which all Bitcoins will have been generated. Now, the last way to limit the generation of Bitcoins is to actually calibrate the difficulty of solving that proof-of-work protocol at a global level. And so I also want to point out that another functionality that Bitcoin has built into it is that for every 2016 blocks that are generated, the network basically estimates the time that it took to generate those blocks. It looks at how long did it take to generate the first of these blocks, and how long did it take to generate the last of these blocks, and it measures that amount of time. And if that amount of time is-- let's say it's something that's significantly bigger than 2 weeks. So if it's significantly bigger than 2 weeks, then the proof-of-work protocol will be simplified. But we're going to calibrate it so it's easier to generate blocks. On the flip side, let's say it took a lot less than 2 weeks to generate these 2016 blocks. In that case, the proof of work will be again calibrated to be made more difficult. And the goal is that we want it to be the case that, of 2016 blocks, we want it to be the case that it takes about 2 weeks to generate these blocks-- about 14 days to generate 2016 blocks. And to get a better sense for why that number is the way it is, you could see that-- let's say it takes about 2 weeks to generate 2016 blocks. What that actually will imply is that it takes about 10 minutes before the proof of work is actually solved, and a new transaction is-- or a new transaction block, rather-- is folded into the overall transaction block chain. And you can actually work out that if you-- if it took 10 minutes to validate, or to come up with one new block in the system at a global level, and you multiply that by 6 to get the number of blocks generated per hour-- so you'd get 6 blocks per hour, or really 6 new proofs of work per hour, which in turn would lead to 6 new transaction blocks per hour-- you multiply that by 24 hours per day. And then you multiply that by 14 days, and you'll actually find that when you multiply these things together, you will get the number 2016. And so you can get a sense for where this number comes from. And I want to make one last, final clarifying remark regarding this proof of work. Since solving the proof of work actually requires a Bitcoin mining node to come up with the proof string-- which it currently does through some type of exhaustive search-- as you increase the number of Bitcoin mining nodes on the network, then really, all else being equal, the proof of work will be solved faster. But I don't mean faster for a particular node. I mean faster at the level of the entire network. In other words, it'll take less time before at least one node comes up with a solution, because these nodes are all working on that same problem concurrently. And actually, on that note, I do also want to mention quickly maybe a more subtle point, which is that-- even though the different Bitcoin mining nodes are all validating either the exact same set of transactions, or maybe a largely overlapping set of transactions-- they actually are all solving entirely different proof-of-work protocols when they're doing this sort of thing. And the reason for that is that each node, remember, inserts its own coinbase, or generational transaction, into the block that it's working on to award itself coins. And this generational or coinbase transaction is actually unique to each node. So as a result, the challenge string for which, let's say, each Bitcoin mining node is seeking a corresponding proof of work-- well, that challenge string will be different for each Bitcoin-- each Bitcoin mining node, rather. And so essentially, what you have is that, because you have a cryptographic hash function that's being used in the process, just this one difference-- the fact that just this one piece is different-- that actually completely randomizes the proof-of-work problem that results. And that makes it likely that across the entire network, the solutions are likely to be widely distributed, and we can expect that if we have enough nodes, one node will come up with a solution in about 10 minutes. At least one of the nodes will. They won't all do it, but at least one will, and once one node comes up with a solution, everyone else can proceed from that point onward with the new chain. So as you can see, the Bitcoin protocol takes a number of measures-- implements a number of mechanisms-- to both limit the total number of Bitcoins, as well as the rate at which these Bitcoins are ultimately generated.