The marginal cost of cryptocurrency — does the price of Bitcoin have to fall so much from contestability?

Robert Sams writes:

This is also why it doesn’t make sense to speak of new cryptocurrencies expanding the aggregate crypto money supply without limit (or limited only by the fixed costs of creating one). What matters is how the aggregate hashing power, which is scarce, gets distributed over the set of extant cryptocurrencies. The above reasoning predicts that hashing power will not spread itself arbitrarily thinly, keeping MC well-above 0. (The distribution currently looks more like a power law.)

Much (something?) hinges on this point.  If I understand the argument correctly, the claim is that the market will not consist of a large number of thinly hashed cryptocoins, because those coins will not be secure.  There is an aggregate amount of hashing power, and it gets distributed in a quite concentrated fashion and that helps prop up the value of Bitcoin and limit the number of truly viable alternatives.  Sams emailed me:

Ignoring any desired technical differences among the various coins, it’s optimal for users to coordinate on one, not b/c of some network effect but b/c spreading hashing costs over lots of coins eventually results in no coin having much security. At the margin, a user will choose the higher hashing coin between two otherwise identical ones.

In the (implicit) model of my earlier post, there is always a bribe to be paid to new cryptocurrency adopters — out of the seigniorage created by the founders of new cryptocoins — that will encourage a larger number of active cryptocoins.  (And total hashing power is somewhat elastic in supply, contrary to how I am interpreting Sams.)  How actively will those coins be hashed?  I am not sure it matters.  There will be two margins: the cost of doing more hashing of existing coins, and the cost of creating additional cryptocurrency through “bribing out of seigniorage.”  In equilibrium those two marginal costs should be equal, adjusting of course for the possible heterogeneity of outputs, as you are not getting exactly the same services.  To the extent “security” is an issue, the initial bribe for using a new cryptocurrency needs to be that much larger.  If no bribe is big enough to induce some defection, I wonder how Bitcoin got started in the first place (which didn’t even have the benefit of the same kind of explicit upfront bribery).

My view is that if bootstrapping can happen once — as it did with Bitcoin — it can and will happen again.  In which case we are back to contestability limiting the value of Bitcoin.  I am not sure how much Sams and I are disagreeing.  At the end he coins (sorry) a new theorem:

So maybe here is a new theorem: the value of a cryptocurrency will converge to its optimal level of hashing costs?

In any case, do read Sams’s entire post, it covers many cryptocurrency issues of interest.


A poorly written piece by Sams, though I kind of got what he was getting at. Sams sample prose: "Bitcoin, therefore, has a free rider problem, whereby speculative coin balances, which benefit from the system’s costly hashing rate are effectively subsidised by those who use bitcoins primarily as a MOE. These speculative balances repay the favour by adding a toxic amount of exchange rate volatility, providing yet another reason for the transaction motive to run away from log coin MOE. As time goes on and the coinbase declines, this inequitable arrangement only gets worse. " --> translation, kind-of: "those that mine and hold bitcoin get a better deal than those that use bitcoin to buy things, since bitcoin is going up rapidly in value. This cannot continue since eventually nobody will buy things, and bitcoin will then crash." Economics is the art of double-talk to give solidity to wind, to paraphrase George Orwell.

Both Robert Sams and Tyler Cowen are wrong, and they are wrong for roughly the same reason, because they dismiss network effects.

Robert Sams thinks that the value of a crypto-currency comes from the cost of mining it. This is simply wrong. The cost of mining a currency is (eventually) just an upper-bound on the value of the cryptocoin. ( "Eventually" is a hedge for the periods of time when mining is profitable -- but those can only be temporary and eventually vanishing.)

If people do not use the cryptocoin, then its value is zero, regardless of how much it costs to mine it. This is "The Labor Theory of Value is Nonsense" 101.

Tyler Cowen is wrong to think that the value of a cryptocoin is determined just by marketing costs. This is wrong because marketing costs and barriers to entry due to network externalities are two entirely different categories. You can't eliminate barriers to entry just by marketing (at least not in a way that is profitable)

Tyler writes: "My view is that if bootstrapping can happen once — as it did with Bitcoin — it can and will happen again "

This is true (and I was a little too strong in dismissing this, in my comment on the earlier post that Tyler links to). But this is not even close to justifying the claim that the value of the cryptocoin is the same as the marketing cost.

The right way to think about competition between cryptocurrencies is to think of it like competition between social networking companies.

It is certainly true that Facebook out-competed Myspace, by coming up with a better product. But whatever value users of Facebook derive from it comes to a large extent from the size of the network. And there is no solid relation between marketing costs and the size of an online social networking company.

Similarly, the value of a cryptocurrency comes (at least in what we may call an equlibrium) from the expectations of its current and future usefulness as a medium of exchange. This depends on the network of people using it for various purposes and it has a vanishing relation to its marketing costs.

Am I misreading you or cost of mining a currency is (eventually) just an LOWER-bound on the value of the cryptocoin. since you will only mine of it costs you less than the sale price?

But unlike Facebook and MySpace, there will be very small transaction costs for moving between currency networks (even on a daily basis) because there will be an efficient exchange market between any two established currencies. If one could create social networks with only modest marketing costs that could mesh smoothly with Facebook, then marketing costs would be important in determining the number of viable social networks.

Sams writes, "not b/c of some network effect but b/c spreading hashing costs over lots of coins eventually results in no coin having much security."

The former is untrue, the latter is true. By design, the coin with the most hashing power is most secure. Network effect is everpresent. Average users have little incentive to choose an alt-coin that is provably 100x or 100,000x less secure. Field experience bears this out: alt-coins have a history of (a) being pre-mine or pump-n-dump scams or (b) being so insecure that a large miner may take over the chain at any time, reversing transactions at will.

Network effect is also present in real world penetration. Few Real People have heard of bitcoin. It makes sense to market "bitcoin" rather than "crypto-currency" and then have to educate normal folks on the differences between bitcoin, litecoin, dogecoin, scamcoin, ponzicoin, ... Because "bitcoin" is marketed, there is little incentive to worry about other crypto-coins.

If an entity with a large hashing machine perceived a new coin as a viable threat to the value of its Bitcoin stash, that entity could mount a 51% attack on the new coin's network.

That said, it's not obvious that a second coin does threaten the value of Bitcoin, any more than a run up in the price of silver threatens the investment position of those hoarding gold. Those using the coin purely as a payments system don't care about the absolute exchange rate with the dollar (only its volatility in the minutes it takes to buy, exchange, and then sell the coin used for the transaction). Which leaves the currency speculators. But rather than compete, speculative bubbles in similar investments can amplify popular interest in both, at least until the point where the scarce commodity becomes greater fools not yet parted from their money.

"Ignoring any desired technical differences among the various coins, it’s optimal for users to coordinate on one, not b/c of some network effect but b/c spreading hashing costs over lots of coins eventually results in no coin having much security. At the margin, a user will choose the higher hashing coin between two otherwise identical ones."

I'm not sure I agree with this. A higher hashing coin will earn a larger market cap, increasing the reward to anyone who attacks it. Low hashing coins will have lower market caps, but the reward to attacking it will be lower. So on the margin, users should be ambivalent between the two coins since the benefits of more hashing are counterbalanced by the threat of attack induced by a higher market cap. If not, prices will rebalance to this equilibrium. On the margin, cryptocoins are fungible.

But there is little direct reward in successfully attacking the coin network. Once it is clear that an attacker controls the network, the value of the coin goes to zero, and the attacker's reward is to be king of the ash heap. The goal of the attack would have to destruction rather than profit.

That is assuming there is no way to short or otherwise bet against the currency.

I'm no expert, but Google searches reveal several claims of ways you can short Bitcoin.

Do they work as shorts if you completely destroy bitcoin? If you have a plan to destroy the NASDAQ, I don't think you can profit directly by shorting GOOG.

I think the most likely result of a successful takeover of Bitcoin would be the immediate destruction of Bitcoin and the swift creation of Bitcoin2 based on the last-known-good blockchain.

It would depend on the details of what one was doing, I suppose. But I would bet on whoever planned the attack being ahead of those detecting the attack and responding by shutting things down.

"If you have a plan to destroy the NASDAQ, I don’t think you can profit directly by shorting GOOG. "

Yes you can. Indeed, this was actually tried in South American in the 80s.

The "Front office" side -- positioning the trades and carrying out the attack , the kind of stuff that shows up in thrillers -- is actually pretty straightforward. The hard part is executing the "back office" side -- clearing, settlement, margin, wire transfer -- without leaving traceable footprints. Because if you extract billions from the market will causing a lot of people grief, many of those folks are going to want to, um, "talk to you."

A "hard part" of such a strategy would be much easier for bitcoin. Indeed, several have already done something similar already and profited handsomely.

The fact that bootstrapping may be possible doesn't mean it will happen at any meaningful scale over and over. Bitcoin bootstrapped itself because it provided genuinely new features; other coins will probably have to also usefully distinguish themselves in some way.

I have yet to see much analysis accounting for DOGE, an oversight which must be corrected because all evidence suggest this one's going "to the moon."

Bitcoin is becoming Tyler's Russian Winter.

Gresham's law. QED

All currencies, the US dollar, the Euro, the Russian rubble are crypto-currencies with very weak embedded security, but a widespread common will to keep them secure. Almost all of these currencies are digital. Almost all these currencies are created privately.

The problem with the dollar and Euro and pound wasn't that the governments had devalued the currencies but that the private sector had devalued them by creating money by making bad loans.

Lots of printed money has been exported in the process of importing lots of goods, much illegal, but as it gets deposited in banks, it is loaned to consumers without any asset backing which makes it purely an accounting fiction. If the borrower defaults, the money the bank created is worthless. When the various government bailed out the banks which created all the worthless money, that was done by the government printing money by electronic accounting tricks - its just a crypto currency. The security feature is the bank has an audit trail back to the government that proves the money is valid, and the test is you pay taxes to the government with it.

"My view is that if bootstrapping can happen once — as it did with Bitcoin — it can and will happen again."

In its infancy, Bitcoin benefited from the fact that few people actually knew about it, and even fewer thought it would be worth even a fraction of what it is worth today. As a result, no one bothered executing an attack on it. Future crypto-currencies will not be so lucky; now, lots of people are attuned to the fact that a crypto-currency could be worth something, and attacks will almost surely happen quickly on any crypto-currency that appears to be getting even a small amount of traction.

There is of course a parallel here to the development of the Internet. The Internet as we know it today (open, decentralized, relatively network-neutral) only came to be because no one saw any commercial value in it for 15+ years. Imagine what a "new" Internet would look like today.

There's a feature called "merged mining" which can at least in theory deal with the problem of thinly spread hashing power by allowing the same hashing power to be used simultaneously on the blockchains of multiple cryptocurrencies.

P.S. +1 to mulp's comment - very insightful

I was going to post the same thing, thank you. Merged mining ftw! I get a kick out of seeing these same arguments made by economists now that we heard from n00bs years ago, but this time it's much more verbose and text formatted.

Gavin Andresen brought this up in connection to my argument My tentitive view of this is that merged mining has effects opposite of its designers' intentions. By allowing an alt-coin to effectively re-use the hashing done on Bitcoin, the marginal cost of creating coin on the auxilary chain is 0. Merged mining is the thin wedge that makes TC’s “bribing out the seigniorage” argument actually work. I suspect that a cryptocurrency can prevent itself from being the target of merged mining by tightening up what arbitrary data is allowed in the coinbase tx. At any rate, it’s a question that needs to be explored (both the technical and economic dimensions).

In the absence of something like wide-spread merged mining (curiously, not the case at the moment), I don't believe there is any seigniorage earned by the guy who introduces a new cryptocurrency. Sure, there is pre-mining among some, but those have a tiny % of the total cryptocurrency marketcap and their very existence is more a pump-and-dump story rather than a microeconomic one. If coin is competitively mined, the marginal cost of coinbase will equal its market value at the time it's mined/produced.. and that includes the very first coins.

You can bid for your new alt-coin coins and the miners will produce them, and you hope to sell them later for more than you paid. Or you can mine them and hope someone else will bid more than your electric bill for them. Either way, you will have had to pay for those coins with electricity or cash, and they may end up worthless before you can sell them. And if they do end up worthless, their supply has no bearing on the valuation of the others, as nobody is hashing the coin and the system is broken. If they end up close-to-worthless, it’s a system very weak in security and the coin is not a near-substitute for MOE on chains with higher hashing costs.

How bootstrapping works is not obvious. Whatever analysis works here, I don't think it is a model of firms "producing" cryptomoney. Seems more like a coordination problem.

"the marginal cost of creating coin on the auxilary chain is 0. Merged mining is the thin wedge that makes TC’s “bribing out the seigniorage” argument actually work. I suspect that a cryptocurrency can prevent itself from being the target of merged mining by tightening up what arbitrary data is allowed in the coinbase tx."

Although the marginal cost is 0 when the coin first launches, it becomes negative once the coin establishes some value. If a miner doesn't mine an altcoin, they're paying an opportunity cost per hash that their competitors aren't.

Your suspicion is correct - merged mining support needs to be built into the coin. For example Bytecoin was originally meant to be a direct copy of Bitcoin, but they added merged mining support later on.

True, and this should eventually make hashrate(Bitcoin) =
hashrate(Alt-coin), even though hashing costs don't equal the
market value of Alt-coin mining award.

Merged mining is what allows TC's "bribing out the seigniorage"
argument work, for an arbitrary number of auxiliary coins can
merge mine against Bitcoin and enjoy the latter's hashing rate no
matter what their market value is. Identical network security
makes these alt-coins closer substitutes for Bitcoin, and with no
break on the rate of money growth, it drives down the aggregate
market value of them all, taking down the shared hash rate with
it.. to 0 eventually.

The entire edifice rests on each coin doing its own hashwork. So
contrary your view that "merged mining support needs to be built
into the coin", I think much rides on the ability of Bitcoin to
NOT allow the insertion of auxiliary block hashes into its

Oh ok, I see what you're saying. Sorry to imply merged mining >ought< to be built into Bitcoin - I was trying to say that merged mining support is indeed optional for any given coin.

I'm not sure I understand how any alternative cryptocurrency is a close substitute for Bitcoin if they have seigniorage - one the initial problems Bitcoin was designed to solve. I mined during the Freicoin beta, but right before launch its dev team crowned themselves heads of an unelected foundation and awarded themselves 80% of all new coins (they swear it will be distributed to charity). Now they'd have to offer a HUGE bribe to convince me to not badmouth them as "yet another scamcoin", more than I would have just earned without seigniorage. That bribe money comes right out of the pocket of every speculator who otherwise would have hyped up the currency even more.

It's not just me: "pre-mine" coins have a negative stigma, and are frequently replaced by non-premined alternatives. For example the first coin to feature Scrypt hashing was Tenebrix, but its premine prompted the launch of Fairbrix and eventually Litecoin (the king of Scrypt). Why would anyone want to use a pre-mined coin when an otherwise identical (but fair) coin also exists, OTHER than being a shill? Solidcoin and Ixcoin are both dead now because they lost the trust of everyone but a small group of insiders.

Tangent: For what it's worth, there has been pressure to upgrade the network so it would be harder to insert arbitrary data in the blockchain.
Not to protect Bitcoin's market position, but to prevent any requirement to store potentially illegal speech (like child porn). We're already stuck with an ASCII portrait of Ben Bernanke for all eternity.

mulp wins this one.

I just couldn't depart your site prior to suggesting that I extremely enjoyed
the standard information a person prokvide for your visitors?

Is gonna be back continuously to check out new posts

Your style is unique compared to other folks I've read stuff from.
Many thanks for posting when you've got the opportunity, Guess I'll just
book mark this site.

I am regular reader, how are you everybody? This
article posted at this site is in fact pleasant.

Howdy, i read your blog occasionally and i own a similar one
and i was just wondering if you get a lot of spam comments?
If so how do you reduce it, any plugin or anything you can advise?
I get so much lately it's driving me crazy so any support is very much appreciated.

Comments for this post are closed