THESIS BENCE ANDRÁS 2018 Corvinus University of Budapest Corvinus Business School Institute of Information Technology A Framework for the Monetary Analysis of Cryptocurrencies Bence András Business Informatics 2018 Thesis advisor: Gergely Kis, Ph.D. Abstract This thesis proposes a framework for the economic analysis of cryptocurrencies as a form of money, and applies it on the case of Bitcoin. The framework has two distinct pillars: 1) a quantitative analysis of time series behavior in comparison to a benchmark portfolio of fiat currencies, and 2) a qualitative assessment of money functions and currency design. As an application of this framework, the full history of Bitcoin was analyzed. All known USD-based Bitcoin exchanges were mined of their data to create the longest possible times series for the trade-weighted BTC/USD price. Using this data, daily log returns were calculated for a similarity/dissimilarity analysis with 23 foreign exchange pairs, and distribution fitting was conducted for identifying the risk profile of Bitcoin. It was found that Bitcoin is highly dissimilar to the forex market, and it has a non-normal distribution. A statistical model was also built for explaining Bitcoin’s volatility with its inherent properties, such as the hash rate, the money supply, the transaction volume or the number of unique addresses. The model demonstrated that one-third of Bitcoin’s volatility can be explained. These results, along with a qualitative assessment of design, showed that as Bitcoin ages, it may become less volatile, and thus better able to fulfill the core functions of money. This suggests that cryptocurrencies, such as Bitcoin, need more time to mature. Keywords: Bitcoin, Blockchain, Cryptocurrency, Evaluation, Financial Technology, Functions of Money, Monetary Economics JEL classification: E41, E42, E51, G15 i DECLARATION I. I. számú melléklet NYILATKOZAT SAJÁT MUNKÁRÓL Név: András Bence E-mail cím: bence@andrasek.hu NEPTUN kód: SCEQJZ A szakdolgozat címe magyarul: A kriptopénzek monetáris elemzési keretrendszere A szakdolgozat címe angolul: A Framework for the Monetary Analysis of Cryptocurrencies Szakszeminárium-vezető (vagy konzulens) neve: Dr. Kis Gergely Én, András Bence teljes felelősségem tudatában kijelentem, hogy a jelen szakdolgozatban szereplő minden szövegrész, ábra és táblázat – az előírt szabályoknak megfelelően hivatkozott részek kivételével – eredeti és kizárólag a saját munkám eredménye, más dokumentumra vagy közreműködőre nem támaszkodik. Budapest, 2018. 11. 22. __________________________ hallgató aláírása TÉMAVEZETŐI NYILATKOZAT Alulírott, Dr. Kis Gergely konzulens kijelentem, hogy a fent megjelölt hallgató fentiek szerinti szakdolgozata (egyetemi/ mesterképzésben diplomamunkája) benyújtásra alkalmas és védésre ajánlom. Budapest, 2018. 11. 22. __________________________ (a konzulens aláírása) ii DECLARATION II. II. számú melléklet NYILATKOZAT A SZAKDOLGOZAT NYILVÁNOSSÁGÁRÓL Név (nyomtatott betűvel): ANDRÁS BENCE Alapszak, szak neve: Gazdaságinformatika Dolgozatom elektronikus változatának (pdf dokumentum, a megtekintés, a mentés és a nyomtatás engedélyezett, szerkesztés nem) nyilvánosságáról az alábbi lehetőségek közül kiválasztott hozzáférési szabályzat szerint rendelkezem. TELJES NYILVÁNOSSÁGGAL A könyvtári honlapon keresztül elérhető a Szakdolgozatok/TDK adatbázisban (http://szd.lib.unicorvinus.hu/), a világháló bármely pontjáról hozzáférhető, fentebb jellemzett pdf dokumentum formájában. Budapest, 2018. 11. 22. …………………………………… a hallgató (szerző) aláírása iii DECLARATION III. III. számú melléklet NYILATKOZAT Alulírott András Bence (név), SCEQJZ (Neptunkód), Gazdaságinformatika szakos, bolognai alapképzés gazdaságinformatikus hallgató aláírásommal tanúsítom, hogy a komplex vizsga letételéhez szükséges tantárgyakat és a szakszemináriumot is sikeresen teljesítettem. Tudomásul veszem, hogy valótlan adatok állítása fegyelmi eljárás indítását vonja maga után. Budapest, 2018. 11. 22. ……………………………… Hallgató aláírása iv Table of contents Preface .............................................................................................................................. x 1. Introduction............................................................................................................... 1 2. Technological foundations and literature overview .................................................. 5 3. 2.2. On the design of a cryptocurrency ..................................................................... 6 2.3. The state of research on cryptocurrencies as a form of money ........................ 10 Monetary economics of cryptocurrencies ............................................................... 14 3.1. 3.1.1. Definition of money ................................................................................ 15 3.1.2. Functions of money ................................................................................ 15 3.1.3. Value theory considerations .................................................................... 17 3.2. Incentive of the general user ................................................................... 20 3.2.2. Incentive of miners ................................................................................. 21 Monetary policy ............................................................................................... 22 3.3.1. Money supply ......................................................................................... 23 3.3.2. Money demand ....................................................................................... 24 3.3.3. Exchange rate regimes ............................................................................ 27 Evaluation framework............................................................................................. 30 4.1. General framework........................................................................................... 30 4.1.1. Quantitative pillar ................................................................................... 30 4.1.2. Qualitative pillar ..................................................................................... 31 4.2. Data .................................................................................................................. 32 4.3. Methodology .................................................................................................... 35 4.4. Results .............................................................................................................. 38 4.4.1. Similarity analysis................................................................................... 40 4.4.2. Distribution fitting .................................................................................. 44 4.4.3. Regression model .................................................................................... 46 4.5. 5. Cryptocurrency ecosystems ............................................................................. 19 3.2.1. 3.3. 4. Theory of money .............................................................................................. 15 Discussion on Bitcoin ...................................................................................... 49 4.5.1. Bitcoin as a medium of exchange ........................................................... 50 4.5.2. Bitcoin as a unit of account..................................................................... 52 4.5.3. Bitcoin as a store of value ....................................................................... 54 4.5.4. Bitcoin’s design: the issue of money supply inflexibility....................... 57 Conclusion .............................................................................................................. 60 v 6. References ............................................................................................................... 62 7. Appendix I: Technological background .................................................................. 73 7.1. 7.1.1. Cryptographic hash function ................................................................... 73 7.1.2. Hash pointer ............................................................................................ 77 7.1.3. Blockchain .............................................................................................. 78 7.1.4. Merkle tree .............................................................................................. 79 7.1.5. Digital signature ...................................................................................... 80 7.1.6. Identity management with public keys ................................................... 84 7.2. Basic model of cryptocurrencies ...................................................................... 84 7.2.1. Double-spending attack .......................................................................... 86 7.2.2. Non-trust-based solutions ....................................................................... 89 7.2.3. Sybil attack ............................................................................................. 90 7.2.4. Consensus algorithm ............................................................................... 91 7.2.5. Block reward ........................................................................................... 92 7.2.6. Proof-of-work ......................................................................................... 93 7.2.7. Proof-of-stake ......................................................................................... 95 7.2.8. 51% attack............................................................................................... 95 7.3. 8. Cryptography.................................................................................................... 73 Links between technology and economics ....................................................... 98 Appendix II: Putting Bitcoin into a historical context .......................................... 100 8.1. History of money............................................................................................ 100 8.2. Comparing Bitcoin to historical forms of money .......................................... 103 9. 10. Appendix III: Relationship between Bitcoin’s price and the public’s interest ..... 106 Appendix IV: Statistical background ................................................................ 108 vi List of figures Figure 1: Transacting in Bitcoin using digital signatures ................................................. 7 Figure 2: Block headers chained together containing the Merkle root ............................. 9 Figure 3: Deviation of the simple average from the trade-weighted average ................. 33 Figure 4: Bitcoin log return variability in a strip/box plot, and a scattergram................ 39 Figure 5: Relative and cumulatice frequency histrogram of BTC/USD returns............. 41 Figure 6: P-P plot of BTC/USD daily log returns........................................................... 43 Figure 7: Q-Q plot of BTC/USD daily log returns ......................................................... 43 Figure 8: Fitting the BTC/USD log returns with an estimated logistic distribution ....... 44 Figure 9: Estimated frequencies of the BTC/USD log returns ....................................... 45 Figure 10: Estimated cumulative relative frequency of the BTC/USD log returns ........ 45 Figure 11: Model performance: predicted Bitcoin volatility vs. observed volatility ...... 48 Figure 12: Standardized coefficients of the model ......................................................... 49 Figure 13: Payment currencies of the dark web ............................................................. 51 Figure 14: 30-day standard deviation of BTC/USD daily returns .................................. 53 Figure 15: Purchasing power of the United States dollar ............................................... 55 Figure 16: The USD price of Bitcoin and its calculated exponential trend .................... 56 Figure 17: Projected money supply in the Bitcoin system ............................................. 58 Figure 18: The cryptographic hash function SHA-256 at work ..................................... 74 Figure 19: Representation of a cryptographic hash function producing a collision ....... 75 Figure 20: Illustration of a hash pointer.......................................................................... 78 Figure 21: Illustration of a blockchain ............................................................................ 79 Figure 22: Illustration of a Merkle tree ........................................................................... 79 Figure 23: Example for sending a digitally signed message .......................................... 82 Figure 24: The process of transferring the ownership of CoinID #1 .............................. 86 Figure 25: Double-spending attack by actor “A” ........................................................... 87 Figure 26: Centralized solution to double-spending attacks ........................................... 88 vii Figure 27: Estimated hash rate distribution among Bitcoin mining pools ..................... 98 Figure 28: Evolution of general interest in cryptocurrencies in the past 10 years........ 106 Figure 29: Relationship between the USD price of bitcoin and its global interest ....... 107 Figure 30: Standardized residuals / Bitcoin 30D volatility........................................... 108 Figure 31: Bitcoin 30D volatility / Standardized residuals........................................... 109 Figure 32: Predicted Bitcoin 30D volatility / Standardized residuals .......................... 109 List of tables Table 1: List of Bitcoin exchanges used for gathering data in the evaluation ................ 33 Table 2: List of currencies used in the evaluation exercise ............................................ 34 Table 3: List of Bitcoin key performance indicators used in the evaluation .................. 35 Table 4: Proximity matrix of Bitcoin and 9 other currency pairs ................................... 40 Table 5: Overall similarity with the entire currency market (24 variables) .................... 40 Table 6: the skewness and kurtosis of BTC/USD log return distribution ....................... 42 Table 7: Normality test for BTC/USD log returns .......................................................... 42 Table 8: Estimated parameters of Bitcoin's logistic distribution .................................... 46 Table 9: Summary statistics for model variables ............................................................ 47 Table 10: Correlation matrix of model variables ............................................................ 47 Table 11: Calculated variance inflation factors for model variables .............................. 47 Table 12: Estimated cost of 51% attacks against major cryptocurrencies ...................... 97 Table 13: Standardized coefficients of the model ......................................................... 108 Table 14: Proximity matrix of Bitcoin and 23 other currency pairs ............................. 110 Table 15: Full list of similar currency pairs .................................................................. 110 Table 16: Descriptive statistics for the BTC/USD log returns...................................... 110 viii List of abbreviations BIS Bank for International Settlements BTC The ticker symbol for Bitcoin BTC/USD The U.S. dollar exchange rate of Bitcoin (USD per 1 BTC) DAO Decentralized Autonomous Organization DSA Digital Signature Algorithm ECB European Central Bank ECDSA Elliptic Curve Digital Signature Algorithm EUR Ticker symbol for the euro EUR/USD The U.S. dollar exchange rate of euro (USD per 1 EUR) FRED Federal Reserve Economic Data GBP/USD The U.S. dollar exchange rate of pound sterling (USD per 1 GBP) GDP Gross Domestic Product IMF International Monetary Fund KPI Key Performance Indicator P2P Peer-to-Peer PoS Proof-of-Stake PoW Proof-of-Work RSA Rivest–Shamir–Adleman (public-key cryptosystem) SHA-256 Secure Hash Algorithm-256 USD Ticker symbol for the United States dollar USD/CHF The Swiss franc exchange rate of the U.S. dollar (CHF per 1 USD) USD/JPY The Japanese yen exchange rate of the U.S. dollar (JPY per 1 USD) VCS Virtual Currency Scheme VIF Variance Inflation Factor ix Preface Milton Friedman foretold the rise of cryptocurrencies in an interview almost two decades ago, saying the following: “I think that the Internet is going to be one of the major forces for reducing the role of government. The one thing that’s missing, but that will soon be developed, is a reliable e-cash, a method whereby on the Internet you can transfer funds from A to B without A knowing B or B knowing A.” (Friedman, 1999) It is an astonishing prediction, which shows how clearly he saw the looming innovations in finance. Considering this, I am a very late joiner in the field of disruptive financial technology. I only started paying attention to cryptocurrencies in early 2013, when I was writing for Portfolio, an online financial journal in Hungary. At the time, the topic was already heated, and I was on the skeptical side at first. It took me years to realize that the idea of reshaping money in a digital world is in fact remarkable from a theoretical perspective. We are still at a point in time, where the fate of cryptocurrencies, and digital currencies as a whole, is undecided. However, if one truly understands why the Bitcoin system took off, when all previous attempts failed, its innovative greatness becomes evident. That is why Bitcoin is worthy of further research, no matter what its future holds. It took me over a year, and a course on cryptocurrencies, to find out where more academic work is worthwhile in this field. I saw two areas of particular interest: the design of cryptocurrencies and their evaluation as a form of money. It turned out that these two areas are closely linked together. In this thesis work, I attempted to map out all the relevant monetary economic aspects of cryptocurrencies in order to build an evaluation framework. In my view, cryptocurrencies have sound technological pillars, yet some of their economic design elements are suboptimal, leading to imperfect forms of money. I sincerely hope that my efforts presented in this paper will contribute to the understanding of how cryptocurrencies, and Bitcoin in particular, function as a novel form of money. I would like to express my gratitude to Princeton University, for making their online course called “Bitcoin and Cryptocurrency Technologies” free to enroll. I also truly appreciated that the Central Bank of Hungary allowed me to attend its Digital Currency Conference in late 2017. I am particularly grateful for the reviews given by Robert Rosenkranz, Ferenc András, Petra Háhner, and Dr. Péter András. Most importantly of all, I would like to thank my advisor, Dr. Gergely Kis for his valuable inputs and guidance. All remaining errors are mine. x 1. Introduction Money has taken many forms in the course of human history, and how people see it today, may turn out to be very different in the future. What constitutes money is an ambiguous question, and how it evolved in the past is also a matter of academic debate (Iwai, 1997). It is quite clear though, that the central authority over money was ever increasing throughout the centuries. The establishment of central banks from the 17th century onward have led to a monopolization of the money supply. The historical ties to precious metals were ultimately cut in the 20th century, when the Bretton Woods system of monetary management was abolished (Bordo, 1993). This gave rise to governmentbacked fiat currencies, whose exchange market has grown to become the largest market in the entire world in terms of trading volume (Bank for International Settlements, 2016). On the 31st of October 2008, the appearance of Bitcoin 1 (Nakamoto, 2008), the first functioning cryptocurrency, posed a difficult question: can a decentralized digital currency overtake the conventional, centralized arrangement? The timing of its introduction was likely intentional, and the creator(s) may have hoped that the turmoil of the global financial crisis will allow for its mass adoption as a new currency and a worldwide payment system. A decade after its release, the Bitcoin system has grown substantially, and over 1500 other cryptocurrencies have emerged as well. These cryptocurrencies have a total market capitalization of over 200 billion U.S. dollars (USD) as of November 2018 (Coinmarketcap, 2018), which is an order of magnitude more than two years ago. 2 It is also noticeable that leading cryptocurrencies, such as Bitcoin, have an increasing number of users, and an increasing number of merchants are adopting it as a valid form of payment (Coinmap, 2018). Bitcoin’s acceptance was estimated to be over 100,000 as of early 2015 (Cuthbertson, 2015), while its user base was reported to be between 3 and 6 million in 2017 (Hileman & Rauch, 2017). Despite the vast amount of information accumulated on the subject of cryptocurrencies, a number of fundamental questions are still unanswered. Can they be considered money? How can they be valued? What are the right tools for assessing their performance as a form of money or as a digital asset? Cryptocurrencies are young, and they encompass a diverse range of scientific fields such as information technology, 1 This paper spells Bitcoin with a capital letter, when referring to the system as a whole, and with lowercase letter (bitcoin) when talking about currency units. 2 Own calculation based on Coinmarketcap’s (2018) estimate for total value on 10 November 2018 and two years prior to that. 1 cryptography, and monetary theory. For this reason, it will likely take years to fully understand the potential of this new innovation. It is reasonable to assume that cryptocurrencies can have the greatest impact on our society, if they can revolutionize today’s payment system. In fact, this is the main assumption on what Bitcoin stands for: its community believes that it should serve as (global) money, and that it has the potential for surpassing current forms of payment (Bitcoin.org, 2018). However, a number of economists challenged this view, naming a range of concerns about Bitcoin’s mass adoption (e.g. Krugman, 2013). Such views fall into two broad categories: the economic and the technical problems of how Bitcoin operates. There are claims that Bitcoin is unable to function as money due to it being overly volatile (e.g. Yermack, 2015). In fact, the same claim can be directed at other free-floating cryptocurrencies as well, since they behave in a similar way. Defendants of the technology argue that as Bitcoin, along with other cryptocurrencies, gains prominence as a new form of money, its volatility will decrease (Bitcoin.org, 2018). This hints that it may just be a matter of adoption rate, how well it serves as money. Yet again, there are also views, which contradict this statement by pointing to inherent design flaws, which render these currencies volatile for life (see Iwamura et al., 2014). One of the chief concerns in this respect is the overly rigid monetary policy of such systems. In Bitcoin’s example, the currently agreed protocol is that new bitcoins are only created in exchange for computing power, which is employed in operating and safeguarding the system. However, the rate of bitcoin issuance is predetermined: its creation is set to decrease geometrically, and the total number of bitcoins is capped at 21 million. Bitcoin has no active monetary policy tool as of today, and thus it cannot react to money demand shocks. Its design is fundamentally different from today’s conventional currencies, where monetary policy is set by central banks, and money creation is primarily done by the banking sector. This raises the question, whether it is even possible to achieve a stable price with the fixed money supply rule of Bitcoin, and if not, how well can it still function as money. These questions also apply to other cryptocurrencies, which have a similar design for a controlled money supply. Interestingly, this feature is so deeply rooted in the philosophy of cryptocurrencies, that the Bitcoin community, for example, lists it as one of its fundamental principles. One that is “prohibited” to change (Bitcoin Wiki, 2018a). 2 These concerns and arguments show how complex cryptocurrencies are. Consequently, there is a strong need for an economic evaluation framework in this field. Previous academic work in this area have led to many contradictions. As it will be demonstrated in Section 2.3. of Chapter 2, even analyses on the monetary nature of cryptocurrencies alone have led to different results, which need to be addressed. In this thesis, an attempt is made for creating a framework for the evaluation of cryptocurrencies as a form of money. This is merely a subset of the many economic questions that would require a framework by which to analyze the vast number of cryptocurrencies. Furthermore, note that related research is quite rare in this field (for an exception, see Burnie et al., 2018). Understanding the monetary nature of cryptocurrencies is fundamental, and needs to be addressed for the following reason: if cryptocurrencies cannot properly serve as money, then much of the ongoing debate around them would become pointless, and a vast portion of related investments would go to waste. It is not a straightforward task to create a framework for the monetary analysis of cryptocurrencies. A range of quantitative models and qualitative methods are needed. Interestingly, the latter part is the more difficult. A quantitative analysis of the time series behavior and the probability distribution function of a currency’s returns is a straightforward exercise, when adequate data is at hand. Of course, such analysis also has its pitfalls, however, it is the qualitative assessment of the obtained results, which is the most difficult. In this respect, this thesis takes the three fundamental functions of money as its guidance of analysis, as it was found to be the most used method in monetary economics. Supplementary to that, this framework also considers how monetary policy is designed in a given system. Essentially, all of these steps aim to cover the key monetary aspects of a cryptocurrency. As a demonstration on how this framework can be applied, a case study is made on Bitcoin, which is the leading cryptocurrency today (Coinmarketcap, 2018). This thesis is structured as follows: the introduction is followed by an overview of the technological foundations and the relevant literature in Chapter 2. Afterwards, a separate chapter is devoted to presenting the related topics in monetary economics. Here, special emphasis is made on introducing the three fundamental functions of money. Afterwards, Chapter 4 lays down the key elements of the proposed framework and applies it on the case of Bitcoin. Here, Bitcoin’s money functions are analyzed in detail. Furthermore, a modeling exercise is conducted to explain the volatility of Bitcoin, which is hypothesized to be its Achilles’ heel. Then, Chapter 6 concludes the main findings of this thesis. 3 The appendices serve four distinct roles: Appendix I provides a detailed mapping of cryptocurrency technologies, which is necessary for understanding their overall design. Furthermore, there are many peculiar links between the technology and the economics of cryptocurrencies, which need to be understood for a thorough discussion. Thus, there will be several references to this appendix throughout the main parts of this thesis. Appendix II serves a different purpose by putting the era of cryptocurrencies into historical context. It provides a detailed overview on the evolution of money, which is important for understanding that this process is not necessarily finished. Appendix III provides some insight on how public interest grew with the success of Bitcoin, and helps understand how young this interdisciplinary research field really is. Finally, Appendix IV gives additional background on the statistical exercise conducted in Chapter 4. 4 2. Technological foundations and literature overview This chapter lays down the necessary technical foundations of cryptocurrencies, and puts the discussion of this thesis into academic context. However, it does not serve as a comprehensive overview of this entire field of research, as that would be overly broad. The literature on cryptocurrencies has two distinct areas: one that deals with the technology itself, and the other, which discusses the related economic topics. Within these fields, several additional research areas have emerged as well. On the technological side, a significant share of the published work deals with the security properties of the technology, including the resilience of peer-to-peer networks and the blockchain. While on the economics side of the discussion, many tried to assess the viability of leading cryptocurrencies as a form of money, a digital asset, or have dealt with the topic from a macroeconomic or regulatory perspective. In this chapter, the focus is on those publications, which have discussed cryptocurrencies, and Bitcoin in particular, as a possible form of money. The many other technological and economic research areas will not be covered, as they fall outside the focus of this thesis. As a background to this chapter, Appendix III presents an overview on how public interest grew in the topic of cryptocurrencies. This is useful for understanding how young this research area really is, and why there are still so many topics that require more academic inquiry. Furthermore, it also demonstrates why most of the public attention was devoted to Bitcoin: interest in cryptocurrencies is highly correlated with the price of bitcoins, and thus many other important topics were not given enough scrutiny yet. In the following, the working concept of Bitcoin is introduced first, which is the leading prototype of cryptocurrencies, and the understanding of its design is essential for any later discussion of the topic. Afterwards, a number of institutional reports and academic publications are discussed in relation to the monetary aspects of Bitcoin and other cryptocurrencies. 5 2.2. On the design of a cryptocurrency This section describes the foundations of cryptocurrency technologies by explaining the technical structure of Bitcoin. The technological blocks are presented in a logic similar to how Satoshi Nakamoto (2008) did it in his or her 3 whitepaper, with a number of additions based on the work done by Narayanan et al. (2016). The starting idea of Bitcoin was about the need for a digital payment system, where no trusted third party is present. More precisely: where this trust is replaced by cryptographic proof. To achieve this, Nakamoto (2008) proposed a solution based on a peer-to-peer (P2P) network, which uses distributed consensus to serve as a timestamp server. Such a mechanism is capable of generating non-reversible transactions. The structure of this system has several technical parts, which are discussed in the following. Chain-linked digital signatures serve as the basis for digital tokens or coins (such as bitcoins). After the initial coins are introduced into the system, all transactions are done by coin owners signing the hash of the originating transaction and the public key of the future owner by their private keys. Ownership of coins can be verified by anyone using the available public keys. See Section 7.1.5. of Appendix I for more details on how digital signatures are used. Building on this digital signature scheme, transactions can be made at will. However, a double-spending attack can occur in such a transaction process (see Section 7.2.1. for a more detailed explanation on how it can happen), which was among the fundamental obstacles for designing electronic money before the Bitcoin era (Narayanan et al., 2016). Bitcoin “defeats” double-spending attacks by introducing a timestamp server, where all transactions are publicly announced. Bitcoin does this by broadcasting all transactions to all nodes in the peer-to-peer network, where participants of the system agree on one history of payments (for more on this idea, see Dai, 1998). This timestamp server works by hashing each and every block of transactions, and publishes these hashes over the network. Since these hashes contain timestamps, this way they are put on top of each other, creating one clear chain of events (Haber & Stornetta, 1991; Nakamoto, 2008). 3 Satoshi Nakamoto’s true identity is still unknown as of early November 2018, and the various rumors that surfaced so far have all failed to convince the Bitcoin community. For this reason, one cannot be sure, whether Nakamoto is a man or a woman, though this Japanese pseudonym refers to a male person. 6 Figure 1: Transacting in Bitcoin using digital signatures (Source: Nakamoto, 2008, p2.) This timestamp server is operated by using a proof-of-work (PoW) system designed after the idea of Hashcash (Back, 2002). Participants of this PoW look for a particular number, which if hashed together with a given block’s other items using the Secure Hash Algorithm 256 (SHA-256) results in a hash beginning with a certain number of zeros (this is the initial design solution proposed by Nakamoto, 2008). The difficulty of executing such work is exponentially related to the number of zeros required, however, the result can be easily verified. For a more detailed explanation of PoW, refer to Section 7.2.6. of Appendix II. This PoW system also serves as the basis for decision-making in Bitcoin. This way, votes in the system are proportional to computing power, and the longest branch of blocks shows the decision of the majority. This means that this branch has the most computational effort put into it. Thus, modifying this element would not just require redoing the PoW of the targeted block, but the PoW of all consequent blocks as well. Consequently, if the majority of block creators are acting honestly (according to the reference protocol), there is no way to outpace their work. The probability of a weaker adversary to win over an honest node diminishes exponentially, as more blocks are added to the chain, as mathematically proven by Nakamoto (2008). Furthermore, Bitcoin’s PoW 7 is designed to automatically adjust its difficulty parameter to keep up with technological advances in information technology. See Section 7.2.6. of Appendix I on how this parameter works. Building on the solutions described in the previous paragraphs, the Bitcoin network is almost fully operational. However, there is still need for a protocol to achieve consensus in the system. Section 7.2.4. of Appendix I describes this consensus algorithm in detail, but the five major steps for Bitcoin are listed in the following as an example: 1. Payees broadcast their transactions to all nodes of the P2P network. 2. Every node collects all broadcasts and organizes them into blocks. 3. Every node works on the PoW system to find a nonce 4 and earn the right to build the next block. 4. When the nonce is found, the winning node broadcasts its block to the entire network. 5. Nodes only accept it, if all the transactions contained in that block are valid. In this case, the next winner extends this block by building on it. Getting the nodes to act in an honest way and follow this reference protocol is not a self-evident task. This is why incentives are added to the system, which is an innovative idea first proposed by Nakamoto (2008). Bitcoin implements an incentive system by making the first transaction of every newly created block unique. This step creates a given number of new coins that the creator of the block can harvest. Along with the possibility of transaction fees, this total monetary reward is called the block reward. (Section 7.2.5. of Appendix I provides a more detailed background on this.) In Bitcoin, there is a predetermined maximum number of bitcoins that can be harvested this way. After 21 million bitcoins, the block reward will only be comprised of transaction fees (Bitcoin Wiki, 2018b). To make this system work efficiently on a technical level, there is need for a specific data handling technique. This is achieved by using Merkle trees to store old transaction data in the Bitcoin system. Section 7.1.4. of Appendix I explains that it is enough to only store the root of the Merkle tree in a block’s hash (the block header), while still being reassured about the data’s integrity. Nakamoto (2008) predicts that this way the storage requirements will not be an issue in the Bitcoin system, if one takes Moore’s Law on 4 In cryptography, a nonce is a random number that is uniformly spread out across a given spectrum and is only used once in communication. 8 growth into account (for more background on this law, see Mack, 2011). Figure 2: Block headers chained together containing the Merkle root (Source: Nakamoto, 2008, p5.) It is worth noting that payment verification does not require running a full node in the Bitcoin network. Block headers from the longest valid branch are sufficient for seeing that a transaction was accepted or not (Narayanan et al., 2016). Bitcoins can also be split in value, while input transactions can be combined for creating outputs, giving a certain level of flexibility to payments. Changes resulting from transactions are handled in a way that there are always two outputs for a bitcoin transfer: one that is directed at paying someone, and the other for returning the change to the owner. Identities in the Bitcoin network are linked to public keys, as the Bitcoin address of a given individual is a hashed public key (Bitcoin Wiki, 2018c). Privacy can be ensured by making sure that the real owners are not identified to be the owners of a given public key. This can be further supported by the usage of new key pairs for every transaction, making the identity even harder to explore. However, links can still be discovered making it possible that the owner of several keys is revealed to be the same person (Narayanan et al., 2016). This type of identity management is discussed in Section 7.1.6. of Appendix I. The building blocks described above provide the backbone of the Bitcoin system, and essentially serve as the technical foundation for a vast number of other cryptocurrencies, or altcoins. These design elements add up to a decentralized system, which can handle electronic payments without the need for a trusted third party. Perhaps the most significant idea introduced in Bitcoin’s design is the use of a proof-of-work system in a peer-to-peer network to prevent double-spending attacks (or more precisely: make them impractical). 9 Furthermore, the Bitcoin network’s consensus mechanism is robust, even if the network itself has many problems. These ideas and design elements provided the first fully functional cryptocurrency in history (Narayanan et al., 2016). 2.3. The state of research on cryptocurrencies as a form of money In the following paragraphs, a selection of institutional reports and academic papers are discussed, which deal with the monetary aspects of the technology introduced in the previous section. First, a number of major reports are considered from leading international organizations, who delegated entire teams of experts to investigate the monetary nature of cryptocurrencies, such as Bitcoin. One such comprehensive assessment on cryptocurrencies came from the Bank for International Settlements (BIS) in 2015. In their report on digital tokens, such as bitcoins, the BIS determines that these inventions do show a number of monetary characteristics. Despite having zero intrinsic value and not being backed by any entity, these assets – as the BIS describes them – do serve as a means of payment. The report also notes that there may be gaps in conventional payment services that these new currency schemes could address with their advantageous properties, such a global reach and reduced transaction fees (Bank for International Settlements, 2015). However, a new analysis conducted by researchers of the BIS reached a different conclusion. They note in their 2018 Annual Economic Report that the observed properties of cryptocurrencies suggest that they do not work as money, and only the underlying technology shows promise. In this respect, they believe that it can serve a special role in low-volume cross-border payments, where the benefits of the system exceed its higher operating costs (Bank for International Settlements, 2018). Another major institution, the European Central Bank (ECB) also issued a study on the emergence of cryptocurrencies as a new form of retail payments. The ECB (2015) describes these innovations as virtual currency schemes (VCS), and analyzes them from a monetary economics perspective. They do not regard a VCS, such as Bitcoin, to be a fully functional form of money. Instead, the ECB defines these innovations as digital representatives of value. However, they do note that under certain circumstances, these items can be used as an alternative form of money. The ECB concludes that using VCS is a drawback to retail users due to a list of inherent disadvantages, such the anonymity of actors, the high volatility of price, and the high dependence on information technology 10 and networks (European Central Bank, 2015). 11 Following on the tracks of the BIS and the ECB, the International Monetary Fund (IMF) has also issued a staff discussion note on virtual currencies. The IMF (2016) notes that virtual currencies offer a range of benefits to its users, including increased speed and efficiency in conducting payments, particularly in cross-border situations. However, the Fund also notes that this new form of money poses significant risks, as they can be potential vehicles for money laundering, tax evasion and various other types of fraud. The IMF states that from the perspective of monetary policy, these virtual currencies cannot yet pose a problem, meaning that they are not threatening the conventional fiat currency based financial system. However, they hypothesize that if these technologies get globally adopted, they may eventually pose a financial stability risk. For this reason, the IMF argues that responsive policies should be developed on both a national and an international level to better contain the risks associated with the spread of cryptocurrencies (International Monetary Fund, 2016). Two researchers from the Bank of Canada have taken a new approach in the monetary analysis of cryptocurrencies. They developed a general equilibrium model to identify the optimal design of blockchain-based cryptocurrencies. As a testing exercise, the model was calibrated to Bitcoin’s transaction data to allow for a quantitative assessment. They argue that the Bitcoin scheme generates a welfare loss equivalent to 1.4% of consumption, however, this can be reduced with an alternative policy design. They also note that cryptocurrencies are the most efficient when the volume of transactions is adequately large in comparison to the individual-level transactions size (Chiu & Koeppl, 2017). A team of Japanese academics also provided a unique work on the monetary properties of Bitcoin. Iwamura et al. (2014) diagnosed the instability problem of the leading cryptocurrency. In their view, Bitcoin was designed to serve as a payment method, while also functioning as a store of value. They demonstrate that the money supply rule of Bitcoin may be the main driver of its instability, seriously hindering its money functions. For this reason, their paper proposes an alternative monetary policy rule to stabilize Bitcoin’s value (Iwamura et al., 2014). Concerning the analysis of money functions, Yermack (2015) explores the properties of Bitcoin, and ascertains that it largely fails as a medium of exchange, a store of value, and as a unit of account. He bases these statements on a comparison of volatility metrics to conventional currencies, and notes that Bitcoin does not correlate with precious metals like gold either. Thus, he concludes that Bitcoin is not useful from a risk management perspective either. 12 Ammous (2016) conducts a similar analysis as Yermack (2015), though he analyzes five cryptocurrencies to see if they have an acceptable monetary role as a medium of exchange, a store of value, and a unit of account. He concludes that although there are no theoretical limitations for cryptocurrencies to fulfill these roles, their inherent stability issues prevent them from doing so. In his assessment, only Bitcoin could serve as store of value, because it has a strong commitment to a low money supply growth. In a recent paper published in the journal called Ledger 5, Burnie et al. (2018) proposes a novel classification scheme to help understand the nature of different crypto tokens. They categorize cryptocurrencies into three main segments: “crypto-transaction”, “crypto-fuel”, and “crypto-voucher” tokens. This is achieved by using a new framework for identifying their inherent functionality. As a part of this exercise, they also look at how different cryptocurrencies perform the core functions of money, and how their design affects their overall usability. They note that contrary to much of the negative commentary on this new technology, clear fundamentals can be identified (Burnie et al., 2018). This novel attempt at standardizing the analysis of the cryptocurrency landscape may serve an important role of guidance in future research. Based on this selection of institutional assessments and academic works, it shows clearly that there is no consensus on the monetary role of cryptocurrencies. All studies point out the issue of high volatility, however, there are significant differences in how they evaluate its consequences. It is a general approach in the academic literature to consider the three fundamental functions of money as a point of reference, yet even in this exercise, academic views differ. These disagreements can only be settled by considering new, standardized frameworks for the analysis of this technology from a monetary perspective. Before delving into the development of such a new framework in this thesis, a number of topics have to be explored in monetary economics. Thus, the following chapter maps out a range of concepts and definitions, which are relevant for the monetary analysis of cryptocurrencies. 5 It is the first peer-reviewed academic journal, which deals with research topics in cryptocurrency and blockchain technologies. 13 3. Monetary economics of cryptocurrencies This chapter discusses a list of topics in economics, which are relevant for the analysis of cryptocurrencies. An economic analysis in this respect could deal with the behavior and interactions of various agents within the network or look at the properties of the underlying ecosystem in general. It could also deal with an analysis of how transactions spread in the real world, and how it benefits its users and ultimately shapes the world of finance. However, this thesis does not aim to cover all these areas of cryptocurrency economics, but rather focus on the monetary aspects alone. Before everything else, it should be emphasized that the very nature of cryptocurrencies is open to ambiguity (see for example Bjerg, 2015; Yermack, 2015). Some scholars define them as currencies, while others see them as assets, and there are even such economists, who see no value or any particular use for them. For this reason, this chapter begins with a discussion of what constitutes money, and how digital currencies, such as cryptocurrencies, could fit into this picture. Special focus is given to describing the functions of money, and how that can be understood in the context of cryptocurrencies. Later on, value theories are considered for deriving the value proposition of these new forms of money, and it is also discussed what incentivizes miners and other agents to take part in such systems. Afterwards, this chapter covers the monetary policy aspects of cryptocurrencies, in particular the questions regarding the supply and demand for money. Lastly, alternative exchange rate regimes are discussed, most prominently the “stablecoin” concept. These coming topics are ordered in a way to facilitate the understanding of cryptocurrency design choices. Ultimately, this chapter provides a descriptive answer to three fundamental questions in monetary economics, which are a prerequisite to building an analytical framework for cryptocurrencies: 1. Are cryptocurrencies money? 2. Do they have any value? 3. What are the ways to control their value? 14 3.1. Theory of money 3.1.1. Definition of money Money has taken many forms throughout the course of history, and neither its definition, nor its classification is overly straightforward. In academic textbooks, money is defined as a type of item that serves the purpose of paying for goods and services and settling various types of debts (Mishkin, 2011). As such, the definition of money is closely connected to the function it serves, and not to the object in which it manifests itself. For this reason, there is no such limitation – concerning the nature of money – that it has to be physically present. To many, this may seem like an obvious statement, given the widely used nature of today’s electronic payments. People use credit cards to transfer currencies 6 between bank accounts, without any physical cash being involved. It is, however, a crucial question when it comes to the discussion of virtual currencies and cryptocurrencies, as their nature is quite different from any other forms of money used by humanity before. Based on current academic literature, money definitions do not exclude cryptocurrencies, if they can serve the functions of money. The next section deals with this topic. 3.1.2. Functions of money In the early academic literature, money was analyzed in terms of four basic functions. However, this categorization of fundamental money functions were later reduced to three in the modern literature by dropping the fourth on this list (Mankiw, 2018): 1. Medium of exchange 2. Unit of account 3. Store of value 4. Standard of deferred payment (later excluded) The reason was that academics saw the standard of deferred payment as being already encapsulated in the other three functions, and thus it was deemed not worthy of a separate pillar (Mankiw, 2018; Krugman & Wells, 2012; Bernanke & Abel, 2005). 6 The definitional difference between money and currency is that currency is such money, which is in use as a medium of exchange. 15 Accordingly, this section only deals with the three widely accepted functions of money, as per the categorization followed in contemporary macroeconomics textbooks (e.g. Mankiw, 2018). 1. The medium of exchange function is concerned with the fundamental role of being able to pay with money. Money has to be accepted by merchants and other actors in exchange for goods and services. Otherwise, it cannot act as an efficient intermediary between transacting parties, and does not eliminate the need for barter. 2. The unit of account function ensures that money can be used to measure the quantifiable value or cost of a certain real good or a debt. In microeconomics, the prices of goods and various resources are established in relative terms, that is: in ratios of other goods and resources. Money can be used in this setting to serve as a standard meter of value, and thus facilitate the understanding of prices. 3. The store of value function ensures that one can convert his or her purchasing power today to purchasing power in the future. Money allows people to postpone transactions without sustaining a significant loss. This way, if one receives 100 euros of payment today, that individual can choose to spend it tomorrow, or even in a year’s time. Of course, money is never a perfect store of value, as prices have a tendency to rise in modern economies, and thus the real value of money depreciates with time. Still, it is a crucial requirement of any form of money that one can choose to pay with it at a later point in time, and that it reasonably upholds its value until then. These three functions are fundamental to the usefulness of a particular money in the economy. With these features present, money allows individuals to overcome the limitations of barter. In an ideal setting, one can use the money he or she acquired for buying any kinds of goods on the market, at any point in time. Furthermore, the price quotes in that given money should facilitate the understanding of the value of any particular good in the economy. Most of today’s fiat currencies fulfill these fundamental functions of money, however they did not do it always, and there are differences in how they do it today. For example, there are currencies, which have higher levels of inflation, degrading their store of value function. Additionally, some currencies – typically issued by smaller, emerging market economies – are not freely convertible to other currencies, and thus may not allow an 16 individual to acquire any good he or she wants on international markets. Such differences in how various nations’ currencies fulfill these functions of money have led to the favoring of one currency over another. This phenomenon is most prevalent in high-inflation environments, where macroeconomic policy is not credible, and the local currency does not serve the store of value function well enough. These economies usually have high dollarization ratios, meaning that the population prefers the U.S. dollar over their local currencies (De Nicoló et al., 2005). In the evaluation work presented in Chapter 4, it will be thoroughly investigated how Bitcoin behaves in these three important segments. Now, the next section deals with the theoretical questions of value in relation to cryptocurrencies. It is a fundamental area to address, as Bitcoin have many times been accused of holding no real value. This statement needs to be addressed before any further analytical discussion is made on cryptocurrencies. 3.1.3. Value theory considerations Since the birth of economics as a distinct scientific field, the concept of value and its relationship to prices have always been a chief concern of economists. It is not surprising that discussions on the value of money have become intense with the debut of Bitcoin. Bitcoin and other cryptocurrencies are virtual phenomena, yet they intend to serve as money, which for the most part of history was present in a physical form: cash. Even more importantly, money was associated with things of material value throughout history, such as gold or silver (see Appendix II for a detailed background). People unfamiliar with monetary economics sometimes misunderstand the nature of fiat currencies, and fail to realize that they have no intrinsic value. Another common fallacy is when someone assumes that something without intrinsic value cannot be valuable at all. They might see a contradiction in that money is exchanged for things of value, while having no value of its own. Understanding the value proposition of fiat currencies is a prerequisite to discussing the value of cryptocurrencies, since these two forms of money are similar in that neither of them have any intrinsic value. Microeconomic theory tells us that money is a tool that lowers the costs of trade (Hirshleifer et al., 2005). Such costs are related to understanding the value of goods, negotiating their exchange value, and not having to find real goods needed by the other party. These costs can be quantified, if one compares two economies, where one relies on barter and the other uses money, with all other things being equal. Microeconomic models 17 prove that having money as a medium of exchange significantly lowers the number of transactional channels needed in the economy, while also allowing for multi-channel trade. In such a setting, transactions costs are lowest, if all the economic agents agree on a single form of money (Hirshleifer et al., 2005). In this case, money could theoretically be anything that people in an economy accept as a medium of exchange. There is no need for any intrinsic or use value, and yet it can provide significant value by facilitating transactions and reducing the associated costs (note that not all transaction costs are reduced by using money). This logic allows cryptocurrencies to be valuable, despite having no intrinsic value or government guarantee. The only prerequisite is that they should be able to function as money. In the case that cryptocurrencies fail to function as money, they still do not necessarily become worthless according to alternative theories of value. The following paragraphs provide a brief overview on the main schools of thought in this respect. Early theories of value were concerned with the necessary amount of labor required to producing a certain good (see the background given by Peach, 1993). They assumed that the value of a product must be in a direct relationship to its cost of production. The more work a certain good requires, the more valuable it must be in this line of thought. This early labor theory of value was further refined by Adam Smith based on the realization that it is insufficient for explaining the price of goods. He considered a combination of the work required, and the additional costs associated with the production of a certain good to explain its value in his best-known book on the matter (Smith, 1776). The emergence of the subjective theory of value in the 19th century contradicted the labor theory of value in several key points. It asserted that the value of a certain good is dependent on its consumer, and not on the labor that goes into its production (see Stigler, 1950). This new line of thought was successful in solving a number of open questions in the field of value theory. Most prominently, it could resolve the well-known diamond– water paradox (for more on this, see Callahan, 2004). This issue dealt with the question of why diamonds are so much more valuable than water, when water is absolutely essential for life, and diamonds are not. The theory explained that even though water is fundamental for sustaining life, and as such, it is very valuable to humans, it is also an abundant resource. For this reason, additional bottles of water have diminishing value. At the same time, diamonds are very scarce, and this way, one additional diamond can be more valuable than one additional bottle of water. Thus, value is also determined by availability, or in other words: the scarcity of a given resource. 18 Most value theories can be categorized into two broad segments: objective and subjective schools. The first is concerned with the idea that goods have such properties out of which their value can be derived. This is linked to the intrinsic theory of value. The subjective school of thought contradicts this and derives value from other sources (for example from the marginal utility of its consumers). Note that there are also such variations, where these two major theories are combined. What is interesting here in relation to cryptocurrencies is that neither of these major theories dismiss them as having no value at all. Cryptocurrencies are acquired by investing computing power and electricity, thus the work and the costs associated with their production can be objectively measured. This way, based on a labor theory of value approach, they have a value objectively different from zero. In the realm of subjective value theory, and marginalism, cryptocurrencies can also have value: they are cryptographically designed to be scarce in the digital realm, and can increase consumers utility by allowing them to trade in specific markets. Without going into further details on this, it is enough to note that this allows them to have a value different from zero. In fact, there is no such dominant theory of value currently, which would conclude that digital phenomena like cryptocurrencies should have zero value. This way it was established that cryptocurrencies cannot be simply dismissed by stating that they have no intrinsic value and thus have zero value. This chapter now continues with the topic of the mining ecosystem, which explains another crucial element in the design of cryptocurrencies. 3.2. Cryptocurrency ecosystems A cryptocurrency ecosystem is a subtype of a digital ecosystem. Digital ecosystems were inspired by natural ecosystems, describing communities of living organisms and their associated nonliving components. They are socio-technical systems with unique properties such as self-organization and scalability (Briscoe & Wilde, 2007). The key questions that scholars of this phenomena try to answer is why people take part in such systems, and how do they collaborate and compete with each other. It is important to cover this topic, because the operation of cryptocurrencies and the value of the money in these systems is closely linked to their respective ecosystems. Thus, it has to be considered, who is taking part in a system like Bitcoin and why. 19 Ivanov (2018) notes that the Bitcoin ecosystem has four main parts: 1. The users, who are actively participating in the system by sending and receiving bitcoins. 2. The miners, who are actively solving hash-puzzles and thus increase the money supply in the system. 3. The investors, who are injecting the system with liquidity by buying bitcoins. 4. Lastly: the developers, who are maintaining the open-source code and monitoring the entire ecosystem. It the following, the first two groups will be addressed: the perspective of the users and the miners, as they are considered the backbone of the system. Without users, there would be no use for mining, and without miners, there would be no way of using the system safely. Investors and developers are also important actors, but they are not essential for basic operation. The following subsections will now look at the incentives of these two groups in the ecosystem. 3.2.1. Incentive of the general user There is no need for any incentive program to get people to use fiat currencies in a well-functioning national economy. Merchants are obliged to accept them as a form of payment, and there are hardly any alternatives to it. However, in a dollarized economy, where the local currency is deemed less stable, incentives may be needed to get the general public off of hoarding dollars. In such cases, the means of promoting the local currency can range from monetary policy measures (such as increased interest rates) to legal rulings (such bans of foreign payments and restricting the convertibility of the local currency). Even though cryptocurrencies are different from fiat currencies, the incentives for hoarding them may be the same. People want to buy certain goods and services and thus allocate a share of their wealth to more liquid assets, such as currencies. Choosing which currency to hold (e.g. dollars or bitcoins), and in what share, will come down to practical angles. Acceptance, transaction fees, and asset price volatility will all play a role in this respect, and such an analysis will have to deal with looking at how a given currency serves the functions of money. This analysis on Bitcoin is provided in Chapter 4. 20 3.2.2. Incentive of miners Looking at the second group, the viewpoint of the miners in a cryptocurrency ecosystem is somewhat different from the case of general users (although both groups can be influential and even exercise voting rights). Miners are considered to serve as the backbone of these ecosystems, as the basic operation and the distributed consensus is achieved through their efforts. This work, however, is costly. Thus, miners actually spend quite a lot of their resources in this regard: they devote their computing power, which has an associated hardware and electricity cost, while using up some of their time in managing and updating their systems. The key question here is how an ecosystem can be designed in a way to incentivize doing this type of mining work. In the following, this topic will be discussed in respect to the Bitcoin system. As it is explained in Section 7.2. of Appendix I, miners solve computationally difficult hash puzzles to earn the right of creating the next block in the blockchain. While doing so, they are rewarded with a certain amount of newly created bitcoins, known as the block reward, which they can transfer to themselves in a special transaction in the block. Another reward can come in the form of transaction fees, and these two items serve as the main incentives for miners. Furthermore, these incentives play a key role in getting miners to act in an honest way and reach consensus. Section 7.2.4. of Appendix I explains this consensus mechanism, and Section 7.2.5. provides a detailed explanation on how the block reward functions. As it is apparent from this scheme, the prerequisite to this incentive system is that bitcoins have to be valuable. More precisely: the amount of bitcoins earned in this process has to be more valuable than the cost of resources spent on mining them. These costs can be categorized into two main parts: • Fixed costs, which include the financial investment into the hardware required for mining, and additionally (though usually not emphasized in this context) the time investment to understanding and setting up such mining servers. • Variable costs, related to the price of electricity, and the implicit labor cost of overseeing the mining farm and conducting repairs and installing updates on the machines. Since fixed costs are involved, miners are running a financial risk in participating in this scheme. Should they abandon this activity before they earned enough money to cover all their expenses, losses can arise. Thus, miners have to weigh the risks and rewards of 21 participating in this system. It is important to note a certain design element of Bitcoin in this respect: the difficulty parameter of hash puzzles is automatically readjusted to control the steady rate of bitcoin creation in the system. This ensures that no matter how many miners choose to participate in the system, they will get block rewards at the same pace (on average). This allows the mining ecosystem to scale, or even survive large population declines. Again, the only prerequisite here is that bitcoins have to remain valuable to some extent. Should it be deemed invaluable, then mining activity would cease to exist. The past paragraphs of this chapter explained the incentives of users and miners. Now, it continues with a closer look on how money is created in these systems, and what tools are present for conducting monetary policy. 3.3. Monetary policy In economics, monetary policy refers to the process by which an authority – in most cases a central bank or a currency board – aims to safeguard trust in a currency and strive for price stability in the economy (Mishkin, 2011; Mankiw, 2018). Even though cryptocurrencies do not have authorities over them to control their stability, there are still some design elements in place, which influence them. In fact, most of today’s well-known cryptocurrencies have passive monetary policy, meaning that they have set of agreed rules to follow, and these are not changed in response to economic shocks. Passive monetary policy is not unique to cryptocurrencies, there are many such monetary regimes, which can be classified as using a passive approach. A currency board for example, is a passive regime, even though it does actually react to economic shocks. In a currency board regime, the main objective is to maintain a fixed exchange rate with a foreign currency, and thus all monetary policy tools are subordinated to ensuring this. In this sense, monetary policy reacts passively, because no other considerations are made in conducting policy other than fixing the exchange rate. The monetary policy regime of most cryptocurrencies is similarly passive, because they have no active decision-making over them either. Yet most of them are distinct in that they have different targets. Cryptocurrencies are (currently) non-interest-bearing currencies, and no widespread credit system is built upon them as of yet. 7 Thus, there is no way of influencing their value by setting short-term interest rates, as in the case of contemporary fiat currencies. 7 Note that in certain markets, cryptocurrencies can be lent out for others to trade, and thereby interest can be earned. However, this is fundamentally different from the interest earned on deposit accounts. 22 For this reason, the tools for conducting monetary policy is either very limited or fully absent in this realm. In major systems, such as Bitcoin, monetary policy is confined to a set of early design choices, some of which the community believes to be the fundamental principles of the currency (Bitcoin Wiki, 2018a). In the following, an overview is provided on the topic of supply and demand for money. Afterwards, this subchapter concludes by looking at alternative monetary policy schemes, such as the stablecoin concept, where the exchange rate is anchored. 3.3.1. Money supply In the modern financial world, the vast majority of money is created by commercial banks, while giving loans to the public. In fact, when a bank credits its customer’s account with a new loan, such as a mortgage, new money is created in the system. This money is sometimes referred to as commercial bank money, since it is different from cash, which only central banks can create. However, this process plays the main role in money creation in the economy (around 90% of newly created money comes from this source), and the role of central banks is mainly limited to influencing the rate of money creation (or destruction) by setting the “price” of money: interest rates (McLeay et al., 2014). Of course, they also create cash, however, it is just a fraction of the money supply in today’s economy (Ryan-Collins et al., 2014). In the world of cryptocurrencies, money supply could also be boosted by fractionalreserve banking, however, it has not taken place in any meaningful way yet. For this reason, there is no commercial bank money in “crypto finance”, and thus the money supply is just a function of inherent design elements. It can be stated that money supply in cryptocurrencies is a variant of controlled supply. In major implementations, such as Bitcoin, Litecoin or Ethereum, money supply is a function of a set of algorithms. The key difference across the range of cryptocurrency variants is thus simply a subject of what functions they chose to issue new coins with, and whether the underlying algorithms can be changed by a central authority or not. Bitcoin, for example does not have a central authority to oversee its money creation protocol, which simply follows a geometrically decreasing function. The issuance of new bitcoins is halving periodically, and thus the money supply is capped at a maximum level (21 million). Some other major implementations do not have such caps on their money supply, although, similarly to Bitcoin, in most cases the issuance rate is not constant. 23 Having a capped money supply is fundamentally different from the nature of fiat currencies, where monetary aggregates follow the trends of economic activity. If the nominal gross domestic product (GDP) grows by 5% annually, it suggests that more money is needed in the course of the transaction processes, assuming a similar level of money velocity. To mimic this scenario, cryptocurrency designs would need to match the money supply function to the money demand function derived from the fundamentals of their underlying economies. However, this is an immensely difficult exercise. So much so, that even in conventional monetary policy, where demand in the underlying economy is observable, monetary aggregates are not controlled directly (see for example Federal Reserve, 2018). It is thus an open question for cryptocurrency designers what the best method is in implementing the money supply rule. If it does not match money demand, then microeconomic theory suggests the price of the currency will fluctuate wildly. In the case of Bitcoin, Chapter 4 will take an in-depth look at how the money supply is designed and what economic consequences it might have. The following section now provides a similar overview on the theory of money demand. 3.3.2. Money demand Demand for money is the economic phenomenon of people wanting to hold a portion of their financial assets in the form of liquid assets. In today’s economy, this can materialize in the form of cash or commercial bank deposits. The emergence of cryptocurrencies adds the choice of holding digital coins as well, and modeling the incentive of economic agents becomes even more complex. In a simple scenario, where people can either hold cash-like money or long-term investments, the actors face a simple trade-off: choosing between liquid or interestbearing assets. Money demand in this situation can be derived from the reaction to this trade-off, and thus people have to optimize, and divide their assets in a way that benefits them most. According to Keynes (1936), money demand is related to a preference for liquidity, and there are three main motives behind it: 1. The first motive for holding cash is linked to a transaction motive, where people prefer assets with which they can transact in their day-to-day lives, and the amount of liquidity needed is a function of their income and spending. 2. The second is a precautionary motive, where people prefer having liquid assets to be able to react to unexpected life situations. The amount needed for such safety purposes is again proportional to income and expenses. 24 3. The third and last item here is the speculative motive. People may speculate on the price of fixed income products (such as bonds) to rise and fall, and thus choose to rather hold money. Interestingly, in the case of cryptocurrencies, this speculative motive can actually work in the opposite way: people may expect cryptocurrency value to rise more than conventional investment assets, and thus choose to hold more of that. This approach to understanding money demand has been at the core of academic models, such as the IS/LM model in macroeconomics (Mankiw, 2018). There are other models for explaining money demand in an economy, and some of them rely on different microeconomic foundations, which will not be discussed here. Understanding money demand can also be done from a top-down, big picture view. In a macroeconomic perspective, demand for money can be explained as a function of prices, incomes and money velocity in a given economy. This is called the quantity theory of money, which establishes the following important equation (Mishkin, 2011): (1) 𝑀𝑀 ∗ 𝑉𝑉 = 𝑃𝑃 ∗ 𝑌𝑌 In this model, 𝑀𝑀 stands for the amount of money in the system, and 𝑉𝑉 denotes how fast this money circulates in the economy, and how many transactions are settled with it in a given period. On the right hand side of the equation, 𝑃𝑃 stands for the average price level of the goods and services that are transacted, while 𝑌𝑌 is the total real income acquired in the economy (or alternatively: the total amount of real goods produced). This equation is true by definition in all closed economies, where transactions happen by the use of a medium of exchange. If money is used in transactions, then the total amount of money needed to satisfy economic activity is 𝑀𝑀, given constant 𝑉𝑉. In other terms, demand for money in an economy can be formulated in the following way: (2) 𝑀𝑀𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 = 𝑃𝑃∗𝑌𝑌 𝑉𝑉 Based on this equation, one can state that money demand is influenced by changes in the price level of goods, the income of individuals, and the velocity of money. This model, however, does not explain a situation, where people can choose between holding a certain 25 amount of cash at hand – which could also be in the form of cryptocurrencies – and leaving it at a commercial bank, where they receive interest on the deposit. Such a tradeoff could better explain the transaction demand for non-interest bearing money, such as most cryptocurrencies. The Baumol-Tobin model provides a theoretical answer to such tradeoffs faced by individuals, who have a continuous need for money to cover their day-to-day expenses, but do not wish to give up on holding investment assets (Mishkin, 2011). This model states that the demand for liquidity 𝐿𝐿(𝑌𝑌, 𝑖𝑖) is a function of real income and interest rates. It can be derived with taking into consideration the fixed transaction costs of withdrawing funds from a bank (𝐶𝐶) and the level of interest rates alone. The overall cost of holding money is proportional to the product of withdrawals and fixed costs, plus the foregone interest (𝑖𝑖). When the model is solved, one arrives at a money demand function that is transformed into a demand for liquidity function. It is expressed in the following way: (3) 𝐿𝐿(𝑌𝑌, 𝑖𝑖 ) = 𝑀𝑀 𝑃𝑃 =� 𝐶𝐶∗𝑌𝑌 2∗𝑖𝑖 This model could serve as a basis for explaining the trade-off of holding non-interest bearing cryptocurrencies and interest-bearing bank deposits in a modern economy, however, there is one obstacle, which cannot be overcome here. Demand for cryptocurrencies do not only have a transactional motive. In fact, it is widely believed that a speculative motive far outweighs everything else. In such a case, this model would fail to predict the true demand for money. In the current phase of cryptocurrency adoption, it is very likely that no current money demand model is able to explain the hoarding of cryptocurrencies. Chapter 4 provides an analysis of Bitcoin’s price dynamics, which shows that demand for bitcoins is so volatile that it cannot be associated with the tradeoffs discussed above. It is possible that cryptocurrencies have various phases of development, and thus the initial demand for such money is significantly different from any later phase. If so, then as these technologies age, demand for them will stabilize. Only at that point will it be possible to estimate their money demand functions with current academic theory. Section 3.3.1 established that money supply is implemented in a controlled form in most cryptocurrencies. Bitcoin has an upper limit on its money supply, however, its impact on the price of bitcoins can only be understood when money demand is taken into 26 consideration. As it was explained in this section, the academic tools for explaining money demand for a non-interest bearing currency would only be possible, if demand for them would be of a transactional nature. However, there is reason to believe that currently, it is primarily speculative. Interestingly, this speculative nature is quite different to the one explained by Keynes in his book called The General Theory of Employment, Interest and Money (1936). This speculation is not about expectations for other investment assets, but rather the value of money itself. This may be the main reason that despite a clear and simple money supply environment, modeling the equilibrium of supply and demand, and the resulting prices of free-floating cryptocurrencies is not possible. The following section concludes the discussion on the monetary policy aspects of cryptocurrencies, and provides and overview on alternative exchange rate regimes in cryptocurrency design. In some those schemes, speculative money demand is not an issue. 3.3.3. Exchange rate regimes Up until now, such cryptocurrencies were discussed, which are similar in nature to fiat currencies. However, not all of them are designed this way. In fact, two distinct categories of cryptocurrencies can be identified, which use a fundamentally different approach: 1. Free-floating cryptocurrencies, which are not linked to any hard currency or commodity, and thus their value is fully determined by market forces. 2. Stablecoins, which are such cryptocurrencies that aim for minimal volatility. This design achieves higher price stability through either hard currency pegs, or other links to various commodities, such as gold or silver. The first category serves as the norm in cryptocurrency design, as the inner philosophy of prominent systems, like Bitcoin, is that it has to be free of any government influence. Linking its value to a government-issued currency, such as the U.S. dollar, obviously destroys this notion. However, there may be genuine reasons for doing this, while retaining many of the beneficial cryptographic properties of a digital currency. Now, a general overview is provided on this choice of designing cryptocurrencies with an alternative exchange rate regime. Similar to currency boards, where a local currency is pegged to a hard currency, such as the U.S. dollar or the Euro, there is a variant of stablecoins, which simply peg to major fiat currencies. Similarly to currency boards, the prerequisite to doing this is the 27 accumulation of sufficient reserves of the backing currency. Note that in this scheme, stablecoins can no longer function as decentralized money, as a third party is needed in maintaining reserves for the peg. Accordingly, such stablecoins not only mimic the risk associated with the currency they peg to, but are actually riskier due to the presence of a third party. Should trust towards this party evaporate, the exchange rate anchor could fail. Note that there is also a certain level of cost associated with the operation of this third party. Such costs are nonnegligible, since maintaining trust in a reserve-holding institution requires establishing compliance systems and involving external auditors as well. When successfully set up, such a scheme allows people to purchase stablecoins at a fixed rate, given that their financial wealth is denominated in the same currency that the stablecoin is pegged to. In such a scenario, people are able to purchase stablecoins or redeem their pegged value at any time from the established third party, and participate in cryptocurrency transactions without being exposed to increased volatility. Of course, they still retain the volatility of the currency that the stablecoin is pegged to. An alternative to such fiat currency-backed stablecoins is the use of commodity pegs. Commodity-backed stablecoins are usually pegged to exchange-traded precious metals, such as gold or silver, and function very similarly to the previous type of stablecoins. They set a fixed ratio of value to a traded commodity, and a regulated third party financial institution serves as the custodian of the peg. Redeeming the stablecoins in this case gives possession of the underlying real assets. These stablecoins thus exhibit the same volatility as their anchor commodities, however, as it was mentioned in the previous case: they bear increased risk due to the presence of a third party. Interestingly, there is a way to operate stablecoins without relying on third-parties, however, in this case they have to be pegged to other cryptocurrencies. In such a scheme, the value of the stablecoins are ensured by relying on other cryptocurrencies, or even a portfolio of cryptocurrencies, as collateral. Pegging is implemented on the blockchain itself using smart contracts instead of a centralized authority. The money supply of such stablecoins can also be governed using smart contracts. Ensuring the price stability of these stablecoins is not a straightforward task, since the collateral used in this case is highly volatile. Thus, only a very large amount of collateral value can ensure the price stability of such stablecoins. This is why these schemes are very costly to both establish and maintain. Moreover, the complexity of this structure, along with the possible bugs in the smart contracts, introduce additional risks. 28 There is yet another type of this stablecoin concept, which tries to address the issues inherent in this design. They are implemented by decentralized autonomous organizations (DAO), which lay down issuance and pricing rules in program codes. This way, the DAO can operate the stablecoin scheme in a decentralized way, yet use a different approach for maintaining price stability. They can use such algorithms, which dynamically issues or destroys the money supply in order to respond to money demand shocks. This can reduce price volatility (in theory), yet the decisions for these actions are part of an algorithm, and thus no central authority is required. As of this writing, no stablecoins are known to have succeeded with this approach. The largest stablecoin currently on the cryptocurrency market is called Tether (Coinmarketcap, 2018). It corresponds to the first type of stablecoins described above: the fiat currency-backed design. It is claimed that each token in the Tether network is backed by a corresponding U.S. dollar, however, they may not be fully redeemable on the Tether platform (Kaminska, 2017). According to Coinmarketcap’s estimate, Tether has grown to be only second to Bitcoin in terms of trading volume (Kelly, 2018). This fact shows the need for a working stablecoin concept, and for now, it seems that the most basic idea has gained prominence in this field. This concludes the discussion of alternative exchange rate regimes in the world of cryptocurrencies, and the chapter on the monetary economics of cryptocurrencies. Thorough these sections, it was shown how money is defined, and that no definition of money excludes the idea of cryptocurrencies. Then the fundamental functions of money were introduced, which cryptocurrencies have to fulfill in order to succeed as a form of money. Afterwards, cryptocurrency ecosystems were discussed, and an overview was given on the passive monetary policy design of major cryptocurrencies. These theoretical foundations now allow for the development of a framework for monetary analysis in this field. The following chapter lays down a general solution in this respect, and then applies it on the case of Bitcoin. 29 4. Evaluation framework In the past chapters, a thorough map was laid out on the economic principles of cryptocurrencies. Appendix I also provides a thorough mapping of the technological side of these systems, while Appendix II puts these new forms of money into a historical context. Cryptocurrencies are immensely complex from both an economic and a technological point of view, and this may be the reason, why there is still no widely accepted way of analyzing their performance. To further this area of research, a new framework is proposed for analyzing one particular aspect of cryptocurrencies: how they function as a form of money. This monetary analysis framework is then applied on the case of Bitcoin, the earliest functioning cryptocurrency, which is also the largest today in terms of market capitalization (Coinmarketcap, 2018). 4.1. General framework The discipline of monetary economics provides a highly general framework for analyzing different forms of money in terms of their functions. They look at how a given currency serves as a medium of exchange, a unit of account, and a store of value. This is a good starting point for a cryptocurrency framework, however, it requires a number of supplementary tools. First, there is a need for a unique list of key performance indicators (KPI) in relation to these money functions. Second, there needs to be an agreement on how these indicators should be measured, and what the appropriate benchmarks are. Third, the consequences of cryptocurrency design have to be considered as well. The general framework proposed in this thesis deals with all of these key points, and provides a practical guide on how to analyze cryptocurrency performance. In this respect, it is divided into two pillars: a quantitative and a qualitative part. The overview of these two pillars, and their corresponding segments are listed below. 4.1.1. Quantitative pillar 1) The price of cryptocurrencies should be assessed as the average trade-weighted USD exchange rate across all exchanges. This ensures that the price used in the analysis best reflects the market’s true judgement on value. Furthermore, the longest possible times series should be acquired in all cases, as determining the 30 risk profile of cryptocurrencies becomes more accurate with more observations. 2) The forex market should be taken as the main benchmark for a similarity/dissimilarity analysis. It should always contain the corresponding currency pairs, that is: in the case of USD-based exchange rate prices, the use of USD crosses is required for comparison. Choosing the U.S. dollar in this respect is ideal, since it is the most traded currency in the world (Bank for International Settlements, 2016). The forex market pairs used in the analysis should be representative of the overall market, which can be ensured by including the four most liquid, major currency pairs, which are the EUR/USD, the GBP/USD, the USD/JPY, and the USD/CHF. Additionally, a number of emerging market currency pairs should also be included to enable for a broader comparison. 3) Calculated daily returns should serve as the basis for analysis instead of prices to make comparisons meaningful. Taking the natural logarithm of returns is advised for statistical analysis and modeling. 4) Volatility metrics should be defined as the moving standard deviation of the daily returns. A general rule of thumb in such analysis is to use a 30-day moving window. 5) Volatility, being the leading concern in the cryptocurrency market, should be analyzed quantitatively, taking all possible properties as explanatory variables. This way, information can be derived on what may be the cause of subpar currency performance, and if it can be expected to improve in the future or not. 4.1.2. Qualitative pillar 1) Using the obtained results from the first pillar, an assessment should be made on how well the given currency fulfills the three fundamental functions of money. 2) The design choices of the cryptocurrency in question have to be analyzed in relation to monetary stability. The most important area to assess in this respect is the money supply rule. The quantitative pillar of this framework provides an objective approach to measuring the relevant properties of cryptocurrencies, while the qualitative segment allows for a certain level of subjective judgement. This latter part is necessary, since the consequences of some design elements cannot be measured directly. The rest of this chapter shows how this framework is applied on the case of Bitcoin. 31 As part of the introduction in Chapter 1, it was suggested that Bitcoin might not function well as money due to excess volatility. The following sections now provide an evaluation of Bitcoin’s properties following the steps outlined in the aforementioned general framework. First, a background is given on the data used, and then the details of the quantitative approach is explained. 4.2. Data The analysis in this chapter will primarily rely on market price data for a number of items, which are going to be discussed in the following paragraphs. The most important time series data in this regard is that of Bitcoin. Since the USD price of Bitcoin is the most traded cross rate in exchanges, this evaluation will take that as the main representation of Bitcoin’s value. Many sources provide price data for Bitcoin, but caution has to be observed. Bitcoin is traded on many exchanges, and the price quotes have been found to deviate from each other quite significantly in some cases. From an academic perspective, average price quotes are preferred, however it poses additional obstacles. Some sources do provide average Bitcoin price data, however they usually do not cover the entire history of Bitcoin trading. Blockchain.com (2018) does claim to provide a full history of the average USD market price of Bitcoin across the major exchanges, however it was found to have a number of issues. First, that the databases mapped by Bitcoincharts (2018) actually provide data for such exchanges, which have prior trades available. Second, Blockchain.com only provides price data for the every second day, and not on a daily basis (only offers this for recent years). Third, it is unclear why they left out lesser known exchanges from calculating the average price of Bitcoin, since using trade weights, any bias from illiquid trades can be easily eliminated. In fact, obtaining a trade-weighted average price of Bitcoin across all exchanges makes the most sense from a research perspective, as it eliminates the exchange selection bias. 8 For this reason, a comprehensive data gathering project was done as part of this evaluation, where all known USD-denominated Bitcoin exchanges were mined of their data. In total, 57 exchanges were found to have meaningful data based on a listing by Bitcoincharts (2018). The names of these exchanges are presented in Table 1. 8 On a side note, it may have the drawback of including market data from such exchanges, where different influencing factors (e.g. lack of transaction fees, primary links to Tether) are present. However, it is assumed that the bias introduced by these circumstances are negligible in this historical analysis. 32 Table 1: List of Bitcoin exchanges used for gathering data in the evaluation List of USD-denominated Bitcoin exchanges used in the evaluation 1coin Abucoin Allcoin ANX Bitalo BitBay BitBox Bitcoin-24.com Bitcoin2Cash Bitcoin7 Bitcurex BTCC CoinsBank GlobalBitcoinExchange LibertyBit Bitfinex btcex.com Coinsbit hitbtc LocalBitcoins Bitfloor btcex.com(2nd) CoinTrader IBWT Mt.Gox Bitflyer BTCMarket1 Crypto-Trade IMCEX.COM OKCoin BitKonan BTCMarket2 CryptoXChange Indacoin TheRockTrading bitMarket.eu BTCMarket3 ExchangeBitcoins.com Intersango Vircurex bitme BitStamp btc.e BTC-Alpha BTCMarket4 BtcTree.com Camp BX CEX.IO EXMO FBTCExchange GDAX GetBTC itBit JustCoin Kraken LakeBTC.com WEX (Source: Personal collection) To illustrate the difference between the method of calculating the simple average of available BTC/USD 9 quotes and using the trade-weighted method, consider Figure 3. It is clear that simple averages overestimate the true market value of Bitcoin in recent years. The average deviation is 1.3% for the entire history of Bitcoin. When compared to Blockchain.com’s (2018) database, this deviation is 1.5%, though the two times series are quite close in recent years. Figure 3: Deviation of the simple average from the trade-weighted average price of Bitcoin (Source: Own work) 9 BTC/USD is the code for the exchange rate value of Bitcoin versus the U.S. dollars. Note that this ratio represents dollars per 1 bitcoin, and not bitcoins per 1 dollar. This can be a source for confusion in some crosses of the forex market as well, as the names usually do not represent actual divisions. 33 The trade-weighted method offers the same time series length as the simple average dataset, yet represents the overall market price of Bitcoin better. The entire price history ranges from April 2010 to November 2018, offering 3098 observations. In the course of the evaluation, a number of foreign exchange rates will also be analyzed to serve as a comparison to Bitcoin, and to understand the different risk profiles of various currencies. The list of currency pairs chosen was arbitrary, however, it was made sure that it contains both the most liquid currencies of advanced economies, and a number of emerging market currencies as well. In all cases, the USD crosses were chosen, as the value of bitcoins were also measured in USD, which is the number one reserve currency in the world. Table 2: List of currencies used in the evaluation exercise List of Foreign Exchange Rates U.S. / Euro Foreign Exchange Rate China / U.S. Foreign Exchange Rate Japan / U.S. Foreign Exchange Rate U.S. / U.K. Foreign Exchange Rate Canada / U.S. Foreign Exchange Rate Mexico / U.S. Foreign Exchange Rate South Korea / U.S. Foreign Exchange Rate Brazil / U.S. Foreign Exchange Rate U.S. / Australia Foreign Exchange Rate Switzerland / U.S. Foreign Exchange Rate India / U.S. Foreign Exchange Rate Thailand / U.S. Foreign Exchange Rate Malaysia / U.S. Foreign Exchange Rate South Africa / U.S. Foreign Exchange Rate Hong Kong / U.S. Foreign Exchange Rate Taiwan / U.S. Foreign Exchange Rate Sweden / U.S. Foreign Exchange Rate Singapore / U.S. Foreign Exchange Rate Venezuela / U.S. Foreign Exchange Rate U.S. / New Zealand Foreign Exchange Rate Norway / U.S. Foreign Exchange Rate Denmark / U.S. Foreign Exchange Rate Sri Lanka / U.S. Foreign Exchange Rate (Source: Personal collection) The source for acquiring the currency quotes was the Federal Reserve Economic Data (FRED) compiled and made openly available by the Federal Reserve Bank of St. Louis (2018). Forex market data was available on a daily basis in FRED for the entire history of Bitcoin, however, not for the weekends. For this reason, aligning these time series for comparative purposes reduced the number of daily observations per variable to 2125. Lastly, a number of additional variables were also compiled with respect to Bitcoin. These are all related to the KPIs of the Bitcoin network, including various aspects of mining activity. This list is presented in Table 3. 34 Table 3: List of Bitcoin key performance indicators used in the evaluation (Source: Personal collection) Data on these variables were obtained from Blockchain.com (2018), and the total number of observations for them was 1802 per time series. However, matching this data to the price of Bitcoin yielded only 1544 observations per variable. Note that this data is not fully available on a daily basis in this source. Data cleaning techniques were deemed unnecessary and thus not conducted. However, additional data manipulations were done, which will be explained in the following section on methodology. 4.3. Methodology As of today, there is no established academic standard in how the performance of a new form of private money should be evaluated. The likely reason for this is that prior to the debut of cryptocurrencies ten years ago, private money only emerged in isolated situations, mostly in the form of complementary currencies. Such alternative forms of money are not rare at all, they are even present in advanced economies such at the United States or the United Kingdom. However, their analysis was not given enough weight so far, and was only done on a case-by-case basis based on a survey of related literature. For this reason, analyzing Bitcoin poses a methodological challenge, which is addressed in the following. The main focus of this analysis is the behavior of the BTC/USD trade-weighted daily open price time series. First, its properties are put it into context by a similaritydissimilarity analysis with respect to the 23 currency pairs listed in Section 4.2. 35 Following the generally accepted approach of quantitative finance, log returns (natural logarithm) are calculated on a daily basis for all observations with the following formula: (4) 𝑟𝑟𝑡𝑡 = ln( 𝑃𝑃𝑡𝑡 ) − ln( 𝑃𝑃𝑡𝑡−1 ) Log returns are denoted by 𝑟𝑟𝑡𝑡 and 𝑃𝑃𝑡𝑡 stands for the average price level of BTC/USD during time 𝑡𝑡. Note that given the nature of log returns, the following holds true: (5) (6) 𝐼𝐼𝐼𝐼 𝑟𝑟𝑡𝑡 ≪ 1 → 𝑟𝑟𝑡𝑡 ≈ � 𝑃𝑃𝑡𝑡 −𝑃𝑃𝑡𝑡−1 𝑃𝑃𝑡𝑡−1 � This states that for returns significantly lower than 100%, the log returns are good approximations of actual returns. Using log returns provides the benefit of normalization, in which variables with otherwise different price levels can be compared. This a standard requirement in multidimensional statistical analysis. Additionally, log returns eliminate long-term trends from asset prices, and thus can help counter the problems with heteroscedasticity. Relying on log returns over simple returns provides several advantages, such as log-normality, time-additivity, numerical stability and a general mathematical ease of doing calculus, which will not be elaborated on in this section (for more on this, see Quantivity, 2011). Note that relying on log returns is generally better suited to statistical analysis and academic inquiry into price behavior, while raw returns are preferred for calculating actual portfolio returns, which this thesis does not deal with. Similarity of log returns is evaluated by calculating the Pearson correlation coefficients of all variables. Using Bartlett's sphericity test, it can be determined that correlation among specific variables is significantly different from zero, which is calculated for all variables. A list of similar time series is identified with a dissimilarity threshold of 0.5. Additionally, averages of the proximity matrix are calculated for all variables (excluding self-comparisons with values of 1), and the squares of these average correlation coefficients are used to rank the similarity and dissimilarity of currencies. 36 In the subsequent exercise, the distribution of log returns will be analyzed. In this regard histograms are built using the square-root choice for intervals. Formally, it is calculated in the following way: 2 𝑘𝑘 = � √𝑛𝑛� (7) Here, the number of intervals is denoted by 𝑘𝑘, while the number of observations is given by 𝑛𝑛. This bracket over the square root means that mathematically the result is rounded up to the nearest integer. Applying this on the number of observations in the database yields a result of 46, and this is used as the base for setting intervals. Since there is no academic best practice in calculating intervals, other approaches were also tested, including Strudge’s formula and the Rice rule, which yielded an interval number of 12 and 25 respectively. These settings were rejected, as they were found to be too low during the analysis. The distribution of Bitcoin log returns is tested for normality using four approaches: the Shapiro-Wilk test, the Anderson-Darling test, the Lilliefors test, and the Jarque-Bera test. As a next step, various distributions are fitted over the histogram of Bitcoin log returns to arrive at the best general model for Bitcoin’s risk profile. The parameter estimation approach in this respect was the maximum likelihood method. In this case, the Kolmogorov-Smirnov test was used to compare the observed distribution to the reference probability distributions. In the last exercise, the drivers behind Bitcoin’s return volatility is investigated. To do this, a 30-day moving standard deviation is calculated for daily log returns. This metric resembles the Bitcoin Volatility Index (Bitvol.info, 2018), though it is different in that it relies on log returns and trade-weighted prices. Multiple regression analysis is used for finding what independent variables can best predict the volatility of Bitcoin. The initial list of regressors was drawn from all the available KPIs of Bitcoin, as presented in Table 3 in Section 4.1. Then the following linear model was considered: (8) 𝐵𝐵𝑖𝑖𝑡𝑡𝐵𝐵𝐵𝐵𝑖𝑖𝑛𝑛 𝑉𝑉𝐵𝐵𝑉𝑉𝑉𝑉𝑡𝑡𝑖𝑖𝑉𝑉𝑖𝑖𝑡𝑡𝑉𝑉 = 𝛼𝛼0 + 𝛼𝛼1 ∗ 𝑋𝑋1 + 𝛼𝛼2 ∗ 𝑋𝑋3 + ⋯ + 𝛼𝛼10 ∗ 𝑋𝑋10 + 𝜀𝜀 As some of these indicators are related to each other, a method is needed to detect multicollinearity. In this respect, variance inflation factors (VIF) are calculated to judge 37 the possible presence of multicollinearity. 𝑉𝑉𝐼𝐼𝑉𝑉𝑖𝑖 is calculated by running ordinary least square regressions of 𝑋𝑋𝑖𝑖 (the variable in question) against all other variables. The method has two steps in all regression rounds. 𝑆𝑆𝑡𝑡𝑆𝑆𝑆𝑆 1: 𝑉𝑉𝐵𝐵𝑟𝑟 𝑖𝑖 = 1 𝑡𝑡𝐵𝐵 10 (9) 𝑋𝑋𝑖𝑖 = 𝛼𝛼0 + 𝛼𝛼2 ∗ 𝑋𝑋𝑖𝑖+1 + 𝛼𝛼3 ∗ 𝑋𝑋𝑖𝑖+2 + ⋯ + 𝛼𝛼10 ∗ 𝑋𝑋𝑖𝑖+9 + 𝜀𝜀 𝑆𝑆𝑡𝑡𝑆𝑆𝑆𝑆 2: 𝑉𝑉𝐵𝐵𝑟𝑟 𝑖𝑖 = 1 𝑡𝑡𝐵𝐵 10 (10) 𝑉𝑉𝐼𝐼𝑉𝑉𝑖𝑖 = 1 1−𝑅𝑅𝑖𝑖2 A general rule of thumb is that if 𝑉𝑉𝐼𝐼𝑉𝑉𝑖𝑖 >10 then multicollinearity is high, and the variable should be considered for dropping. This method is used to reduce the number of independent variables in the subsequent steps of the multiple regression analysis. In the course of the regression analysis, and the various tests for distribution normality, the 𝑆𝑆-value was compared to a standard significance level of 𝛼𝛼 = 5%. In cases where 𝑆𝑆 < 𝛼𝛼 the result is considered to be statistically significant. 4.4. Results This section now discusses the results that were obtained by applying the methodology explained in Section 4.3. using the data presented in Section 4.2. First, descriptive statistics is provided on the BTC/USD log returns. The observed mean of the time series is 0.6% with a standard deviation of 6.6%. The times series minimum is -50% and the maximum is 88%, indicating an outstandingly wide range with respect to daily currency returns. Grouping the data by its quartiles provides an informative overview of return variability. It is presented in three different angles in the following graphs. 38 Figure 4: Bitcoin log return variability presented in a strip plot, a box plot, and a scattergram (Source: Own work) (Source: Own work) This overview of log return variability suggests that the behavior of Bitcoin’s price is highly unstable. However, its actual risk profile requires further investigation. Thus, Bitcoin’s log returns will now be considered in a broad forex market context in search of similarities. 39 4.4.1. Similarity analysis The proximity matrix, showing the Pearson correlation coefficients for the log returns of BTC/USD and nine currency pairs is shown in Table 4. The full 24x24 matrix is presented in Appendix IV. Table 4: Proximity matrix of Bitcoin and 9 other currency pairs Proximity matrix BTC/USD U.S. / Euro China / U.S. Japan / U.S. U.S. / U.K. Canada / U.S. Mexico / U.S. South Korea / U.S. Brazil / U.S. U.S. / Australia 1st 100% 5% 0% -1% 1% -3% -1% 0% -1% 2% 2nd 5% 100% -21% -30% 57% -43% -34% -36% -29% 51% 3rd 0% -21% 100% 13% -22% 19% 17% 29% 15% -24% 4th -1% -30% 13% 100% -12% 7% -3% 10% 4% -18% 5th 1% 57% -22% -12% 100% -45% -34% -34% -25% 46% 6th -3% -43% 19% 7% -45% 100% 57% 46% 43% -67% 7th -1% -34% 17% -3% -34% 57% 100% 45% 55% -58% 8th 0% -36% 29% 10% -34% 46% 45% 100% 36% -54% 9th -1% -29% 15% 4% -25% 43% 55% 36% 100% -47% 10th 2% 51% -24% -18% 46% -67% -58% -54% -47% 100% (Source: Own work) Based on this selection alone, it shows clearly that the BTC/USD log return series is very dissimilar to other currency pairs. At the same time, a number of conventional fiat currencies showed a degree of similarity to each other. With a threshold of 0.5, 24 pairs of partially similar currencies emerge, and Bitcoin does not appear in any pairing. To better illustrate the level of similarity-dissimilarity among these pairs, the squared average Pearson correlation coefficients are calculated across all time series. Table 5: Overall similarity with the entire currency market (24 variables) Currency pair Squared average correlation Currency pair Squared average correlation U.S. / Australia Daily log return U.S. / Euro Daily log return Singapore / U.S. Daily log return U.S. / New Zealand Daily log return South Korea / U.S. Daily log return Taiwan / U.S. Daily log return Norway / U.S. Daily log return South Africa / U.S. Daily log return Thailand / U.S. Daily log return U.S. / U.K. Daily log return Mexico / U.S. Daily log return Sweden / U.S. Daily log return 7.72% 6.51% 6.20% 6.06% 4.33% 4.16% 4.15% 4.10% 3.95% 3.63% 3.49% 3.49% Canada / U.S. Daily log return Denmark / U.S. Daily log return Brazil / U.S. Daily log return Malaysia / U.S. Daily log return India / U.S. Daily log return Switzerland / U.S. Daily log return China / U.S. Daily log return Hong Kong / U.S. Daily log return Japan / U.S. Daily log return Sri Lanka / U.S. Daily log return BTC/USD log return Venezuela / U.S. Daily log return 3.12% 2.85% 2.67% 2.48% 2.44% 1.70% 1.29% 0.84% 0.31% 0.01% 0.01% 0.00% (Source: Own work) 40 Bitcoin’s overall similarity to the entire currency portfolio is 0.01%. In this sense, it is on par with Venezuela and Sri Lanka, who show no similarity to the benchmark currency portfolio, which represents a large section of the forex market (including all major crosses). Both of these fiat currencies have demonstrated great instability (in the case of Venezuela: managed depreciations of the official rate) over the past 10 years. These findings show that the behavior of the BTC/USD time series does not fit into the forex market context or in other words: the asset class of fiat currencies. The main reason for this is that Bitcoin exhibits a significantly different risk profile, which can be estimated by looking at the distribution of its log returns. To do this, first the relative frequency histogram of the BTC/USD log returns is built with the square-root choice for intervals. Figure 5: Relative frequency histrogram of BTC/USD daily log returns and the cumulative histogram (Source: Own work) It shows clearly that the distribution of Bitcoin returns has a very high kurtosis. In fact, calculations made in this respect confirm this visual opinion, as presented in the following table, showing values for both skewness and kurtosis. 41 Table 6: the skewness and kurtosis of BTC/USD log return distribution Statistic Skewness (Pearson) Skewness (Fisher) Skewness (Bowley) Kurtosis (Pearson) Kurtosis (Fisher) BTC/USD log return 1.515 1.516 0.105 26.700 26.768 (Source: Own work) These properties suggest that Bitcoin’s returns are not normally distributed. To test this, four different methods are employed, the results of which are shown in Table 7. Table 7: Normality test for BTC/USD log returns ShapiroWilk test W Result1 0.791 AndersonDarling test A² p-value p-value < 0.0001 (Two-tailed) (Two-tailed) alpha 0.05 alpha Result2 +Inf < 0.0001 0.05 Lilliefors test D Result3 0.133 D (standardized) p-value (Twotailed) alpha 6.015 Jarque-Bera test JB (Observed value) JB (Critical value) < 0.0001 DF 0.05 p-value (Twotailed) alpha Result4 61949.159 5.991 2 < 0.0001 0.05 (Source: Own work) These tests all gave statistically significant results, meaning that their null hypothesis can be rejected, and the alternative hypothesis is correct: the BTC/USD log returns do not follow a normal distribution. This is not surprising given the statistical properties of Bitcoin and the many outliers identified in the time series. For an overview of the empirical cumulative distribution of Bitcoin log returns, and its quantiles, see the probability–probability plot and the quantile-quantile plot presented in Figure 6 and Figure 7. 42 Figure 6: P-P plot of BTC/USD daily log returns (Source: Own work) Figure 7: Q-Q plot of BTC/USD daily log returns (Source: Own work) 43 4.4.2. Distribution fitting The results of the previous section imply that finding an appropriate distribution by which to model the risk profile of Bitcoin is highly challenging. A large number of known distributions were tested as part of this exercise to see how they fit the observed data. The results were unsatisfactory in nearly all of the cases, yet one distribution was found to perform better than the rest: the logistic distribution. Using the maximum likelihood estimation method, it is able to track the shape of the BTC/USD log returns better than the normal distribution, although its fit is still imperfect. In the below graphs, the estimation results are shown in comparison to the density, frequency and cumulative frequency of the BTC/USD log returns. Figure 8: Fitting the BTC/USD log returns with an estimated logistic distribution (Source: Own work) 44 Figure 9: Estimated and observed frequencies of the BTC/USD log returns (Source: Own work) Figure 10: Estimated and observed cumulative relative frequency of the BTC/USD log returns (Source: Own work) Modeling the probabilities of Bitcoin returns based on this estimated logistic distribution is better than using any variants of a normal or a standard normal distribution. 45 However, this logistic model also fails to pass the Kolmogorov-Smirnov test, indicating that it still does not fully capture the behavior of Bitcoin returns. The parameters of the model are presented in Table 8. Table 8: Estimated parameters of Bitcoin's logistic distribution Parameter µ s Value Standard error 0.005 0.001 0.028 0.001 (Source: Own work) These results have shown that Bitcoin has a significantly different risk profile to conventional currencies, and that the probability distribution of its returns can be better modeled with a logistic distribution than a normal distribution. In quantitative finance, normal distributions are assumed for a vast range of modeled phenomena, and thus the non-normality of Bitcoin poses a difficult challenge that needs to be better explored in subsequent research. 4.4.3. Regression model The following section investigates additional properties of the Bitcoin system with the aim of explaining its volatile behavior. To do this, a new metric is calculated, which is similar to the Bitcoin Volatility Index (BVI) provided by Bitvol.info (2018). A 30-day moving standard deviation of the daily log returns is calculated for the entire period between 2010 and 2018. This is set to be the dependent variable in a linear model, which tries to explain its variability using a list of independent variables presented in Section 4.2. Note that a large number of pitfalls are present in building such regression models. Bitcoin’s volatility is a function of price movements, and thus any independent variable that has a relation to price movements will introduce a bias. Consequently, a number of explanatory variables have to be removed while modeling Bitcoin’s return volatility. It was found that variables, such as the metric for miner’s reward introduces a bias. Another technical issue in this modeling exercise is related to multicollinearity, That time series on the difficulty parameter and the transaction per block variable both had a high VIF. Lastly, the transactions per day and the total transaction number variables were found to be statistically insignificant in explaining Bitcoin’s volatility, and were dropped from the overall model. 46 This way, the model was left with five independent variables to explain the volatile behavior of Bitcoin: 1. Hash rate 2. Cost per transaction 3. Unique addresses 4. Total bitcoins 5. Estimated transaction volume Summary statistics on these variables and their correlation matrix is presented in the tables below: Table 9: Summary statistics for model variables Variable Obs. without missing data Bitcoin 30D volatility Hash rate Cost per transaction Unique addresses Total bitcoins Estimated rransaction volume 1503 1503 1503 1503 1503 1503 Minimum Maximum 0.007 0.003 0.135 284.000 3750900 556.000 Mean 0.241 60089527.190 146.595 1054711.000 17366475 5615762340.673 Std. deviation 0.051 4748634.265 20.905 229245.755 12512898 281980152.197 0.036 11547666.893 26.666 212511.149 3810558.432 616913044.610 (Source: Own work) Table 10: Correlation matrix of model variables Variable Hash rate Hash rate Cost per transaction Unique addresses Total bitcoins Estimated transaction volume Bitcoin 30D volatility 100% 65% 49% 48% 48% -15% Cost per Unique Total Estimated transaction addresses bitcoins transaction volume 65% 100% 50% 47% 74% 2% 49% 50% 100% 86% 71% -27% 48% 47% 86% 100% 47% -46% 48% 74% 71% 47% 100% -3% Bitcoin 30D volatility -15% 2% -27% -46% -3% 100% (Source: Own work) The multicollinearity statistics of the final model’s variables are shown below. All variables were dropped above the predefined limit of 𝑉𝑉𝐼𝐼𝑉𝑉 > 10. Table 11: Calculated variance inflation factors for model variables Hash rate Variance Inflation Factor (VIF) 1.90 Cost per transaction 3.61 (Source: Own work) 47 Unique addresses Total bitcoins 8.88 5.68 Estimated transaction volume 5.06 This final specification of the model yielded statistically significant results for all independent variables in explaining the 30-day volatility of Bitcoin. However, the moderately low level for the coefficient of determination (𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝑡𝑡𝑆𝑆𝐴𝐴 𝑅𝑅2 = 36%) means that the model is only able to explain one-third of the variability in Bitcoin’s volatility. This suggests that there are other factors not considered in the model, which are important in explaining Bitcoin’s volatility. The model’s overall performance is demonstrated in Figure 11. It shows that heteroscedasticity in not a concern in this model, which is likely a result of the log approach. Figure 11: Model performance: predicted Bitcoin volatility vs. observed volatility (Source: Own work) Since all of the widely tracked KPIs were considered in this modeling exercise, it is assumed that non-observed variables may be at play here. The effect of speculative behavior on Bitcoin’s volatility cannot be accounted for without an objective measure. Nevertheless, the hypothesis that the estimated coefficients have no effect can be rejected, which is an important result in itself. Furthermore, analyzing the coefficients of the model also yields interesting information concerning Bitcoin’s volatility and its inherent properties. 48 Figure 12: Standardized coefficients of the model (Source: Own work) The model’s coefficients shows that increases in three metrics lead to a reduction in observed volatility: the hash rate, the number of bitcoins, and the estimated volume of transactions. These indicators are all related to the maturity of a cryptocurrency system. The more adopted a cryptocurrency is, the higher the hash rate goes, and the larger the transaction volume rises. This model suggests that higher adoption rate may lead to reduced volatility. Interestingly, Bitcoin’s price volatility has been notably low in recent months, if compared to historical values. The measure for the 30-day moving standard deviation of log returns is in the range of 1-4% for the past 6 months and is showing a downward trend. It will be interesting to see, if Bitcoin’s volatility will continue to normalize as the new currency matures. This concludes the discussion of the quantitative results on Bitcoin’s behavior. Building on these findings, the next section provides a qualitative assessment on how Bitcoin performs as a form of money. 4.5. Discussion on Bitcoin The evaluation done in Section 4.4., and the monetary theory explained in Chapter 3, now enable an informed discussion on how Bitcoin performs the fundamental functions of money. This section follows the second pillar of the framework outlined in Section 4.1., and will thus contain a number of subjective statements. 49 4.5.1. Bitcoin as a medium of exchange The theoretical framework of the three fundamental functions of money were outlined in Section 3.1.2. and the following section now elaborates on that point by point. The first question is whether bitcoins are able to serve as a medium of exchange or not. Since there are established ways in which people can use the Bitcoin system for purchasing certain goods and services, this clearly suggests that it does serve this function. There is ample evidence that bitcoins are widely used in different types of transactions. However, if this requirement is interpreted in a broader way, then one should consider the number of merchants willing to accept bitcoins as a form of payment. The current estimate for merchants accepting bitcoins is around 100,000 globally (Cuthbertson, 2015), however no exact number is given in this matter, and tracking sites, such as Coinmap (2018) do not offer in-depth analysis on this matter. General usage statistics were gathered by the Cambridge Centre for Alternative Finance (Hileman & Rauch, 2017), however this only provides limited insight on the underlying dynamics of adoption. Their report notes that general cryptocurrency adoption is the highest in North America and Europe, and the total number of wallets may be between 2.9-5.8 million. This level of usage and acceptance is very low, even if just compared to the number of businesses and consumers in the United States. According to DMDatabases.com (2018), there are over 18 million businesses in the U.S., thus Bitcoin’s acceptance rate has to be below 0.005% there. Consequently, Bitcoin performs much worse as a medium of exchange than the USD or other major fiat currencies. Its current level of acceptance compares to the scale of a small-sized country, such as Hungary, where the local statistical office reports that around 130 000 retail shops are present (Hungarian Central Statistical Office, 2018). Thus, if only retail shops are considered, then the market for Bitcoin is comparable to Hungary. This analogy suggests that Bitcoin’s current level of acceptance as a medium of exchange is probably comparable to local currencies of small nations, however, it is spread out on a global level. Note that this comparison may not be accurate enough since it does not take into account the actual economic weight of these retailers, and thus should be taken with caution. Note also that it is unclear to what market Bitcoin should be compared to in this respect. Taking the retail markets where the U.S. dollar is used may be inappropriate in this setting. Bitcoin is a new form of money and thus – from a subjective point of view – it can successfully serve as a medium of exchange by covering only a smaller market. It just so happens that Bitcoin is a well-adopted currency in a specialized market. 50 Bitcoin is the dominant form of money, and the primary medium of exchange, in the dark web. It is an area of the World Wide Web that is present on darknets and overlay networks, and can only be accessed via specialized software or prior authorization. It is a smaller part of the deep web, which is an area of the Internet that is not indexed by search engines. The economy of the dark web primarily deals with illegal goods and services, and thus the size of this market cannot be reliably estimated. It is well documented, however, that Bitcoin and other cryptocurrencies (most prominently: Litecoin, Dash and Monero) are widely used in the dark web, since they offer a convenient and practically anonym form of payment (though there are differences in their level of anonymity). Thus, in this non-negligible area of the internet, cryptocurrencies, such as Bitcoin, are already the unchallenged mediums of exchange (Sharma, 2018). Figure 13: Payment currencies of the dark web (Source: Barysevich & Solad, 2018) 51 In conclusion, Bitcoin does fulfill the money function of being a medium of exchange in certain markets. It also does it globally, however, only in a very fragmented and insignificant way. However, Bitcoin has only been around for 10 years, and its adoption was quite dynamic despite no government backing. For this reason, Bitcoin is considered to have a lot of untapped potential as a medium of exchange. 4.5.2. Bitcoin as a unit of account The second fundamental function of money is the unit of account role. This is concerned with how the units of a given currency can represent the real value or cost of a certain good or service. Simply stated, a money is a unit of account, if it helps economic agents garner information about the relative value of their item of interest or understand the value of their income. In practice, a money can only be a good unit of account, if the information it conveys about the goods in question does not change hectically. It is reasonable to believe that a certain good, such as a leather wallet in a shop window, should have almost the same value in a short to medium timespan. If it is seen that its quoted price changes daily, then one can assume that either something very strange is happening on the market of leather wallets, or that the currency in which it is measured is not a good unit of account. When a country becomes fiscally unstable, its currency can lose value at an unpredictable rate, forcing merchants to either constantly update their prices, or switch to quoting their goods in a more stable currency. It can even happen in less severe cases, for example, an online retail shop who sells imported products might find it logical to rather use prices denominated in USD or EUR, instead of the less stable local currency rates. This way they can ensure that the price paid for a certain good properly compensates for the associated cost. This situation does not only affect crisis countries, such as Venezuela, where a socioeconomic and political crisis is taking place since 2010, but also more stable nations. Moldova, Ukraine, and even Russia to some extent, have very high dollarization rates, since their local currencies were historically unstable (see for example Ponomarenko et al., 2011). Bitcoin’s price, as quoted in USD, or even in real goods, like the leather wallet mentioned above, has been highly unstable throughout all of its history, as it was demonstrated in Section 4.4. Consequently, Bitcoin, and all such cryptocurrencies, which are not pegged to a stable fiat currency like the USD, are unable to serve as a unit of account today. This is the reason, why most of the merchants who provide price quotes 52 of their products in bitcoins, usually do it on a hard currency basis. It means that they actually set prices in currencies, such as the dollar or the euro, and then implement an automatic calculation of the corresponding Bitcoin price. Measuring value in bitcoins is not feasible, as it has much higher volatility than any other currency, or even most other financial assets for the matter. The 30-day moving standard deviation of the BTC/USD daily returns, as analyzed in Section 4.4., clearly shows that the price of bitcoin has been historically unstable. For an overview of this historical volatility, which is similar to the more commonly known BVI, refer to Figure 14. Figure 14: 30-day standard deviation of BTC/USD daily returns (Source: Own work) Based on the benchmark comparison presented in Section 4.4., it is clear that Bitcoin’s volatility is about one order of magnitude larger than that of the EUR/USD exchange rate (6.6% compared to 0.6% for the past 10 years). In fact, similar differences are seen when comparing to any other pairs in the used currency portfolio, with the only exception being Venezuela. As an additional check, Bitcoin’s volatility was also compared the price of gold bullion. Although gold has a more volatile nature than the fiat currencies used as a benchmark, it still does not compare with Bitcoin, as it only shows an average of 2% standard deviation. 53 Another solution for showing that bitcoin quotes are not able to fulfill the unit of account function, would be to show that the time series of its USD price is trending steeply. However, in this case it is enough to look at the mean log return of the BTC/USD history, as it makes the presence of a trend obvious. The mean daily log return for the past 10 years was 0.6%, which is significantly different from zero. This demonstrates that the price of bitcoin is trending, unlike the other currencies in the benchmark portfolio, which have close to zero average returns, and exhibit stationarity. These observations demonstrate that the current times series behavior of Bitcoin prevents it from serving as a unit of account. Other currencies, such as the USD, are needed to support Bitcoin’s transactions by measuring the value of goods and services. In the following segment, the third function of money is analyzed, which is also related to the issue of volatility. 4.5.3. Bitcoin as a store of value A money has to serve the function of storing value, since people do not intend on spending all of their earnings instantly. If a given currency is not able to store the value one acquired, then economic agents will suffer a loss due to postponing transactions. Retaining purchasing power in time is an essential function of money, though it is not a binary (yes or no) property either. All modern forms of money are prone to inflation, and they lose their purchasing power over time. In the United States, a 100-dollar bill buys less than tenth the amount of goods today than it did after World War II. Consumer prices have risen almost twelvefold since 1947, which means that today’s 100-dollar bill is worth less than the 10-dollar bill at that time. This diminishing purchasing power of the USD is demonstrated below. 54 Figure 15: Purchasing power of the United States dollar: 100 USD deflated by CPI in 1947-2018 (Source: Own work) This is a feature of all modern currencies, and in fact, one can hardly find such historical periods, where inflation was nonexistent. For this reason, the store of value function of a given currency cannot be interpreted in absolute terms, as then all historical currencies would fail in this regard. Rather, it is to be approached from a risk management point of view. This implies that predictability is needed in how a given currency stores value. This way, a steady rate of diminishing purchasing power can be acceptable, but large swings in value, on the other hand, are not. The U.S. dollar satisfies this requirement well, as it does not exhibit large deviations in purchasing power on a yearly basis, while Bitcoin does. Its properties in this respect were presented while discussing its unit of account function. However, Bitcoin’s purchasing power is not diminishing at all, in fact, it is dynamically increasing in a long-term comparison. So much so, that the raw BTC/USD time series best fits to an exponential trend. 55 Figure 16: The USD price of Bitcoin and its calculated exponential trend (Source: Own work) This is an important point to address: can an appreciating currency be in violation of the store of value function or not? As noted above, the best way to approach this question is from a risk management angle. This concerns the liquid nature of money, and that it cannot be known when an owner might want to spend it in the future. If Bitcoin only showed appreciation, with no temporary declines, then there would be no need to look at it from a risk management perspective. However, its volatility is not only a result of constant price increases, but it is a combination of large ups and downs. One way to assess the inherent risk of holding bitcoins is to look at the distribution of its historical returns. This quantitative analysis was done in Section 4.4.2., showing that Bitcoin’s log returns have a non-normal distribution. Using the frequency distribution calculated for BTC/USD log returns, it can be shown that there is a 48% probability for a daily return to fall between -1.1% and 3.2%. This is an unusually low probability for acceptable deviations: this means that in roughly every second day, Bitcoin’s returns fall outside of this range. The chance of sustaining a loss between 10-30% is 3.3% according to the calculated distribution of Bitcoin. This is an unacceptable level of risk for a currency that is intended to function as a store of value, and thus it can be subjectively assessed that Bitcoin fails in this regard. The next section explores the possible cause of this elevated volatility, which prevents Bitcoin from fulfilling the unit of account and the store of value money functions. 56 4.5.4. Bitcoin’s design: the issue of money supply inflexibility In the following, Bitcoin’s money supply model is explored, which is identified as the most important design element with respect to price stability. In the Bitcoin system, a generation algorithm defines how the currency is created, and at what pace. Furthermore, money supply is predetermined, meaning that it can be (almost) perfectly forecast, how the total number of bitcoins will evolve in the future. As it is explained in Section 7.2.5. of Appendix I, which discusses the topic of block rewards, the supply of bitcoins only increase when a miner successfully creates a new block in the blockchain. However, the rate of block generation is fully controlled (Bitcoin Wiki, 2018b). This is achieved by an automatic adjustment of the difficulty parameter of the hash puzzles to arrive at a constant rate of block creation. This results in a constant supply of bitcoins in the system. The number of newly created money is set to decrease geometrically by design. Money supply halves after every 210,000 blocks mined, which corresponds to about 4 years of mining activity (it is a reasonably precise estimate, since the rate of block creation is controlled). Mathematically, this money supply rule is given in the following way: (11) 𝐵𝐵𝐵𝐵𝐵𝐵𝐵𝐵_𝑟𝑟𝑟𝑟𝑟𝑟∗108 � 2𝑖𝑖 108 ∑34 𝑖𝑖=1 210000 � This statement shows why the maximum number of bitcoins cannot exceed 21 million: the number of bitcoins created in every bitcoin reward era (denoted by 𝑖𝑖 ) is summed, where the initial reward (𝐵𝐵𝑉𝑉𝐵𝐵𝑘𝑘_𝑟𝑟𝑆𝑆𝑟𝑟) equals 50 bitcoins. In each additional step, less and less bitcoins are added to the total monetary base. Even though there may be an infinite amount of steps, since the block reward is halving, the total amount of newly created bitcoins will converge to zero quite quickly. In about 34 steps, money creation will halt. 57 Figure 17: Projected money supply in the Bitcoin system (Source: Own work based on Bitcoin Wiki, 2018b) Figure 17 shows visually how Bitcoin’s money will hit the theoretical limit of slightly less than 21 million coins in the future. Note that this projected number does not actually equal the money that can ever circulate in the Bitcoin ecosystem. In fact, a large share of the bitcoin monetary base is static for a number of reasons: 1. Owners may have lost their private keys to their digital signatures, and thus can no longer spend their bitcoins. 2. Some early miners are in possession of a large number of bitcoins and may be unwilling to trade them for various reasons. 3. A block-creating miner can choose to underpay himself, and that block will still be considered valid in the system. This is one way, how the bitcoin supply can grow less than what was intended. Though this is not a frequent event at all. 4. Lastly, some bitcoins may have been purposefully destroyed by sending them in a way that they can never be spent. This is achievable by specific script operators that are impossible to execute, or by simply sending them to addresses that pass validity checks, yet their private keys are unknown to all. This is again not very common. These are the reasons, why the total amount of available bitcoins is significantly less than what the money supply rule would suggest. Pollock (2017) notes that close to 4 million bitcoins may already be lost. This also suggests that the money supply of Bitcoin 58 will start to shrink once the block reward has been lowered sufficiently. Since bitcoins can be divided to 8 decimal points in transactions (1 satoshi = 0.00000001 BTC), this limited money supply will not necessarily appear as a drag on transaction dynamics for quite some time. Even if it does, the consensus view on this division rule might change by then. However, this hard cap will affect the price of bitcoins if there will be continued demand growth after the supply growth halts. Since this is an expected feature of any currency that is used in a positive GDP-growth environment, it is inevitable that Bitcoin will face demand shocks. This suggests that an inflexible, capped money supply can lead to elevated price volatility. The likely intention behind designing the money supply rule of Bitcoin this way was to safeguard its long-term value. However, this may have the side effect of unstable prices or even a deflationary environment if adopted on a broad level. This concludes the discussion on the possible consequences of Bitcoin’s inflexible money supply rule. Note however, that empirical tests are not possible in this respect. Bitcoin’s evaluation is also concluded with this section. It was analyzed from both a quantitative and a qualitative angle, pinpointing where it fails to fulfill the fundamental functions of money. The following is the last chapter in the main part of this thesis, which sums up the assessment on Bitcoin’s performance. 59 5. Conclusion Throughout this thesis, the economic principles of cryptocurrencies were mapped out in order to understand how they can be compared to conventional forms of money. Not everyone treats cryptocurrencies as money though, some believe them to be a form of digital asset. Even though they could be valuable is such a form as well, considering them as alternative money bears a lot more significance. The introduction of this paper noted that the market of currencies is by far the largest in the world (in terms of trading volume). Fiat currencies have a tremendous impact on how economies function: they reduce the costs associated with making transactions, serving an immensely valuable role in society, despite having no intrinsic value at all. If a new currency, such as Bitcoin, could take over this role from conventional currencies, then it would have an outstanding impact on the world. This is why this thesis considered cryptocurrencies from a monetary aspect. And this may also be the reason why the creator of the first functioning cryptocurrency, Satoshi Nakamoto, intended Bitcoin to serve as a new form of money, and not merely as a digital asset. Accordingly, there are at least two fundamental questions to ask here: 1) Can a cryptocurrency theoretically function as a form of money? 2) Do current implementations function as money? In Chapter 3, it was demonstrated that there are no theoretical limitations on considering cryptocurrencies as a new form of money. In fact, it is shown in Appendix II that cryptocurrencies are similar in nature to the private currencies issued by commercial banks in the 17th-19th century. Furthermore, they are also similar to fiat currencies in having no intrinsic value. Section 3.1.3. deduced that neither of the major value theories of economics deny cryptocurrencies of their value, which effectively answers the first question above. Cryptocurrencies have been around for over 10 years now, if one counts their presence from the appearance of the Bitcoin whitepaper. Thus, there is a way to investigate the second question as well. Despite the elevated media attention in the past couple of years and the increasing academic scrutiny, there is still no standard method for evaluating the monetary aspects of a cryptocurrency. In monetary economics, the most common framework for analyzing currencies is to look at the three fundamental functions of money: 1) medium of exchange, 2) unit of account, and 3) store of value. 60 Building on this approach, a two-pillar framework was proposed in Chapter 4 for analyzing the monetary properties of cryptocurrencies. The first pillar deals with a quantitative analysis of observable behavior in comparison to a portfolio of fiat currencies. As part of this exercise, a similarity/dissimilarity analysis is needed, along with an identification of the risk distribution of the given currency. A model can also be considered for explaining the volatility of the currency in question, as this was found to be the leading problem with free-floating cryptocurrencies. This framework was applied on the case of Bitcoin, the leading cryptocurrency as of today. Its properties were discussed from both a quantitative and a qualitative point of view, and the following conclusions were made with respect to its monetary performance: 1) Bitcoin successfully serves as a medium of exchange in a number of markets, and on a global scale as well to a very limited extent. 2) Bitcoin, however, fails to fulfill two fundamental functions of money, as it cannot effectively serve as a unit of account or a store of value. 3) Bitcoin is overly volatile, and bears a high risk of inducing significant losses on its holders. It was demonstrated that holding bitcoins is an order of magnitude riskier than conventional currencies. It was also shown that Bitcoin’s returns have a non-normal distribution. 4) This elevated volatility may be a result of its rigid money supply rule, though this cannot be empirically tested. 5) The statistical model built for explaining the volatility of Bitcoin suggests that as the hash rate, the money supply and the volume of transactions grow, its volatility will decline. Interestingly, recent observations show a downward trend in volatility, however, there is a large part of this phenomenon (about 2/3 of variability), which the model could not explain. In overall, these findings show that Bitcoin does not function well as a currency yet. Nonetheless, it may change in the future, if its level of volatility is reduced, which is the Achilles’ heel of this currency. The model suggests that it may happen as Bitcoin becomes more widely adopted across the globe. However, this will require a significant amount of time. 61 6. References Abel, A. & Bernanke, B. (2005): Macroeconomics. Pearson, 5th edition, pp. 266–269. ISBN 978-0-201-32789-2. Ammous, S. (2016): Can Cryptocurrencies Fulfil the Functions of Money? Columbia University, Center on Capitalism and Society, Working Paper No. 92. Available from: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2832769 [Accessed: 10 November 2018]. Back, A. (2002): Hashcash - A Denial of Service Counter-Measure. Available from: http://www.hashcash.org/papers/hashcash.pdf [Accessed: 08 November 2018]. Bank for International Settlements (2015): Digital Currencies. Committee on Payments and Market Infrastructures. Available from: https://www.bis.org/cpmi/publ/d137.pdf [Accessed: 12 November 2018]. Bank for International Settlements (2016): Triennial Survey of foreign exchange and OTC derivatives trading. Available from: https://www.bis.org/publ/rpfx16.htm [Accessed: 01 October 2018]. Bank for International Settlements (2018): Annual Economic Report 2018. Available from: https://www.bis.org/publ/arpdf/ar2018e.htm [Accessed: 12 November 2018]. Barysevich, A. & Solad, A. (2018): Litecoin Emerges as the Next Dominant Dark Web Currency. Recorded Future Blog. Available from: https://www.recordedfuture.com/darkweb-currency/ [Accessed: 22 November 2018]. Bitcoin Wiki (2018a): Prohibited changes. Available from: https://en.bitcoin.it/wiki/Prohibited_changes [Accessed: 02 November 2018]. 62 Bitcoin Wiki (2018b): Controlled supply. Available from: https://en.bitcoin.it/wiki/Controlled_supply [Accessed: 12 November 2018]. Bitcoin Wiki (2018c): Address. Available from: https://en.bitcoin.it/wiki/Address [Accessed: 12 November 2018]. Bitcoin Wiki (2018d): SHA-256. Available from: https://en.bitcoin.it/wiki/SHA-256 [Accessed: 12 November 2018]. Bitcoin Wiki (2018e): Block chain. Available from: https://en.bitcoin.it/wiki/Block_chain [Accessed: 12 November 2018]. Bitcoin Wiki (2018f): Merkle tree. Available from: https://en.bitcoinwiki.org/wiki/Merkle_tree [Accessed: 10 November 2018]. Bitcoin Wiki (2018g): Elliptic Curve Digital Signature Algorithm. Available from: https://en.bitcoin.it/wiki/Elliptic_Curve_Digital_Signature_Algorithm [Accessed: 10 November 2018]. Bitcoin Wiki (2018h): Weaknesses – Sybil attack. Available from: https://en.bitcoin.it/wiki/Weaknesses#Sybil_attack [Accessed: 10 November 2018]. Bitcoin Wiki (2018i): Protocol rules. Available from: https://en.bitcoin.it/wiki/Protocol_rules#.22tx.22_messages [Accessed: 10 November 2018]. Bitcoin Wiki (2018j): Protocol documentation. Available from: https://en.bitcoin.it/wiki/Protocol_documentation#Block_Headers [Accessed: 10 November 2018]. 63 Bitcoin Wiki (2018k): Protocol documentation. Available from: https://en.bitcoin.it/wiki/Protocol_documentation#Block_Headers [Accessed: 10 November 2018]. Bitcoin.org (2018): Frequently Asked Questions. Available from: https://bitcoin.org/en/faq#what-is-bitcoin [Accessed: 02 November 2018]. Bitcoincharts (2018): Pricechart. Available from: https://bitcoincharts.com/charts/bitstampUSD#rg60ztgSzm1g10zm2g25zv [Accessed: 04 November 2018]. Bitvol.info (2018): The Bitcoin Volatility Index. Available from: https://bitvol.info/ [Accessed: 20 November 2018]. Bjerg, O. (2015): How is Bitcoin Money? Available from: https://journals.sagepub.com/doi/abs/10.1177/0263276415619015 [Accessed: 07 November 2018]. Blockchain.com (2018): Blockchain Charts – The most trusted source for data on the bitcoin blockchain. Available from: https://www.blockchain.com/charts [Accessed: 15 October 2018]. Bordo, M. D. (1993): The Bretton Woods International Monetary System: A Historical Overview. In: A Retrospective on the Bretton Woods System: Lessons for International Monetary Reform pp 3-108. University of Chicago Press, ISBN: 0-226-06587-1. Available from: http://www.nber.org/chapters/c6867.pdf [Accessed: 01 November 2018]. Briscoe, G. & De Wilde, P. (2007): Digital Ecosystems: Evolving service-oriented architectures. In IEEE First International Conference on Bio Inspired mOdels of NETwork, Information and Computing Systems (BIONETICS). Available from: https://arxiv.org/abs/0712.4102 [Accessed: 31 October 2018]. 64 Burnie, A., Burnie, J. & Henderson, A. (2018): Developing a Cryptocurrency Assessment Framework: Function over Form. Ledger, Vol 3 (2018). Available at: https://ledger.pitt.edu/ojs/index.php/ledger/article/view/121 [Accessed: 20 November 2018]. Callahan, G. (2004): Economics for Real People – An Introduction to the Austrian School. Ludwig von Mises Institute, 518 West Magnolia Avenue. ISBN: 0-945466-41-2. Chiu, J. & Koeppl, T. V. (2017): The Economics of Cryptocurrencies – Bitcoin and Beyond. Available at SSRN: https://ssrn.com/abstract=3048124 or http://dx.doi.org/10.2139/ssrn.3048124 [Accessed: 11 November 2018]. Coinmap.org (2018): Map of Bitcoin accepting venues. Available from: https://coinmap.org/ [Accessed: 01 November 2018]. Coinmarketcap (2018): Top 100 Cryptocurrencies by Market Capitalization. Available from: https://coinmarketcap.com [Accessed: 24 November 2018]. Cryptor51 (2018): PoW 51% Attack Cost. Available from: https://www.crypto51.app/ [Accessed: 14 November 2018]. Cuthbertson, A. (2015): Bitcoin Now Accepted by 100,000 Merchants Worldwide. International Business Times, 4 February 2015. Available from: http://www.ibtimes.co.uk/bitcoin-now-accepted-by-100000-merchantsworldwide-1486613 [Accessed: 18 September 2018]. Dai, W. (1998): B-money. Available from: http://www.weidai.com/bmoney.txt [Accessed: 02 November 2018]. 65 De Nicoló, G., Honohan, P. & Ize, A. (2005): Dollarization of bank deposits: Causes and consequences. Journal of Banking & Finance, Volume 29, Issue 7. Available from: https://www.sciencedirect.com/science/article/pii/S0378426604001359 [Accessed: 10 November 2018]. DMDatabases.com (2018): USA Business List – Employee size profile. Available from: https://dmdatabases.com/databases/business-mailing-lists/how-many-businesses [Accessed: 22 November 2018]. Dwivedi, D. N. (2010): Macroeconomics: Theory and Policy. McGraw Hill Education. ISBN-10: 0070091455. Eichengreen, B. (1989): The Gold Standard Since Alec Ford. NBER Working Paper No. 3122. Available from: https://www.nber.org/papers/w3122 [Accessed: 20 November 2018]. European Central Bank (2015): Virtual currency schemes – a further analysis. Available from:https://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyschemesen.pdf [Accessed: 01 November 2018]. Federal Reserve (2018): Monetary Policy. Board of Governoed of the Federal Reserve System. Available from: https://www.federalreserve.gov/monetarypolicy.htm [Accessed: 01 November 2018]. Federal Reserve Bank of St. Louis (2018): Federal Reserve Economic Data. Available from: https://fred.stlouisfed.org/ [Accessed: 22 November 2018]. Ferguson, N., Schneier, B. & Kohno, T. (2012): Cryptography engineering: design principles and practical applications. John Wiley & Sons. ISBN: 978-0-470-47424-2. 66 Friedman, M. (1999): Milton Friedman Full Interview on Anti-Trust and Tech. TV interview conducted by the National Taxpayers Union Foundation. Available from: https://www.youtube.com/watch?v=mlwxdyLnMXM [Accessed: 02 October 2018]. Github.com (2018): Proof of Stake FAQs. Available from: https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQs [Accessed: 01 November 2018]. Google Trends (2018): Explore what the world is searching. Available from: https://trends.google.com/trends/ [Accessed: 14 November 2018]. Gopher, A., Tsuk, T., Shalev, S. & Gophna, R. (1990): Earliest Gold Artifacts in the Levant. Current Anthropology, Vol. 31, No. 4 (Aug. - Oct., 1990), pp. 436-443. Graeber, D. (2011): Debt: The First 5,000 Years. Melville House; 1st Edition edition (July 12, 2011). ISBN-10: 1933633867. Haber, S. & Stornetta, W. S. (1991): How to time-stamp a digital document. In: Journal of Cryptology, Vol 3., No 2., pp 99-111. Hertig, A. (2018): Blockchain’s Once-Feared 51% Attack Is Now Becoming Regular. Coindesk.com. Available from: https://www.coindesk.com/blockchains-feared-51attack-now-becoming-regular [Accessed: 16 November 2018]. Hileman, G. & Rauchs, M. (2017): Global Cryptocurrency Benchmarking Study. Cambridge Centre for Alternative Finance. Available from: https://www.jbs.cam.ac.uk/faculty-research/centres/alternativefinance/publications/global-cryptocurrency/#.W_gPO6q2lhE [Accessed: 22 November 2018]. 67 Hirshleifer, J., Glazer, A. & Hirshleifer, D. (2005): Price Theory and Applications: Decisions, Markets, and Information. Cambridge University Press, 7th edition. ISBN-10: 0521523427. Hungarian Central Statistical Office (2018): Number of retail shops and enterprises by main activity of operating enterprises. Available from: http://www.ksh.hu/docs/eng/xstadat/xstadat_infra/e_okk006b.html [Accessed: 05 November 2018]. International Monetary Fund (2016): Virtual Currencies and Beyond: Initial Considerations. Staff Discussion Note 16/03. Available from: https://www.imf.org/external/pubs/ft/sdn/2016/sdn1603.pdf [Accessed: 01 November 2018]. Ivanov, S. (2018): Op Ed: What Do We Mean When We Talk About the "Blockchain Ecosystem”? Bitcoin Magazine. Available from: https://bitcoinmagazine.com/articles/op-ed-what-do-we-mean-when-we-talk-aboutblockchain-ecosystem [Accessed: 01 November 2018]. Iwai, K. (1997): Evolution of Money. In: EVOLUTION OF ECONOMIC DIVERSITY, pp. 396-431, Ugo Pagano, Antonio Nicita eds., London: Routledge, 2001. Available at SSRN: https://ssrn.com/abstract=1861952 [Accessed: 01 October 2018]. Iwamura, M., Kitamura, Y., Matsumoto, T. & Saito, K. (2014): Can We Stabilize the Price of a Cryptocurrency?: Understanding the Design of Bitcoin and Its Potential to Compete with Central Bank Money. Available from: SSRN: https://ssrn.com/abstract=2519367 or http://dx.doi.org/10.2139/ssrn.2519367 [Accessed: 15 October 2018]. Kaminska, I. (2017): Crypto tethers as the new eurodollars. Financial Times Alphaville Blog. Available from: https://ftalphaville.ft.com/2017/09/15/2193370/crypto-tethers-asthe-new-eurodollars [Accessed: 22 November 2018]. 68 Karaman, K., Pamuk, S. & Yildirim. S. (2018): Money and Monetary Stability in Europe, 1300-1914. Centre for Economic Policy and Research. Available from: https://cepr.org/active/publications/discussion_papers/dp.php?dpno=12583# [Accessed: 22 November 2018]. Katz, J. & Yehuda, L. (2014): Introduction to Modern Cryptography. Chapman & Hall/CRC Cryptography and Network Security Series, Second Edition. ISBN-10: 9781466570269. Kelly, J. (2018): People are freaking out about Tether. Financial Times Alphaville Blog. Available from: https://ftalphaville.ft.com/2018/10/15/1539630238000/People-arefreaking-out-about-Tether-/ [Accessed: 22 November 2018]. Keynes, J. M. (1936): The General Theory Of Employment, Interest, And Money. CreateSpace Independent Publishing Platform (published on 31 December 2013). ISBN-10: 149485474. Krugman, P. (2013): Bitcoin is Evil. Available from: https://krugman.blogs.nytimes.com/2013/12/28/bitcoin-is-evil [Accessed: 02 November 2018]. Krugman, P. & Wells, R. (2012): Economics. Worth Publishers, third edition. ISBN-10: 1429251638 Lamport, L., Shostak, R. & Pease, M. (1982): The Byzantine Generals Problem. ACM Transactions on Programming Languages and Systems (TOPLAS), Volume 4 Issue 3, pp. 382-401. Available from: https://dl.acm.org/citation.cfm?id=357176 [Accessed: 15 September 2018]. Mack, C. A. (2011): Fifty Years of Moore's Law. In: IEEE Transactions on Semiconductor Manufacturing, Volume 24., Issue 2. Available from: https://ieeexplore.ieee.org/abstract/document/5696765 [Accessed: 01 November 2018]. 69 Mankiw, N. G. (2018): Macroeconomics. Worth Publishers; 10th edition. ISBN-10: 1319105998. McLeay, M., Radia, A. & Thomas, R. (2014): Money creation in the modern economy. Bank of England Quarterly Bulletin 2014 Q1. Available from: https://www.bankofengland.co.uk/quarterly-bulletin/2014/q1/money-creation-in-themodern-economy [Accessed: 05 November 2018]. Menger, C. (1976) Principles of Economics. the Ludwig von Mises Institute (Republished in 2007). p. 120. ISBN: 978-1-933550-12-1. Mishkin, F. S. (2011): The Economics of Money, Banking, and Financial Markets. Fourth Canadian edition. ISBN 978-0-321-58471-7. MIT Technology Review (2017): Bitcoin Transactions Aren’t as Anonymous as Everyone Hoped. Available from: https://www.technologyreview.com/s/608716/bitcointransactions-arent-as-anonymous-as-everyone-hoped/ [Accessed: 22 November 2018]. Nakamoto, S. (2008): Bitcoin: A Peer-to-Peer Electronic Cash System. Bitcoin.org. Available from: https://bitcoin.org/bitcoin.pdf [Accessed: 31 October 2018]. Narayanan, A., Bonneau, J., Felten, E., Miller, A. & Goldfeder, S. (2016): Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction. Princeton University Press, Princeton, NJ, USA. O'Sullivan, A. & Sheffrin, S. M. (2003): Economics: Principles in action. Upper Saddle River, New Jersey 07458: Pearson Prentice Hall. p. 246. ISBN 0-13-063085-3. Peach, T. (1993): Interpreting Ricardo. Cambridge University Press. ISBN 0-52126086-8. 70 Pollock, D. (2017): Up To Four Million Bitcoins Gone Forever. Cointelegraph. Available from: https://cointelegraph.com/news/up-to-four-million-bitcoins-goneforever [Accessed: 20 November 2018]. Ponomarenko, A. A., Solovyeva, A. & Vasilieva, E. (2011): Financial Dollarization in Russia: Causes and Consequences. Available from: https://www.researchgate.net/publication/228220469_Financial_Dollarization_in_Russi a_Causes_and_Consequences [Accessed: 16 November 2018]. Pornin, T. (2013): Deterministic Usage of DSA and ECDSA Digital Signature Algorithms. IETF Trust. Available from: https://tools.ietf.org/id/draft-pornindeterministic-dsa-02.html [Accessed: 01 November 2018]. Quantivity (2011): Why Log Returns. Available from: https://quantivity.wordpress.com/2011/02/21/why-log-returns/ [Accessed: 02 November 2018]. Rivest, R. L., Shamir, A. & Adleman, L. (1978): A method for obtaining digital signatures and public-key cryptosystems. Magazine Communications of the ACM, Volume 21 Issue 2. pp. 120-126. Ryan-Collins, J., Greenham, T., Werner, R. & Jackson, A. (2014): Where Does Money Come From?: A Guide to the UK Monetary & Banking System. New Economics Foundation; 2nd Revised edition edition (1 Mar. 2014). ISBN-10: 1908506547. Sharma, R. (2018): Litecoin Gains Ground On Bitcoin In The Dark Web. Investopedia. Available from: https://www.investopedia.com/news/litecoin-gains-ground-bitcoindark-web/ [Accessed: 22 November 2018]. 71 Shim, KA., Park, CM. & Koo, N. (2017): An Existential Unforgeable Signature Scheme Based on Multivariate Quadratic Equations. In: Takagi T., Peyrin T. (eds) Advances in Cryptology – ASIACRYPT 2017. Lecture Notes in Computer Science, vol 10624. Springer, Cham. Available from: https://link.springer.com/chapter/10.1007/978-3-31970694-8_2#citeas [Accessed: 22 November 2018]. Smith, A. (1776): The Wealth of Nations. CreateSpace Independent Publishing Platform (Republished on November 1, 2018). ISBN-10: 1505577128. Stigler, G. (1950): The Development of Utility Theory. I" The Journal of Political Economy Vol. 58, No. 4 (Aug., 1950), pp. 307-327. Available from: https://www.jstor.org/stable/1828885?seq=1#page_scan_tab_contents [Accessed: 22 November 2018]. Suberg, W. (2018): Steve Wozniak: Bitcoin Is ‘The Only Digital Gold’. Cointelegraph. Available from: https://cointelegraph.com/news/steve-wozniak-bitcoin-is-the-onlydigital-gold [Accessed: 22 November 2018]. Sussman, N. & Eichengreen, B. J. (2000): The International Monetary System in the (Very) Long Run. International Monetary Fund. SBN/ISSN:9781451846317/1018-5941. Available from: https://www.imf.org/en/Publications/WP/Issues/2016/12/30/TheInternational-Monetary-System-in-the-Very-Long-Run-3466 [Accessed: 22 November 2018]. The British Museum (2018): The origins of coinage. Available from: https://www.britishmuseum.org/explore/themes/money/the_origins_of_coinage.aspx [Accessed: 01 November 2018]. Yermack, D. (2015): Is Bitcoin a Real Currency? In: David K.C. Lee ed., The Handbook of Digital Currency (Elsevier, 2015), pp 31-44. Available from: https://www.sciencedirect.com/science/article/pii/B9780128021170000023 [Accessed: 05 November 2018]. 72 7. Appendix I: Technological background Understanding the world of cryptocurrencies is not possible without having a grasp of some key concepts in cryptography. Therefore, this appendix chapter will provide an extensive overview of the underlying technical tools, which create the backbone of cryptocurrencies. Such new forms of money face many challenges in the real world, and thus a number of innovative solutions are needed to handle them, which this appendix will also explain. This technical chapter will conclude by showcasing some of the links between the technological and the economic context of cryptocurrencies. The definitions and concepts described in the following sections apply to most cryptocurrencies known today. However, special references to Bitcoin will be made, as it is the primary focus of the evaluation exercise demonstrated in this thesis. Conveniently, most of the coming statements on Bitcoin can be generalized, as the vast majority of other cryptocurrencies follow a similar technical design. 7.1. Cryptography 7.1.1. Cryptographic hash function The cryptographic hash function is a hash function with special properties, which make it suitable for cryptographic purposes. Hash functions are such mathematical functions, which can be used to map any size of data to a fixed size. This way one can represent the information contained in a very large chunk of data with a series of values, which are usually called hashes or hash values. There are three properties of hash functions, which are important to point out (Narayanan et al., 2016): 1. They can take an arbitrarily sized string as an input. 2. They always produce a fixed size output from the taken input. For example, in the case of Bitcoin, the output is 256 bits in size. 3. The computation of the hash function is not inconceivably difficult, which practically means that it can be done in a reasonable amount of time. In technical language, this is specified in the following way: an n-bit string’s hash can be calculated with a running time of O(n). 73 Figure 18: The cryptographic hash function SHA-256 at work* (Source: Own work) *Output calculated using Secure Hash Algorithm-256. Note how small changes in the word “Hello” to “Hallo” changes the entire hash very significantly, and despite the much longer text in input number 3, the hash remains the same length. These aforementioned points are generally present in hash functions, however, some additional properties are required to hold, in order to arrive at cryptographic hash functions. By this, cryptographically secure hash functions are meant. To achieve this, the following properties are needed: 1. Collision-resistance 2. Hiding property 3. Puzzle-friendliness It should be noted, that the third property listed above, that the hash function should be puzzle-friendly, is actually only practical for a cryptocurrency, but is not a general requirement for cryptographic hash functions to work (Katz & Yehuda, 2014). Now, let’s take a closer look at what these additional properties mean. 1. Collision resistance: The hash function, denoted with an 𝐻𝐻, is collision-resistant, when it is infeasible to find such two values (𝑥𝑥, 𝑉𝑉), where 𝑥𝑥 ≠ 𝑉𝑉, but at the same time 𝐻𝐻(𝑥𝑥) = 𝐻𝐻(𝑉𝑉). Less formally, collision-resistance means that in the case of a cryptographic hash function, which bears this property, it is near impossible to find collisions (Ferguson et al., 2012). To better understand this: collisions occur, when one gets the same output from two different inputs. In other words, there is a collision when the hash function creates 74 the same hash from different chunks of data. It would be clearly an undesirable situation, as one would be unable to distinguish between these sets of data, based on their hashes. Figuratively it looks like this: Figure 19: Representation of a cryptographic hash function producing a collision (Source: Own work) Note that collisions actually must exist in the case of hash functions, which can be easily understood by considering the entirety of the possible input space, and the fixed output space. It is logically impossible to not have a collision, when the input space in infinite and the output space is finite. Furthermore, one can also develop techniques to find these collisions with a high probability. However, doing so might take up an unreasonable amount of time. To better understand this, consider the case of a hash function, which produces 256-bit outputs. In this case, one would need to compute the hash 2128 number of times, on average, to find a collision. In the worst-case scenario, it take 2256 +1 computations in this setting. Even the first number is so large, that with current technology, it would take an unfathomable amount of time to calculate this number of hashes. Of course, there may be cases, where an efficient algorithm can be found for a specific hash function in order to locate collisions. If so, then that hash function is no longer considered collision-resistant. Interestingly, there is no scientific proof, that the cryptographic hash functions in use today meet this requirement. As of 75 today, some hash-functions are considered to be collision-resistant, because nobody could find an efficient way to look for collisions in their cases (Narayanan et al., 2016). Using these collision-resistant hash functions is paramount to building cryptocurrencies. It is due to this property, that one can safely assume, that two inputs (𝑥𝑥, 𝑉𝑉) are different, just by checking their hashes, since in this case 𝐻𝐻(𝑥𝑥) ≠ 𝐻𝐻(𝑉𝑉). This way any size of data can be digested, be it a message, or a list of transactions, into fixed length outputs, which can then be easily compared. 2. Hiding property: The hash function, denoted with an 𝐻𝐻, is hiding, when a secret value 𝑟𝑟 is taken from a high min-entropy probability distribution, and given 𝐻𝐻(𝑟𝑟 || 𝑥𝑥) it is near impossible to locate 𝑥𝑥. The hiding property of a hash function ensures that one cannot easily acquire the input 𝑥𝑥 from analysing the output 𝐻𝐻(𝑥𝑥). This is not a straightforward property to acquire, since anyone can try to guess a number of possible inputs with the hash function in question, and might succeed if there are not that many possibilities. To counter this, the input (𝑥𝑥) is concatenated with a random variable 𝑟𝑟 that is very uniformly spread out across a given spectrum (such a number is called a nonce). This is denoted above as (𝑟𝑟 || 𝑥𝑥). If one takes the hash of this concatenated message, then it becomes nearly impossible to find 𝑥𝑥 from the hash (Katz & Yehuda, 2014). This is very useful for making commitment schemes, which can be understood as sealing data into an “envelope”, and then later reopening it. This is another key element that is necessary for constructing cryptocurrencies. 3. Puzzle-friendliness: The hash function, denoted with an 𝐻𝐻 , is puzzle friendly, when for every n-bit output value 𝑉𝑉, given that k is taken from a high min-entropy distribution, it is near impossible to locate 𝑥𝑥 such that 𝐻𝐻(𝑘𝑘 || 𝑥𝑥) = 𝑉𝑉 in reasonably less time than 2𝑑𝑑 . This property ensures the following: it makes it very difficult for anyone to make a desired value to be the hash function’s output. So no one can force the hash function into producing what they want, just by controlling the variable 𝑥𝑥. Additionally, it ensures that there is no better way of finding 𝑥𝑥, than by just simply guessing what it might be. In 76 practice, that means that someone has to take a lot of random variables as 𝑥𝑥, and then check if it produces 𝑉𝑉. If this property holds, then so-called search puzzles can be constructed, which are such mathematical problems, where there are no shortcuts to an efficient and quick solution (Narayanan et al., 2016). One has to search through a huge space for the right answer. Additionally, a set of values can be given as the target for the given search puzzle, thereby increasing and decreasing the difficulty (and the time it takes) to solve them. This is an application of this third property, that cryptocurrencies utilize in the process called “mining”. Note that there can actually be such systems, which do not necessarily need this property. This concludes the overview of cryptographic hash functions, and take a note here, that in the case of Bitcoin, the SHA-256 is used as the hash function (Bitcoin Wiki, 2018d). It relies on the Merkle-Damgard transform to be able to accept any input size, which makes it particularly handy. However, its technical features will not be discussed here. The following section will show how hash functions can be used to construct advanced data structures, which serve as the building blocks of distributed systems such as Bitcoin. 7.1.2. Hash pointer Building on the cryptographic hash functions discussed previously, it is the next logical step to build data structures using these tools. The hash pointer can be thought of as a pointer, which shows where certain information is located, while simultaneously storing the cryptographic hash of that data. This is important, because it also provides a means to verify that the information it points to has not been changed. If it was, then its hash would change as well, resulting in a clear detection of any data manipulation attempt. Figuratively, a hash pointer looks similar to the concept shown in Figure 20. 77 Figure 20: Illustration of a hash pointer (Source: Own work) 7.1.3. Blockchain The hash pointers discussed in the previous section can be used in various combinations, and thus many types of data structures can be built with them. Consider a linked list, which is implemented by hash pointers: this is going to be called a blockchain (alternatively: block chain, but the more common spelling will be used). It is list of data blocks, which are chained together using hash pointers (Bitcoin Wiki, 2018e). The hash pointers themselves are contained in the various blocks, and a participant of such a blockchain only needs to store the head of the list to know that the contained data is not compromised. To better understand this, consider the following. If an early block is tampered with, then its hash will not equal to the hash pointer stored in the n + 1 block. If that changes as well, then it will create a chain reaction throughout the blockchain, since all the blocks are linked together with hash pointers. Note that it is statistically highly unlikely that the changed content (however minor the change) will create the same hash, as the hash function in use is collision resistant (as described in the previous section). Any attempt to change a part of the data would require tampering with all of the blocks. This would require a huge effort, when the blockchain is large, however even in this case, if someone has the head of the list, then he or she can easily detect the manipulation attempt by comparing just that one hash with the top of the blockchain. It is easy to understand how useful this feature is. The most practical application of a blockchain, is to create a tamper-proof data log (Narayanan et al., 2016). One can always add new data, however previous blocks cannot be altered without detection. For a representation of a blockchain, refer to Figure 21. 78 Figure 21: Illustration of a blockchain (Source: Own work) 7.1.4. Merkle tree Now, consider another important data structure, which also utilizes hash pointers, and is based on the same concept: the Merkle tree. The key difference here is that the data blocks are grouped in pairs, and their hashes are stored in a parent node (Bitcoin Wiki, 2018f; Narayanan et al., 2016). These nodes, which contain the pairs of hashes are yet again grouped into pairs, and a new parent node is introduced. This pairing process continues until all the data is covered, and at that point, one arrives at a single node, called the root. This whole structure looks like a tree, and this so-called root is actually at the top of it. Figure 22: Illustration of a Merkle tree (Source: Own work) 79 The Merkle tree provides the same security benefits as the blockchain. If someone tries to tamper with the data in one of the blocks, then the hash pointers in the parent nodes will not match. Continuing to change the parent nodes will not help the adversary either, as such an attack would eventually lead to the root node, which can be remembered by any participant of the system. As such, the integrity of the data structure is ensured by simply storing the hash pointer at the top (the root). Merkle trees have one clear advantage over the blockchain-type data structures, and this is related to the proof of membership concept (Narayanan et al., 2016). There are various scenarios, where someone might want to prove that a given data is part of the system (in this case: the Merkle tree). For someone to verify this, it is enough to only check the path leading to the data in question. Consider the example of a Merkle tree that is depicted in Figure 22, and say that someone wants to show that “Data Block 2” is part of the structure. In such a scenario, they only need to consider the parent nodes that lead directly to the root, thus two steps on the left side of the structure is enough for proof. The rest of the structure can be ignored in this process. The general rule is that when the Merkle tree has 𝑛𝑛 nodes, then it takes log(𝑛𝑛) steps to prove membership. In each step, the hash of the child block needs to be calculated, which means that the time requirement of this process is also logarithmically related to 𝑛𝑛. For this reason, proving membership in this data structure is fast, even if the number of data blocks is very large (Nakamoto, 2008). The Merkle tree and the blockchain are two particularly useful, and thus well-known data structures, which one can build using hash pointers. However, it should be noted that actually many other types of structures are possible with them as well. The only limitation in this respect, is that the structure must not have cycles in it, as those would make it impossible for the hashes to match up. Thus, in general terms, it must be made sure that the structure being built is a directed acyclic graph. These guidelines are essential for developing distributed data structures for cryptocurrency systems (Narayanan et al., 2016). 7.1.5. Digital signature Verifying the authenticity of information, be it raw data, organized data like documents, or just short messages, is essential for interactions in a non-trust-based system. For this reason, cryptocurrencies utilize digital signatures, which are such mathematical schemes that are well suited for these purposes (Ferguson et al., 2012). The 80 required properties of digital signatures are quite similar to simple, handwritten signatures, and thus can be easily understood. When someone signs a document with a handwritten signature in a typical life situation, such as taking up a loan, then the involved parties want the following properties to hold: 1. Authentication: they know who signed it, and thus only its owner can sign it. 2. Non-repudiation: it cannot be denied, that it was the owner, who signed it. 3. Integrity: what was signed, cannot be altered. In the digital realm, digital signatures can be utilized to fulfill these needs, and today, they are widely used in cryptographic protocol suites. Note that electronic signatures constitute a broader term: anything with the intent of signing a document. In some countries, electronic signatures can be useful in the legal system. However, in the case of digital signatures, the primary concern is security. Implementing a digital signature scheme with the aforementioned ideas in mind, typically requires three algorithms (Narayanan et al., 2016): a) Key generation algorithm (𝐺𝐺): creation of two keys, a private key (also known as secret key) from a uniformly random set of possibilities, and a corresponding public key. Generally the private key is denoted with an 𝐴𝐴𝑘𝑘, while the public key is written as 𝑆𝑆𝑘𝑘. b) Signing algorithm (𝑆𝑆): using 𝐴𝐴𝑘𝑘, one can sign a message 𝑚𝑚, which produces a signature 𝐴𝐴 . For any 𝐴𝐴𝑘𝑘 ∈ 𝐾𝐾 and any 𝑚𝑚 ∈ 𝑀𝑀 , where 𝐾𝐾, 𝑀𝑀 are the designated spaces for keys and messages respectively, the following holds: 𝑆𝑆𝑠𝑠𝑠𝑠 (𝑚𝑚) → 𝐴𝐴 c) Verification algorithm (𝑉𝑉): using 𝑆𝑆𝑘𝑘, and looking at the incoming signed message 𝐴𝐴, one can verify its authenticity, meaning, that it was signed by someone, who possesses 𝐴𝐴𝑘𝑘. For an illustration of a simple digital signature scheme, refer to Figure 23. 81 Figure 23: Example for sending a digitally signed message (Source: Own work) It should be noted that algorithm 𝐺𝐺 (used for key generation) should produce random results, as such a situation should be avoided where users have the same key. Algorithm 𝑆𝑆 can also be random, however 𝑉𝑉, used for verification, must be deterministic. Otherwise one would not be able to properly check the signatures using 𝑆𝑆𝑘𝑘 . It is a general requirement that valid signatures must be verifiable in this scheme, and false ones detectable with an overwhelming probability. Formally, the following two things must hold: (12) (13) 𝑉𝑉𝑝𝑝𝑠𝑠 (𝑚𝑚, 𝐴𝐴) = 𝑡𝑡𝑟𝑟𝐴𝐴𝑆𝑆, 𝑟𝑟𝑖𝑖𝑡𝑡ℎ 𝑆𝑆𝑟𝑟𝐵𝐵𝑝𝑝𝑉𝑉𝑝𝑝𝑖𝑖𝑉𝑉𝑡𝑡𝑉𝑉 = 1 𝑖𝑖𝐼𝐼 𝑆𝑆𝑠𝑠𝑠𝑠 (𝑚𝑚) → 𝐴𝐴 𝑉𝑉𝑝𝑝𝑠𝑠 (𝑚𝑚, 𝐴𝐴) = 𝐼𝐼𝑉𝑉𝑉𝑉𝐴𝐴𝑆𝑆, 𝑟𝑟𝑖𝑖𝑡𝑡ℎ 𝑆𝑆𝑟𝑟𝐵𝐵𝑝𝑝𝑉𝑉𝑝𝑝𝑖𝑖𝑉𝑉𝑡𝑡𝑉𝑉 ≈ 1 𝑖𝑖𝐼𝐼 𝑆𝑆𝑠𝑠𝑠𝑠 (𝑚𝑚) ↛ 𝐴𝐴 There are additional important security requirements in a digital signature scheme. One of the most important ones is that the signatures should not be easy to forge. The most general attack on digital signature schemes is the adaptive chosen-message attack (for more on this topic, see Shim et al., 2017). In this situation, the adversary possesses the public key, and is able to get signed messages from its target, which is referred to as an oracle signing service provider. This enables the attacker to learn from the received signatures, and eventually mimic the original 𝐴𝐴𝑘𝑘 for signing. If successful, the attacker can create messages of his own, and they will pass the verification process. This is referred to as the unforgeability game of the digital signature schemes (Narayanan, 2016). To ensure security, there must be no efficient way of forging the scheme. This leads to a situation where an attacker can only prevail in an unreasonable amount of time, or with infinite computational power. 82 In addition to the security design of these signature schemes, there are a few practical issues to consider as well. One is concerned with randomness. Even the most advanced schemes can be easily broken, if bad randomness is used (Ferguson et al., 2012). There are two broad methods to create random values: one is to rely on a physical phenomenon, which is considered naturally random (e.g. atmospheric noise or radioactive decay). The second one is about using algorithms to produce sequences of seemingly random numbers. However, these rely on so-called initial values, which if discovered, can compromise everything, since those can be used to reproduce the random sequences. For this reason, this second type of method is called a pseudorandom number generator. They do not rely on natural entropy present in the real world, and thus are not truly random. As a result, the quality of randomness can vary greatly, and this affects the cryptographic security discussed previously (Ferguson et al., 2012). Another issue to consider in digital signature schemes is related to the size of the messages. Typically, the signing algorithms used in these situations limit the length of possible message inputs, which would be an obstacle for the general application of digital signatures. To circumvent this problem, first the hash of the message is calculated and then the signature is applied on top of that. As shown in Section 7.1.1., the hash of a message can be considered a safe digest of the information contained within, when the hash function is collision resistant. Accordingly, this practice allows one to sign messages of arbitrary length. Furthermore, one can also sign hash pointers in this process, which if chained properly, can apply to the entirety of a blockchain or any other type of data structure. There are various types of digital signing schemes, and the earliest and most notable examples derive from the Rivest–Shamir–Adleman (1978) cryptosystem (RSA). The RSA was one of the first public-key cryptosystems, yet it is still widely used today for data transmissions. Another notable example is the Digital Signature Algorithm (DSA), and an elliptic curve variant of this is called the Elliptic Curve Digital Signature Algorithm (ECDSA). The ECDSA is the algorithm used in the Bitcoin system (Bitcoin Wiki, 2018g). For an insight of how DSA and ECDSA work, see Pornin (2013). 83 7.1.6. Identity management with public keys Having identities in a digital system, either transparent or concealed, is crucial for interactions. An idea that was mostly propagated by Bitcoin, is to use public keys (referred to as 𝑆𝑆𝑘𝑘 in the previous section) as identities of different actors. In this setup, one can consider any signature on a message to be a statement by an actor. The 𝑆𝑆𝑘𝑘 is accessible to anyone, thus the actor’s messages can be verified, reassuring it was that given person who made a statement, or committed to an action. The only requirement is that this person, and this person only, has the corresponding 𝐴𝐴𝑘𝑘 . In real life usage, the actors of cryptocurrency systems like Bitcoin rather use the hash of their public key (which is shorter), and not the raw 𝑆𝑆𝑘𝑘 as their identity (Narayanan et al., 2016). Since new pairs of 𝑆𝑆𝑘𝑘 and 𝐴𝐴𝑘𝑘 can be generated at whim, nobody is confined to one identity, allowing for a certain level of anonymity. Note that creating these pairs can be done by anyone, no central authority is needed, which essentially translates to a decentralized identity management system. The keys are generated randomly, and thus the chance that someone would generate the same n-bit length key as someone else is effectively negligible. However, this only holds true, as long as someone relies on genuine sources of randomness in creating the pairs of keys, as described in the previous section. Should they use the same biased sources, the inferences made using probabilistic theory might no longer hold. The identities created in this way is referred to as addresses in the general language of the cryptocurrency world, and technically this always means the hashed public key of a certain actor. It should be noted that even though anyone can create as many addresses as he or she pleases, this does not necessarily ensure full anonymity, since the actions made using these identities might be linked together, and later even connected to a real life person. This is the case in the Bitcoin system (MIT Technology Review, 2017), and thus other techniques were developed in other systems to overcome this issue, however this is outside the scope of this thesis. 7.2. Basic model of cryptocurrencies Section 7.1. discussed the cryptographic tools that are essential for the operation of cryptocurrency systems. This second part of this appendix now demonstrates how putting them together can be used to construct cryptocurrencies of any kind. The technical model presented here can be considered as the basic formula for cryptocurrencies. Real life 84 constructs follow the same technical principles discussed below. Now, take the following as the starting point of building an electronic payment system: • An electronic coin is a standard measure (i.e. 1) of a given electronic money. • Electronic coins are created by an ID-generating algorithm. These IDs represent the coins, and they must be unique. • Coins travel in a chosen network through the means of digital signatures. • Transactions are linked together using hash pointers in a given data structure. This means, that electronic money is essentially a chain of digital signatures, as proposed by Nakamoto (2008) in case of the Bitcoin system. Coins are transferred, when a payer digitally signs (the hash of) the preceding transaction (that is, where the coin came from) and the public key (the identifier) of the recipient. This way, a chain of ownership is created through which the uniquely identifiable coins travel. For a simple example, consider the following situation: A owns several coins and he wants to pay 1 coin to B. To do this, A creates a statement that he pays 1 coin to B. He does this by digitally signing a hash pointer, which points to the ID of that 1 coin being transferred, as well as B’s public key, which is essentially his identifier, and shows where this particular coin travels to. After it is completed, B can prove that he now owns that 1 coin he received from A, since anyone can verify the validity of the statement using A’s public key (showing that it was indeed A who transferred that coin). B can now pay with the 1 coin he received to C, and such a payment chain can go on indefinitely. The validity and ownership of this particular coin can be traced backwards to the point, where it was created. How coins can be created in such a system will be discussed in Section 7.2.5. For an overview of this aforementioned payment process, refer to Figure 24, which shows how a coin goes from the generating source to A, then from A to B, and finally from B to C. 85 Figure 24: The process of transferring the ownership of CoinID #1 (Source: Own work) This represents the basic mechanism of an electronic currency that is operated with the help of cryptographic tools discussed in the previous sections. Much of these techniques were well-known prior to the debut of Bitcoin, the first functioning cryptocurrency (Narayanan et al., 2016). How come then, that cryptographers did not succeed before Nakamoto? The answer is that electronic payments systems, such as this basic one discussed above, have many inherent problems. Various issues can make them prone to certain types of attacks, if designed improperly. One of the most fundamental issues to address in this respect is the possibility of a double-spending attack (Nakamoto, 2008). 7.2.1. Double-spending attack It is an inherent problem in all electronic currency schemes that digital tokens, such as the coins mentioned in the previous section, can be spent multiple times (Narayanan et al., 2016). This is simply due to that fact that digital files, such as digitally signed documents, as shown in the previous model, can be easily duplicated. Consider the situation shown in Figure 24: A is paying 1 coin to B by signing a hash pointer with the public key of B, thereby transferring the ownership of that 1 coin to him. B is able to verify this transaction by using A’s public key and running the verifying algorithm. If it checks out, B will believe that he is now the rightful owner of that coin. 86 However, A can make the same signature and offer it to C, thereby double-spending the coin in question. Neither B, nor C will be aware of this fraud, unless someone warns them, or when they later realize that both of them has a coin with the same ID. This newly created situation is depicted in Figure 25. Figure 25: Double-spending attack by actor “A” (Source: Own work) This is such a serious problem in cryptocurrency systems, that has effectively hindered their operation prior to the debut of Bitcoin. For this reason, simple cryptocurrency schemes, as described in the beginning of Section 7.2. are prone to exploitation, unless a defense mechanism is introduced. There are two ways to do this: 1. Creating a central authority to check for and prevent double-spending attempts. 2. Establishing a decentralized mechanism, which effectively defeats these attacks. The first solution is very straightforward. The cryptocurrency system is supplemented with a trusted third party, who can centrally oversee all the transactions. This way, this central authority can verify that any payee offering to pay with a coin is honest. On a technical level, this can be implemented in a way that this central authority regularly publishes an append-only ledger. Participants broadcast their signed transactions to this third party, who reviews them, and stores them in the ledger. This ledger should contain all the transactions that were made in the past, and could be done in a blockchain type of data structure. The data blocks containing the transactions, and the hash pointers forming 87 the blockchain, would be digitally signed by the central authority. By checking the very last item on this chain, would be sufficient to know that the entire transaction history is intact (as explained in Section 7.1.3). Figure 26: Centralized solution to double-spending attacks (Source: Own work) In case a given transaction would be missing from this chain, it would be considered invalid by the participants of this cryptocurrency system. If the central authority is acting in an honest way, and does not sign double-spends like the one shown in Figure 25, then such a system can work flawlessly. However, the problem is related to trust. Why would participants trust a central authority, and how can they choose an honest one? The answer to this issue is that they do not need to. The second option for countering double-spending attacks is about eliminating the need for a central authority, and thus the need for trust in the system (Nakamoto, 2008). This solution, however, is not just more complicated, but also more prevalent in cryptocurrency design, thus a separate section is devoted for its discussion. 88 7.2.2. Non-trust-based solutions It is a fundamental question in nearly all digital systems, whether they should be built around a central authority or in a decentralized manner. In fact, these two approaches often compete with each other in various aspects of the digital world, such as in communication. Well-known examples are the email with the Simple Mail Transfer Protocol or messaging through Facebook. It is worth noting that complete decentralization is usually not achieved in the real world, and some parts of a system remain centralized (Narayanan et al., 2016). It will also be the case with cryptocurrencies, where the basic operation of the system is generally decentralized, however many essential services, such as the exchanges or the third party software solutions might not be. As such, only decentralization in the aspect of the core technological solution will be discussed. Of course, there are other important questions to address in this field, however, those are primarily related to the economic aspects of cryptocurrencies. In this section, the main concern is the maintenance of transactions, and the authority over their validation. Both are related to the basic mechanics of transferring valid coins of cryptocurrencies to different parties, and the principal issue to address here, is how decentralization can be achieved in this regard. To do this, distributed consensus has to be achieved among the participating members. For this, a protocol is needed to ensure that the vast majority of the network agrees on the state of the cryptocurrency system. The state in this respect refers to the ownership of coins, and the validity of transactions. All of these transactions are broadcast to all the members of the network, who gather this information, then decide on whether to record them in the ledger or not. Furthermore the protocol can also tell them in what order to do so. Transactions can be grouped, and then recorded in separate blocks, just as Section 7.1.3. described this mechanism. The key question here is how the participants, or the nodes of the network, will agree on which block to record in the ledger. Everyone can propose a block, and there has to be a way to decide on which to go with. Such a protocol should ensure that no faulty and malicious blocks (containing double-spending attacks) are accepted. Designing such a protocol is particularly difficult, as it has two issues to overcome: 1) it has to deflect attackers, and 2) it has to overcome any general issues with the network itself, such as high latency or other imperfections (Nakamoto, 2008). With respect to the first issue, there are theoretical challenges to consensus design as well, such as the Byzantine Generals Problem, which can give impossibility results in certain setups (for a 89 background on this, see Lamport et al., 1982). Interestingly, even without a clear solution to these problems, some consensus protocols were found to work well in practice (Narayanan et al., 2016). These theoretical issues, however, will not be discussed in this appendix chapter. Nonetheless, note that it is an area where further theoretical research is needed in respect to finding a stable consensus design for cryptocurrencies. 7.2.3. Sybil attack There is one additional topic to discuss before giving an example of a distributed consensus protocol, and that is the practical vulnerability of any consensus mechanism in a peer-to-peer network, which has decentralized identity management. As it was mentioned in Section 7.1.6., identity management is unique in cryptocurrency systems in that they are generally not overseen by a central authority. Identities can be created at will, and this provides an opportunity for an attacker to subvert any consensus process in a given system. If there are no limitations for generating identities (i.e. public keys), then an adversary can identify itself with a large number of separate nodes, and thus try to gain a larger influence in a network with distributed consensus (where everyone is involved in the consensus process). This is called a Sybil attack, and the nodes created by such an adversary are referred to as Sybil nodes (Bitcoin Wiki, 2018h; Narayanan et al., 2016). Since giving up decentralized identity management is not desirable, a new solution has to be introduced to avert this attack. Such a design is needed, which ensures that no one can multiply its voting power in the network, by simply creating additional identities. This can be achieved by a certain type of random selection, which does not take into consideration the number of identities. In the case of the Bitcoin system, this random selection will consider the computing power of the nodes, which cannot be manipulated in the same way as the possession of identities. The implementation of this solution will be discussed in more detail in Section 7.2.6., however, prior to that, a simplified example can be given on how the distributed consensus protocol looks like in Bitcoin. 90 7.2.4. Consensus algorithm The preceding sections now enable the discussion on how Bitcoin’s consensus algorithm works, and see why it is a robust method. Bitcoin’s solution provides a basis for many other cryptocurrency designs, and the inherent ideas are considered novel in the field of consensus protocols. To provide an overview of how it is designed, a step-by-step list is shown on this algorithm (Bitcoin Wiki, 2018i; 2018j; Narayanan et al., 2016). 1. Every node can create new transactions and then broadcast it to everyone. 2. Every node collects all transactions and then puts them in blocks. 3. There are rounds in given time intervals for broadcasting these blocks. 4. Random node selection is used to decide which broadcast block makes it into the ledger. (This random selection will be discussed in Section 7.2.6.). 5. The newly created block is checked by other nodes if it is valid. 6. If valid, that block is approved by other nodes. This approval is implemented by including the hash of the previous block when a new block is created. This is a repetition of step 1-4. 7. If invalid, the block is ignored, and the nodes extend the previous longest valid branch. As it is clear based on the steps shown above, the consensus ensures that new blocks are created by nodes in a given time interval. In the case of Bitcoin, it happens in every 10 minutes on average. The reason why this consensus filters out malicious blocks is that the hash of such wrongdoing will not be included in new rounds, assuming that the majority of the winning nodes (those who get to create new blocks) are acting in an honest way. The reason why the majority acts in the right way (i.e. follows the reference protocol for normal operation) is that they are incentivized to do so. Now, the next section discusses the incentive system of Bitcoin, which is crucial for the robust operation of this protocol. The other key element in this mechanism is the uniquely random selection of nodes that were mentioned previously. This is indispensable for successful operation, since one has to ensure that nobody can take the lead in creating blocks. The selection process has to be rather spread out across real participants to deflect (or tax) a Sybil attack. 91 7.2.5. Block reward Incorporating incentives to further stabilize a distributed consensus mechanism is a novel idea introduced by Nakamoto (2008) in the Bitcoin system. It is not a technological solution, but rather a creative use of certain tools to make a technology – the consensus mechanism – more robust. As it was briefly mentioned in the previous section, participants are given incentivizes to act in an honest way, and thus follow the reference protocol. This is achieved by incorporating a unique coin generating function in the block creation process. Whenever a node is chosen to create a new block, that new block will contain a special transaction for sending a certain number of newly minted coins to an address of the block creator’s choice. In practice, this means that the creator of a block is rewarded with coins in the system. However, as it was discussed in Section 7.2.4., other nodes will only validate and extend the given block with additional new blocks, if that adheres to the rules. If the block creator would include a double-spending attempt in that particular block, then others would simply ignore it in the following rounds. This way, an attacker could not spend the coins he or she earned for creating the block, as that would no longer be on the longest valid branch. For this reason, participants face strong incentives by these new coins – the so-called block reward – to act in an honest way. Otherwise, their reward ends up on an orphan block, rendering it worthless. If this block reward is considered valuable, then the majority of nodes will act in an honest way, according to the reference protocol. Any attempts to deviate from protocol will most likely end up on an orphan block, as the other participants – if not all collaborating – will aim to get (a share of) the block reward. In practice, a block reward is not constrained to the newly generated number of coins, but can also be supplemented by transaction fees. In that case, the transaction fees are deducted from the input side of the incoming transactions. Thus, the full reward for creating a block equals the new coins plus the transaction fees, which can be a certain percentage of the input coins used for paying someone in that round. Then the entire money supply in this system is determined by the function responsible for money creation in this process. The last thing to discuss in this mechanism is the random selection of nodes. If there is collaboration among nodes, then the system has to be designed in a way that it is not easy to take the lead in the block creation process. This can be ensured by a proof-of-work (PoW) system, or its similar variants, like proof-of-stake (PoS). In the following, both of them will be discussed briefly, noting that proof-of-work serves as the basis for Bitcoin (Nakamoto, 2008). 92 7.2.6. Proof-of-work As it was discussed in the previous two sections, nodes will strive for creating new blocks, as they are rewarded in the process, and some might try creating Sybil nodes to gain an extra advantage. To avert chaotic competition and diminish the desirability of Sybil attacks, a proof-of-work system has to be introduced. In the following, the version implemented in the Bitcoin system will be discussed. Bitcoin introduces hash puzzles to serve as a PoW system. Proof-of-work could mean any deterrence to abuses, by making an attack, such as the Sybil attack, very expensive to accomplish. One solution could be that all nodes have to do a certain amount of work (e.g. a given calculation) before being allowed to participate in the process. Such ideas were actually proposed much before Bitcoin, with the idea of preventing harmful behaviors, such as spamming over the internet (see for example Back, 2002). In the case of the Bitcoin system, the hash puzzles are the choice of work that each node has to participate in, if they want to win the block reward explained in Section 7.2.5. The hash puzzle is named so, because it is effectively a puzzle that is computationally very intense. The idea is based on the Hashcash proof-of-work system (Back, 2002). In this setup, anyone wishing to be the creator of the next block is to find a special number, a so-called nonce, which if concatenated with the hash of the previous block and the new transactions, provides a specific string. Such a sting, that when hashed, results in a certain type of hash. More precisely: given the nonce, the hash of the concatenated string has to fall into a defined target space (Nakamoto, 2008). A target space is a subset of all possible hash outputs. For example, one can define the target space as all the hashes, which start with a given number of zeros at the beginning. The puzzle in this case is to find the appropriate nonce, which results in a hash with this requirement. Formally, the nonce denoted with an 𝑛𝑛 has to satisfy the following inequality: (14) 𝐻𝐻(𝑛𝑛||𝐻𝐻(𝑆𝑆𝑟𝑟𝑆𝑆𝑝𝑝𝑖𝑖𝐵𝐵𝐴𝐴𝐴𝐴_𝑝𝑝𝑉𝑉𝐵𝐵𝐵𝐵𝑘𝑘)||𝑛𝑛𝑆𝑆𝑟𝑟_𝑡𝑡𝑟𝑟𝑉𝑉𝑛𝑛𝐴𝐴𝑉𝑉𝐵𝐵𝑡𝑡𝑖𝑖𝐵𝐵𝑛𝑛𝐴𝐴) < 𝑡𝑡𝑉𝑉𝑟𝑟𝑔𝑔𝑆𝑆𝑡𝑡 This hash function has to satisfy the puzzle-friendliness outlined in Section 7.1.1. to make it impossible to calculate in an efficient way. If this holds, then there is no better solution to finding the required nonce, that by trying random numbers. In this PoW system, all nodes compete with each other at the same time in finding this number. Whoever finds it first, gets to build the next block. This process is referred to as Bitcoin 93 mining (Bitcoin Wiki, 2018k). Since trial and error is the only way to solve the puzzle, nodes will succeed in a random manner, however, their computing power will influence their success rate. The probability of a node winning the hash puzzle is equal to its share of the total hash rate. To see an example in this respect: if node A controls 1% of the total hash rate, then it has a 1% chance of winning in every round. On average, A will win every 100th round. If node A has double the computing power (two-times the hash-rate) of node B, then node A will – on average – get double the amount of block reward. However, it does not mean the A will always win over B, because it calculates faster, as it is a random process, and the previous work done cannot be accumulated for the next. Thus, it can even happen, that B wins two times in a row due to mere chance, yet in the long term, the probability will be in favor of A, and its average block reward will converge to two-times that of B. It is quite apparent from this setup, that nodes are selected in a random manner, as they chance upon the correct nonce. For this reason, there is no point in creating Sybil nodes, as it is the computing power that matters in this system. Collaborating with other nodes will also fail, since the assignment sequence of block creation is random. One would have to join forces with actors who control over 50% of the entire computational power of the system to make sure that they can usually create consecutive blocks. More background will be provided on this type of attack in Section 7.2.8. Another property worth mentioning regarding this hash puzzle type of PoW system, is that its difficulty is adjustable. By modifying the required output space, one can lower or increase the difficulty level of finding a given nonce. This feature is very important in cryptocurrency design, as it can effectively set how costly it is for participants to operate the system (since computation power is associated with fixed costs in hardware and variable costs in electricity). Adjusting the difficulty parameter can also set the pace of block creation, which the designer of a cryptocurrency might want to keep fixed. In the case of Bitcoin, the required target is automatically recalculated every 2016 blocks to ensure that new blocks are created in 10 minutes intervals on average (Bitcoin Wiki, 2018i). This effectively means that no matter how big the ecosystem’s computational power grows, the difficulty will keep rising to ensure a steady block creation sequence. Since block creation is also the source of money creation in the Bitcoin system, this adjustable difficulty could actually be used as a monetary policy tool. In the current setting, the money supply follows a predetermined path, and the computational 94 fluctuations are offset by the difficulty parameter, which is technically the required output space for the hash. 7.2.7. Proof-of-stake As described in the previous section, alternative solutions can be proposed for solving the issues related to distributed consensus. In a proof-of-stake system, the resource that is used to determine “voting power” is related to one’s stake in the system. In a theoretical scenario, a PoS system could ensure that if a given node owns 1% of the coins in the system, then he or she can only “mine” 1% of the blocks as well. The idea is that the more share a node has in a cryptocurrency, the less incentive it has to undermine the entire system, and thus can be considered more reliable (Github.com, 2018). There are also other variations of the PoS system, which combine it with randomization. For example, Peercoin’s system uses a concept of “coin age”, which gives a higher probability of signing a new block to the owners of older coins (Github.com, 2018). Advocates of the proof-of-stake system usually emphasize the much lower electricity costs associated with its operation, when compared to the hash puzzle type of proof-of-work. It should be noted though, that the PoS can introduce additional problems in the proper functioning of a cryptocurrency system, such as a very low deterrence for generating multiple branches in a blockchain, which could hurt the general consensus. This appendix chapter will not go deeper into the possible advantages or disadvantages of such alternative design choices. The discussion on technical design elements is concluded with the proof-of-stake alternative. The following section will now consider a well-known attack on the PoW of cryptocurrencies. 7.2.8. 51% attack In the previous sections, it was laid out how consensus can be achieved in a Bitcoinlike cryptocurrency system, and demonstrated how it can deflect various attacks, including the historically unpreventable double spending attempts. However, such a consensus mechanism is not entirely secure either. There is still a way to carry out a double spending spree successfully in this system, it just becomes very difficult to do so. If an attacker is able to temporarily gain control over 50% of the computational power (also referred to as the hash rate) in the system, then he will be able to divert the consensus mechanism and control the longest valid branch. This would allow an adversary to successfully launch a series of double-spending attacks in the network, however, it would 95 be visible to the other honest nodes (Bitcoin Wiki, 2018h; Narayanan et al., 2016). Furthermore, it should be noted that a so-called 51% attacked would still not be able to simply steal the token coins (e.g. bitcoins) of others. Diverting the consensus protocol does not mean that the cryptography of the system is compromised. Should the attacker create a malicious transfer of other people’s coins to himself/herself, the signature on it will still be fake, and others will be able to verify this. To steal the coins in a cryptocurrency system one would have to be able to forge signatures, and that – with current technology – is an impossible task. Such an attacker can, however, do a list of other damaging actions in the system. He or she can, for example, suppress anyone in the network by not including his or her transactions in the blockchain’s longest valid branch. The attacker, however, could not strip anyone from broadcasting its transactions in the peer-to-peer network, thus such wrongdoing would also be visible to others. The 51% attack would also not be able to bend the rules of a cryptocurrency system, such as the Bitcoin network. Its rules are encoded in the base software, which the nodes run on their individual computers, and altering them is not possible this way. This means that a 51% attacker could not artificially change the block reward in the system for his or her gain either. The most likely outcome of a 51% attack would be temporary financial gain for the attacker (by surprise double-spends) and a lasting decline of trust in the system. In fact, this latter effect could be so far-reaching, that it could even spell doom for a cryptocurrency. If people could not trust the longest valid branch, they could eventually decide not trust the cryptocurrency itself. It should be noted though, that the bigger the ecosystem of a cryptocurrency, the more difficult it is to accomplish such an attack. In the past decade, 51% attacks mostly posed a theoretical danger to the functioning of cryptocurrencies, however, it has changed recently. With the spread of computer power renting services, it became feasible to overwhelm some lesser networks. Such schemes may have driven the notable 51% attacks on Bitcoin Gold, Zencash and MonaCoin (Hertig, 2018). Large networks, like Bitcoin and Ethereum, are better protected against such attacks, as there is likely not enough free power capacity up for rent to successfully attack them in their current state. Crypto51 (2018) has been tracking the estimated costs of such attacks, and an overview is presented on their findings for five large cryptocurrencies below. 96 Table 12: Estimated cost of 51% attacks against major cryptocurrencies Name Bitcoin Ethereum Bitcoin Cash Litecoin Dash Market Cap $111.99 B $22.11 B $10.57 B $3.23 B $1.42 B Algorithm SHA-256 Ethash SHA-256 Scrypt X11 Hash Rate 47,254 PH/s 210 TH/s 4,898 PH/s 234 TH/s 2 PH/s 1h Attack Cost $434,317 $157,348 $45,023 $33,593 $8,503 NiceHash-able 1.0% 4.0% 10.0% 7.0% 37.0% (Source: Personal collection based on Crypto51, 2018) It should also be noted, that hash power can also accumulate in certain mining pools, which can also pose a security issue in this regard. Even in the case of Bitcoin, which has the largest network with the most miners, a very strong accumulation of power is visible in the hands of a few groups (although these are not entities themselves, just pools of miners, who may not necessarily act in concert). Blockchain.com (2018) provides a realtime estimate of the hash rate distribution among various mining pools, and this confirms that the majority of power is accumulated in the hands of a few mining pools. 97 Figure 27: Estimated hash rate distribution among Bitcoin mining pools (Source: Blockchain.com, 2018) In conclusion, the 51% attack is not just a theoretical problem in proof-of-work based cryptocurrencies, but can actually pose a real threat in less developed systems. It does not allow an attacker to simply steal coins at whim, and any attempts to double-spend will be visible by the network. Such an attack is, however, able to diminish the trust in the entire system, and can thus severely damage cryptocurrencies, if allowed to happen. 7.3. Links between technology and economics The previous sections discussed the various cryptographic building blocks of cryptocurrencies, and the most important concepts. Section 7.2. of this appendix chapter showed how these pieces can be fit together to form a wholly functional cryptocurrency, such as Bitcoin. To further add to this discussion, this appendix has also outlined the wellknown obstacles in cryptocurrency design, such as the possibility of a double-spending or a Sybil attack, and then showed the corresponding solutions. The concepts and the tools discussed in this chapter generally apply to the entire range of cryptocurrencies today, which mimic the design of Bitcoin. 98 Using these ideas, an arbitrary number of altcoins can be designed from a theoretical point of view (and the freely available source code of Bitcoin can also be altered at whim). One example could be, where the proof-of-work system of Bitcoin is replaced by the proof-of-stake solution (such altcoins do already exist), or where different data structures are used in the constructions process. The key point to note here is that there is a certain degree of freedom in cryptocurrency design, which have given rise to over a thousand different concepts. The majority of these, however, are very closely related to Bitcoin, and only distinguish themselves in a select few areas. Even those altcoins, which offer a significantly different service, mostly share the fundamental basics of Bitcoin, such as the use of a blockchain. For this reason, it is not far-fetched to say that the basic model of cryptocurrencies shown in Section 7.2. and the overview of Bitcoin’s design in Section 2.2. of Chapter 2 (in the main part of the text) can be easily used for generalization in the cryptocurrency arena. This appendix does not intend to dig any deeper into the technological underpinning of cryptocurrencies, however understanding their basic construct – as outlined in this appendix – is essential for any economic discussion of the topic. Three very strong reasons can be stated in this respect: 1. Understanding the cryptographic properties of hash functions, and the organization of such data structures as the blockchain, is essential for understanding how cryptocurrencies can function safely as money. 2. Knowing how the difficulty parameter in the proof-of-work system governs the supply of money in Bitcoin, and similar altcoins, is essential for understanding what kinds of tools may be available for conducting monetary policy in the realm of cryptocurrencies. 3. The intrinsic value of cryptocurrencies is a very intricate topic, however it is clearly related to how robust and useful the underlying technology is. Thus, any assessment of its economic value (or from the aspect of other theories of value) has to take into consideration the technological framework of cryptocurrencies. The evaluation part of this thesis only deals with the monetary aspects of cryptocurrencies, and analyzes the case of Bitcoin in this respect. However, understanding the overall design of cryptocurrencies is a prerequisite to any discussion on their performance. 99 8. Appendix II: Putting Bitcoin into a historical context This second appendix serves a unique purpose: it attempts to put cryptocurrencies in a historical context. As it was suggested in the main part of the thesis, some believe that this technology represents the next step in the evolution of money. In the following, this notion is explored from the perspective of economic history. 8.1. History of money In the early ages of human civilization, money emerged from the mixed needs of people. The distribution of resources was uneven in social groups and there was an inherent need for trade. However, the exchange of goods could only happen when there was a mutual need for the good or service that the other party owned, otherwise no deal could be made. This barter-like system was an early form of transacting, but it introduced harsh limits on trade, and thus lowered everyone’s utility (Hirshleifer et al., 2005; Mishkin 2011). Consequently, there was a strong incentive for humans to find a workaround to the limits of barter. Theoretically, there were two solutions to this problem from early on: money and debt. There is reason to believe that debt came long before money as a form of settling trades (Graeber, 2011). If the selling party was willing to take the word of the buying individual that it will repay what it owes in the future, then exchanges could still happen without immediate barter. This way, the discrepancies in the needed items could be eliminated by giving credit (seller) and taking debt (buyer). However, this nonmonetary arrangement could only work in such scenarios, where there were ways to enforce the repayment of debts, and the borrowers did not default on their obligations on a regular basis (meaning that they could acquire the needed items) to deter this practice. Absent any functioning jurisdiction, this could only work efficiently in closed social groups. However, as civilizations grew and advanced, money had to be invented to facilitate the exchange of goods and services among larger groups of people. The next step was choosing the appropriate item to serve as money in a given social context. Note that some items were better suited to become money than others due to their inherent properties. People first chose from items that already had some value in society, in fact, they selected such goods, which were generally valuable for large groups of people. This way, others could simply accept it based on its inherent value, and those who 100 took it only for its exchange value, could still easily find someone who had need for it. This situation gave birth to commodity money (O'Sullivan & Sheffrin, 2003). There were, however, several limitations to what could best serve the role of money. It was not enough that it had inherent value for large groups of people, since if that item could spoil (food resources), then it would not hold its value well enough. Similarly, if it was not divisible, then it could not facilitate the different types of payments needed in a market of goods. Furthermore, if it were abundant in nature, then people would not find it valuable enough to accept it in exchange for other goods. These property requirements gave birth to a great number of different commodity monies in the course of history. The first commodity money that resembles today’s modern terms in the form of a coin was the stater electrum coin from Lydia. Herodotus documented that the Lydians were the first to use gold and silver coins as money in the 7th century BC, however these coins were actually made from a naturally present alloy of gold and silver, which is called electrum 10 (The British Museum, 2018). This was an important step in the evolution of money, as it was a clear step towards standardization. People no longer had to rely on weighing precious metals or other commodities to deduce their true values, but could easily count the number of coins in a trade deal. In this setting, gold was an ideal choice for money, as it fulfilled the required properties mentioned above: it did not spoil (it did not corrode), it was divisible (and could be easily processed), and it was scarce in nature. It is an interesting thought that the ideal properties of gold have made it such a good choice for money that its actual usefulness was no longer a question (this statement is also true for silver). Based on archeological evidence, it is known that gold had been a favored decorating tool for artifacts since the 4th millennium BC (Gopher et al., 1990), yet it is reasonable to assume that this usage did not change significantly in the following eras. Thus, it suggests that eventually the properties of money, and the functions it served, were far more important to people than their inherent value. In the course of human history, precious metals, especially silver and gold, and in some cases their combination (a bimetal system), was the primary form of money in the world. The following step in the evolution of money was the emergence of representative money. It is a form of money that represents commodity money, and can be reliably exchanged for that (e.g. gold or silver). This idea gave rise to paper money in the economy, the value of which (at this stage of history) was directly related to the 10 Interestingly, there is a wallet software called Electrum Bitcoin Wallet. 101 underlying commodity money. Representative money had all the beneficial properties of the underlying commodity money, and it was far easier to carry and use. The problem, however, was with trust. Representative money was first issued by private institutions, such as early forms of banks. With a few exceptions, such money was not monopolized by governments at first, and were thus not backed by any official authority either. When they did in fact monopolize money issuance with the establishment of central banks, the trust in representative money was still not the same as commodity money, since governments routinely depegged their currencies to gold and silver in times of fiscal pressures (Karaman et al., 2018). Prior to the 19th century, silver money was the dominant medium of exchange in most countries, as it was more practical for settling everyday transactions than gold, however it slowly started to change afterwards (Sussman & Eichengreen, 2000). The period of the classical gold standard lasted 34 years, as the outbreak of the First World War (1914) forced many nations to abandon the free convertibility of their currencies to gold (Sussman & Eichengreen, 2000; Eichengreen, 1989). There were several new attempts to return to the gold standard after the war, however, in the period of the great depression (from 1929-1933 in most countries) the gold-pegged exchange rates came under severe pressure. From 1931 onwards, most countries gave up defending their pegs, and delinked their currencies from gold altogether. Despite the failure of these pegged regimes, gold did not lose its significance in the financial world just yet. U.S. president Franklin Roosevelt temporarily decoupled the U.S. dollar from gold, however, after a devaluation of the currency (they moved the dollar price of gold from 20.6 to 35 USD, constituting a massive shift in value) they introduced a new gold peg in January 1934 (Sussman & Eichengreen, 2000). Thus, the gold peg could live on in the financial world, and as the U.S. became a dominant actor in the ending phase of World War II, they could shape how international monetary management was established in 1944. The Bretton Woods system required leading nations to adopt such monetary policies that result in a fixed exchange rate (with a 1% threshold) to gold, and this later led to the rise of the U.S. dollar as the dominant form of international reserves. This arrangement lasted until August 15, 1971, when the U.S. terminated the convertibility of the dollar to gold. This incident, referred to as the Nixon shock, sealed the fate of the Bretton Woods system, and finally allowed the concept of fiat money to spread around the world (Bordo, 1993). Most major currencies, like the U.S. dollar or the pound sterling, became fiat money, in a free-floating monetary policy regime. 102 Fiat money is such money that is not backed by any precious metals, and thus has no intrinsic or any “use value”. It only has value due to government regulation, which declares it legal tender, and people – in most cases – are compelled to accept it in the course of transactions. Note that fiat money systems were known and tried well before the collapse of the Bretton Woods system or even the period of the classical gold standard. In fact, there were several historical periods, where governments switched back and forth between commodity money (gold, silver or bimetal standards) and fiat money (Karaman et al., 2018). However, in the course of the 20th century, fiat money came to dominate the financial world, and it is still the case today. Based on this historical overview, it is clear that money has changed several times throughout the centuries, and it did not happen in a random way. Note that some features of money had to be present for it to succeed, and as economies grew, monies with less physical constraints were preferred (such as paper money). The evolution of money was not a straightforward process, and fiat money, which is today’s dominant form of money, did not succeed instantly. From today’s point of view, it seem that economic forces have pushed towards a form of money that is least constrained by physical barriers, such as natural resources. Fiat money perfectly serves this purpose, in fact, electronic fiat money does not even need a physical form. In today’s economies, only a fraction of broad money is present physically in the world (McLeay et al., 2014). Understanding the past and the present features of money is crucial for considering how it could evolve in the future. There is no particular reason, why other forms of money could not succeed in the future. Fiat money was the most flexible among the variations of monies presented in the previous paragraphs. However, the emergence of digital currencies, such as cryptocurrencies, could offer even better features than fiat currencies do today. 8.2. Comparing Bitcoin to historical forms of money At first sight, Bitcoin is very much unlike any previous forms of money that were discussed in the previous parts of this appendix chapter. In most of its features, it is unlike commodity money, representative money or even fiat money. In the following, this statement is analyzed in more detail. Despite the many associations to gold in the Bitcoin system (consider for example the terminology of mining and coins), or even some outright claims that Bitcoin is digital 103 gold (Suberg, 2018), it cannot be so easily justified from a monetary economics point of view. Commodity money is linked to such natural resources, which have uses in society other than a medium of exchange. In some cases, they are very practical items, in other cases less practical, but even gold and silver serves important decorative and representative purposes in most societies. The analogy that both precious metals and Bitcoin are rare in nature, and require mining, is not enough in itself to make it qualify as a commodity money. Bitcoins can be considered as unique digital tokens, which are rare by design, however, they have no use outside the realm of that payment system. For this reason, its comparison to commodity money does not hold well. Establishing that it is not representative money or paper money is far easier, since it is not derived from any currencies, and cannot be exchanged for any fixed amount of commodity or cash. Of course, it can be exchanged for various currencies, however, not at a fixed ratio, but rather at an ever-changing market rate. Bitcoin is actually closest to fiat money in its nature. It does not bear any intrinsic value, which could be derived from the usefulness of a natural resource, and has no guarantee of any fixed conversion to other valuable assets or commodities. However, unlike fiat currencies, no government has endorsed or ever guaranteed its value. Such guarantees are thought to be most valuable, when the underlying economy – in which the currency operates – is strong, and the government has no history of debasing its money or inducing high inflation. Following this line of though, this guarantee is less valuable, when the underlying economy is weak, and there is an expectation that the government will artificially take the purchasing power of the currency away for some reason (in most cases for inflating away its local currency debt). In international financial markets, such as the forex market, these national differences usually translate into deviations in the corresponding exchange rates. The stronger economy with no currency manipulation will have an appreciating exchange rate over the other nation in the long term. Bitcoin cannot be understood in this context, because it does not have an underlying economy (it is intended to be global), and nor does it have any authority that could manipulate its value, since it has no active monetary policy built into its design. Fiat currencies, in most cases, cannot exist without governments and host nations (where they are set to be legal tender), and thus it can be concluded that it is a wrong analogy to consider Bitcoin as a fiat currency. Despite the otherwise many similarities. 104 Looking through other historical periods of monetary systems, an interesting analogy can still be found in this respect. Bitcoin is in some way similar to the private money issuance of commercial banks in the 17th-19th century. This was a period in the history of banking, when traditional banking products were largely extended with the issuance of private bank money, or from another angle: bank debt. At this time, money issuance was not monopolized by the state yet, and central banks were still non-existent in most countries. Thus, several banks could create their own currencies, which could serve as a substitute for gold or silver. This kind of private money had a similar feature to today’s cryptocurrency issuances. They were also free from government influence, and trust in such currencies was linked to the institutions themselves. This analogy is not perfect of course, since most of these currencies were partially backed by precious metals, and transactional trust was a big issue, unlike with cryptographically secured digital currencies. For this reason, the main conclusion of this historical comparison is the following: even though cryptocurrencies share some of the features of previous money types, such as fiat money or private commercial bank money, they represent a new form of money, which requires its own definition. Such future categorization should focus on the private nature of cryptocurrencies and their similarity to fiat money. 105 9. Appendix III: Relationship between Bitcoin’s price and the public’s interest The academic literature on digital currencies, virtual currencies, cryptocurrencies and blockchain technology is growing rapidly as of November 2018, however, the discussion is still very fragmented and lacking depth in several topics. The reason for this is that public interest in this technology was weak prior to 2013, which is clearly visible with both a manual survey of publication dates and the quantitative analysis of Google searches for related topics. This data on evolving interest is shown below. Figure 28: Evolution of general interest* in cryptocurrencies in the past 10 years (Source: Own work based on Google Trends, 2018) *Interest is measured by searches per relevant topics, and an index of 100 represents the highest public interest over this 10-year period. Based on this data, it is clear that public attention was quite low before 2013, except for a small spike in interest during the summer of 2011. Public attention peaked in December 2017 for the entire field. In fact, the various keywords used to track interest in cryptocurrency technologies show strong comovement. It is very clear, that interest in Bitcoin far outweighs any other related topic, the interest for some of which were not even observable during this 10-yer period that was analyzed (as this corresponds with the history of Bitcoin). 106 Another interesting fact is that public interest in the topic of Bitcoin – and all cryptocurrency topics for the matter – was primarily connected to the price of bitcoins. Running a linear regression on the monthly average USD price of bitcoins and the monthly average interest for Bitcoin yields a statistically significant relationship with a coefficient of determination equaling 71%. However, these findings do not reveal the direction of the effect, and thus one cannot be sure about causality in this matter. Figure 29: Relationship between the USD price of bitcoin and the global interest* for Bitcoin (Source: Own work based on Google Trends, 2018). *Interest is measured by searches per relevant topics, and an index of 100 represents the highest public interest over the past 10-year period. This analysis of interest confirms that public and academic attention to cryptocurrencies only rose in recent years, as Bitcoin became more valuable. For this reason, there is still a significant amount of research to be done in the many fields of cryptocurrency technologies. 107 10. Appendix IV: Statistical background This last appendix is intended to help better understand the results of the statistical exercise conducted in Chapter 4. It provides a list of additional tables and graphs on the similarity/dissimilarity analysis done in Section 4.4.1., the distribution fitting in Section 4.4.2. and the regression analysis of Section 4.4.3. Table 13: Standardized coefficients of the model Source Hash rate Cost per transaction Unique addresses Total bitcoins Estimated transaction volume Value -0.164 0.526 0.741 -1.103 -0.346 Standard error 0.029 0.039 0.062 0.049 0.047 t -5.756 13.349 12.009 -22.340 -7.410 (Source: Own work) Figure 30: Standardized residuals / Bitcoin 30D volatility (Source: Own work) 108 Pr > |t| < 0.0001 < 0.0001 < 0.0001 < 0.0001 < 0.0001 Lower bound (95%) Upper bound (95%) -0.220 -0.108 0.449 0.603 0.620 0.863 -1.200 -1.007 -0.437 -0.254 Figure 31: Bitcoin 30D volatility / Standardized residuals (Source: Own work) Figure 32: Predicted Bitcoin 30D volatility / Standardized residuals (Source: Own work) 109 Table 14: Proximity matrix of Bitcoin and 23 other currency pairs Proximity matrix 1st: BTC/USD U.S. / Euro China / U.S. Japan / U.S. U.S. / U.K. Canada / U.S. Mexico / U.S. South Korea / U.S. Brazil / U.S. U.S. / Australia Switzerland / U.S. India / U.S. Thailand / U.S. Malaysia / U.S. South Africa / U.S. Hong Kong / U.S. Taiwan / U.S. Sweden / U.S. Singapore / U.S. Venezuela / U.S. U.S. / New Zealand Norway / U.S. Denmark / U.S. Sri Lanka / U.S. 1st 100% 5% 0% -1% 1% -3% -1% 0% -1% 2% 2% -2% -3% -2% -3% 3% -4% -2% -1% -2% 1% -2% -5% -1% 2nd 5% 100% -21% -30% 57% -43% -34% -36% -29% 51% -62% -25% -40% -20% -44% -14% -36% -80% -62% -1% 50% -72% -100% 0% 3rd 0% -21% 100% 13% -22% 19% 17% 29% 15% -24% 14% 18% 29% 24% 22% 16% 33% 22% 32% 1% -21% 22% 20% 1% 4th -1% -30% 13% 100% -12% 7% -3% 10% 4% -18% 36% -3% 21% -2% 11% 0% 14% 21% 30% 0% -23% 18% 30% 5% 5th 1% 57% -22% -12% 100% -45% -34% -34% -25% 46% -37% -23% -31% -24% -39% -13% -32% -53% -51% -2% 44% -54% -56% 2% 6th -3% -43% 19% 7% -45% 100% 57% 46% 43% -67% 28% 31% 39% 28% 54% 20% 42% 49% 61% 1% -60% 57% 43% -1% 7th -1% -34% 17% -3% -34% 57% 100% 45% 55% -58% 19% 40% 40% 33% 64% 19% 43% 41% 55% 0% -50% 48% 34% 0% 8th 0% -36% 29% 10% -34% 46% 45% 100% 36% -54% 23% 40% 48% 48% 47% 26% 67% 38% 64% 0% -48% 43% 36% 2% 9th -1% -29% 15% 4% -25% 43% 55% 36% 100% -47% 17% 30% 33% 26% 53% 16% 36% 35% 46% 1% -41% 41% 29% 2% 10th 11th 12th 13th 14th 15th 2% 2% -2% -3% -2% -3% 51% -62% -25% -40% -20% -44% -24% 14% 18% 29% 24% 22% -18% 36% -3% 21% -2% 11% 46% -37% -23% -31% -24% -39% -67% 28% 31% 39% 28% 54% -58% 19% 40% 40% 33% 64% -54% 23% 40% 48% 48% 47% -47% 17% 30% 33% 26% 53% 100% -35% -40% -48% -38% -63% -35% 100% 17% 31% 15% 28% -40% 17% 100% 42% 38% 39% -48% 31% 42% 100% 42% 44% -38% 15% 38% 42% 100% 31% -63% 28% 39% 44% 31% 100% -27% 7% 17% 17% 20% 22% -51% 26% 38% 48% 44% 47% -57% 50% 27% 41% 25% 48% -73% 45% 43% 60% 49% 62% -1% 1% 2% 4% 1% 1% 78% -35% -33% -46% -31% -54% -62% 48% 32% 44% 32% 52% -51% 62% 25% 40% 20% 44% -2% 0% 7% 2% 5% 1% (Source: Own work) Table 15: Full list of similar currency pairs FX rate 1 U.S. / Euro U.S. / Euro Canada / U.S. Canada / U.S. Canada / U.S. Canada / U.S. Mexico / U.S. Mexico / U.S. Mexico / U.S. South Korea / U.S. South Korea / U.S. Brazil / U.S. U.S. / Australia Switzerland / U.S. Thailand / U.S. South Africa / U.S. South Africa / U.S. Taiwan / U.S. Sweden / U.S. Sweden / U.S. Sweden / U.S. Singapore / U.S. Singapore / U.S. Norway / U.S. FX rate 2 U.S. / U.K. U.S. / Australia Mexico / U.S. South Africa / U.S. Singapore / U.S. Norway / U.S. Brazil / U.S. South Africa / U.S. Singapore / U.S. Taiwan / U.S. Singapore / U.S. South Africa / U.S. U.S. / New Zealand Denmark / U.S. Singapore / U.S. Singapore / U.S. Norway / U.S. Singapore / U.S. Singapore / U.S. Norway / U.S. Denmark / U.S. Norway / U.S. Denmark / U.S. Denmark / U.S. Similarity (threshold = 0.5) 0.568 0.513 0.570 0.544 0.609 0.570 0.550 0.644 0.549 0.672 0.638 0.527 0.785 0.625 0.601 0.621 0.521 0.623 0.616 0.789 0.798 0.630 0.622 0.721 (Source: Own work) Table 16: Descriptive statistics for the BTC/USD log returns 110 16th 17th 18th 19th 20th 21th 22th 23th 24th 3% -4% -2% -1% -2% 1% -2% -5% -1% -14% -36% -80% -62% -1% 50% -72% -100% 0% 16% 33% 22% 32% 1% -21% 22% 20% 1% 0% 14% 21% 30% 0% -23% 18% 30% 5% -13% -32% -53% -51% -2% 44% -54% -56% 2% 20% 42% 49% 61% 1% -60% 57% 43% -1% 19% 43% 41% 55% 0% -50% 48% 34% 0% 26% 67% 38% 64% 0% -48% 43% 36% 2% 16% 36% 35% 46% 1% -41% 41% 29% 2% -27% -51% -57% -73% -1% 78% -62% -51% -2% 7% 26% 50% 45% 1% -35% 48% 62% 0% 17% 38% 27% 43% 2% -33% 32% 25% 7% 17% 48% 41% 60% 4% -46% 44% 40% 2% 20% 44% 25% 49% 1% -31% 32% 20% 5% 22% 47% 48% 62% 1% -54% 52% 44% 1% 100% 24% 22% 28% -1% -24% 20% 14% 0% 24% 100% 35% 62% 0% -47% 41% 36% 2% 22% 35% 100% 62% 0% -53% 79% 80% 1% 28% 62% 62% 100% 0% -67% 63% 62% 3% -1% 0% 0% 0% 100% 0% 0% 1% 0% -24% -47% -53% -67% 0% 100% -56% -49% -2% 20% 41% 79% 63% 0% -56% 100% 72% 1% 14% 36% 80% 62% 1% -49% 72% 100% 0% 0% 2% 1% 3% 0% -2% 1% 0% 100% Statistic Nbr. of observations Nbr. of missing values Sum of weights Minimum Maximum Freq. of minimum Freq. of maximum Range 1st Quartile Median 3rd Quartile Sum Mean Variance (n) Variance (n-1) Standard deviation (n) Standard deviation (n-1) Variation coefficient Skewness (Pearson) Skewness (Fisher) Skewness (Bowley) Kurtosis (Pearson) Kurtosis (Fisher) Standard error of the mean Lower bound on mean (95%) Upper bound on mean (95%) Standard error of the variance Lower bound on variance (95%) Upper bound on variance (95%) Standard error(Skewness (Fisher)) Standard error(Kurtosis (Fisher)) Mean absolute deviation Median absolute deviation BTC/USD log return 2059 0 2059 -0.498 0.878 1 1 1.376 -0.016 0.003 0.027 12.362 0.006 0.004 0.004 0.066 0.066 11.011 1.515 1.516 0.105 26.700 26.768 0.001 0.003 0.009 0.000 0.004 0.005 0.054 0.108 0.038 0.021 (Source: Own work) 111