Chicago Booth Review Podcast Why Bitcoin Will Fail

Eric Budish: Anybody can enter or exit at any time. So in particular, I can enter with a lot of computers. If I want to enter the Bitcoin system with 800 million trillion computations per second, there's nothing in the protocol that stops me from doing so. The question I ask is, what are a bad actor's incentives to engage in that kind of attack of the system?

Hal Weitzman: Evangelists of Bitcoin say the cryptocurrency's strength is its distributed ledger that no one institution controls. But as it turns out, that makes it open to sabotage a vulnerability that will prevent it from replacing real currencies. Welcome to the Chicago Booth Review Podcast, where we bring you groundbreaking academic research in a clear and straightforward way. I'm Hal Weitzman, and today I'm talking with Chicago Booth's Eric Budish, who has spent his career thinking about market design and proposing fixes to flaws work that has earned him the niche title of the LeBron James of batch auctions. According to Budish, the cost of securing Bitcoin at a really large scale is too high, and that will always limit its growth. Eric Budish, welcome back to the Chicago Booth Review Podcast.

Eric Budish: It's great to be with you. Thanks.

Hal Weitzman: Last time you came on, you mentioned, cryptically, I should say, about crypto and how your research is popular among the crypto crowd. So, we wanted to have you back to talk about crypto and blockchain. But I know you are something of a legend in the crypto world, aren't you?

Eric Budish: It's funny. I think I have two separate reputations in the crypto world. At some point I was told I'm crypto famous. And there are two lines in my research that have registered in that world, one of which is very skeptical of the intrinsic economics of blockchains and cryptocurrencies. Skeptical of from an economic perspective of the core computer science innovation that underpins cryptocurrencies, the core, technical innovation in Satoshi Nakamoto's 2008 whitepaper and subsequent research and other forms of what's called permissionless consensus. And then, quite separately-

Hal Weitzman: That's blockchain, that's the plumbing of the system.

Eric Budish: Yeah. So, skeptical of the economic plumbing of the system. And in particular of this novel, quite ingenious, decentralized way of creating trust without any reliance on a government, without any reliance on rule of law, without any reliance on traditional reputations or other sources of trust in the economy. That's one line of research that I hope we can talk about on this podcast. And then, the other source of crypto world notoriety is my work on high frequency trading and frequent batch auctions. Because crypto trading-

Hal Weitzman: Which we talked about last time.

Eric Budish: Yeah. Crypto trading markets have a version of high-frequency trading on steroids that is facilitated by the fact that in crypto markets, you can literally reorder the sequence of trades by reordering transactions on a block on the blockchain, and that creates a form of rent extraction or high-frequency trading on steroids, as I like to call it. I got approached at a conference once and I gave a talk on my frequent batch auctions work. And a crypto trader researcher came up to me and said, "I feel like I'm meeting the LeBron James of batch auctions." And part of me was like, there's no such thing as the LeBron James of batch auctions.

Hal Weitzman: Right. That's kind of a very specific form of fame that you've achieved.

Eric Budish: So, I'm famous in a very narrow, esoteric universe.

Hal Weitzman: Everyone's famous for 15 minutes. They don't tell you how you're famous for 15 minutes.

Eric Budish: I've got my 15 minutes in crypto markets.

Hal Weitzman: There you go. Better than nothing. Not to be [inaudible 00:04:02].

Eric Budish: Exactly. I'll take it.

Hal Weitzman: Obviously, we're distinguishing there, as we said, between the guts, the plumbing, blockchain and crypto. Just tell us a little bit more. What's interesting to you, as an academic, about blockchain?

Eric Budish: What's fascinating to me as an academic? At some level... And I'll describe it now with the benefit of years of hindsight of the learning I've done over the last several years. Blockchain is both a data structure and a trust model. And I think it's very important to distinguish those two aspects. And very early in my explorations of this topic, it was common to say on, for example, CNBC, or my father said this to me, "I don't believe in Bitcoin, but I believe in the blockchain." And there's some version of that sentence I was making fun of my dad. He's like, "It's like saying I don't believe in Bitcoin, but I believe in the Excel spreadsheet." Which is true. Excel spreadsheets are great, databases are great, but what's really academically interesting and exciting, but also, I'll argue, limiting about blockchains, as discovered by Satoshi Nakamoto and improved upon in various ways by subsequent researchers, is the novel way of generating trust.

And so, let me explain all that. What Satoshi Nakamoto invented in this 2008 whitepaper is a way of generating consensus on the state of a data set that doesn't rely on any particular party being trustworthy. That doesn't sound as revolutionary, I think, as it really was. It really was quite an ingenious technical innovation prior to Nakamoto's work to get consensus on the state of a data set, so just basic data integrity on the elements of a database, required either there to be a trusted keeper of the data set. Let's say there was a financial institution, like a Venmo or a Bank of America, keeping track of balances of currency, the trusted party keeps track of who has how much money. And maybe in the background, the reason they're trustworthy is not just their vaunted reputation, but that there's rule of law in the background. If Bank of America were to steal your money or abscond with your funds, there would be a lot of legal consequences.

What Nakamoto invented was a way of keeping track of a data set, keeping track of balances of a currency, for example, that doesn't require a bank, that doesn't require rule of law in the background, that emerges from a large anonymous, decentralized mass of actors collectively maintaining this data set. Once you get your head around, okay, suppose we could have perfect data integrity without any specific foundation of trust, without a financial institution, without a government, without law enforcement in the background, without relationships like you and I trust each other because we know each other a long time and we work at the same institution. It does start to be a little bit mind-bending. You can imagine currency uses of such a database. Cryptocurrencies are the most direct and original application.

But you can also imagine other kinds of applications, in particular taking advantage of what's called a smart contract. So, the ability to program not just currency transactions into this decentralized data structure, but you could run a high school election in the decentralized data structure. You could keep track of support for where to build the next park in a neighborhood, so public goods support. So, all sorts of applications of this trusted database without any particular trusted party that one can start to fantasize about. So I take as given, okay, there was a genuine technical scientific innovation in Nakamoto. He invented this concept of permissionless consensus, consensus on a data set without a trusted party. And what I wanted to do in my research is study the core economics of that. Trust doesn't come for free. Where does the trust come from in the Satoshi Nakamoto version of decentralized trust? And what I found is that the Nakamoto trust model, it's, I think, genuinely ingenious, but it scales terribly is kind of the punch line. It's economically limited in deep ways.

And I think the simplest way to explain that idea is maybe with a metaphor or an analogy, and I can come back to the weeds in a moment. But imagine you're thinking of robbing a bank and you're asking, "Well, why might it not be a good idea to rob the local bank?" One reason why it might not be a good idea to rob the local bank is the local bank might have some security guards who are armed. And so, to overcome those security guards, you'd have to come at the bank yourself with several armed assailants, and there might be a battle, you might lose your life or some of your armed assailant co-conspirators might lose their life. But another reason why it might not be wise to rob the local bank is that if you try to, the police are going to come after you and you're going to spend the rest of your life in jail or get punished by the legal system.

So actually, a lot of the protection of a local bank comes not from the security guards at the bank, but comes from all of the deterrents in the background, so the police and courts that are in the background keeping all of us safe without us even noticing. The Bitcoin trust model is, well, to rob the bank, you need to have more assailants than there are security guards. There aren't these sources of deterrents in the background like police and courts. The security guards for Bitcoin take the form of computational work. You may have heard the phrase proof of work, the details are esoteric. But think of it as large amounts of computational power collectively maintaining the Bitcoin data set. Last I checked it was performing 700 million trillion computations per second. But if you came at the Bitcoin data set with 800 million trillion computations per second-

Hal Weitzman: You'd have more assailants than guards.

Eric Budish: You'd have more assailants than guards and you could steal a lot of money. And the issue is that that scales badly. To keep the system 10 times more secure, you need 10 times more computations per second, to keep the system a thousand times more secure, you need a thousand times more computations per second. It scales very linearly. And so, this insight then led me to think through, well, suppose Bitcoin and cryptocurrencies became a more significant part of the modern economy, what would it actually cost to secure the trust in this decentralized way based on hundreds of millions of trillions of computations per second?

And the numbers get comical fast. It would cost all of the entire global economy, so all of international GDP, gross domestic product, which is about 100 trillion dollars, to keep Nakamoto trust safe up to a theft of about 40 billion. Which 40 billion is nothing to sneeze at, but if we're imagining Bitcoin becoming a more and more significant part of global finance, the trust model just doesn't scale. That's what I found in my research.

Hal Weitzman: Carry the Two is the show that pulls back the curtain to reveal the mathematical and statistical gears that turn the world. Co-hosts Katie Witkowski and Ian Martin bring unique perspectives from the fields of mathematics and statistics to convey how mathematical research drives the world around us. With each episode tackling a different topic, subscribe to Carry the Two, part of the award-winning University of Chicago podcast network.

So Eric, you talked about the fact that blockchain might have a challenge when it scales, it revolutionises the idea of trust, but perhaps that only works on a small scale. What do we mean by small scale? Is Bitcoin small now?

Eric Budish: It's a great question. One version of a small scale use of trust would be like picture a local babysitting co-op. People in a neighborhood who trust each other and want to trade who's babysitting whose kids. And you could imagine keeping track of how much babysitting have I contributed to this system or taken from this system using effectively a Google Doc. And the trust would come from, well, we're all in the neighborhood, we all trust each other. If somebody abuses the system will get called out by the other parents. Trust at that scale would work just fine. If you imagine trying to scale that up to the size of the national economy, you'd be like, well, we don't all know each other anymore. So, trust from knowing each other works at a small scale. At a larger scale, it helps to have some law enforcement or other sources of trust in the background.

For Bitcoin, the way I think about it is at small scale uses of Bitcoin, it's already quite secure. By small scale uses, I mean ordinary black market activity, like buying drugs on the internet. Or it's been very effective for cyber criminals doing extortion or scamming individuals out of their life savings. At that scale I think it's very secure, although its security actually often poses problems for law enforcement because you have this anonymous way to engage in the criminal transfer of funds. Slightly larger scale uses of cryptocurrency for sending money overseas, I think it scales to that pretty easily. International remittances are a commonly discussed use case of sending money to my family overseas or medium scale criminal activities. So, a criminal enterprise sending money around anonymous. I mean, Hamas was funded by cryptocurrency, and Binance got in big trouble with US regulators over facilitating that.

What I'm skeptical of is, is cryptocurrency being useful at, what I'll call, global financial scale? The scale of the global financial system. The US financial system has trading volume on the order of trillions of dollars per day, quadrillions of dollars per year. It's very rare that in a paper you get to use the phrase quadrillions of dollars. So, I really enjoyed that one. Crypto doesn't work, the trust model just fundamentally breaks at that scale because it's too expensive to secure. This is the millions of guards outside of the bank.

Hal Weitzman: Let's go back to that analogy. Who are the people who are getting all these bad assailants with their weapons to go down to the local bank? Who are they?

Eric Budish: Great question. The guards themselves are getting paid to be guards. So, the 700 million trillion computations per second for Bitcoin or the billions of dollars of stake that's locked up for a proof of stake blockchain, like Ethereum. The reason they're providing the security guards in my analogy outside of the bank, is they're getting paid to do so. And they get paid to do so typically with new cryptocurrency. So, with what's called block rewards. And the economics of that are pretty standard and worked out in my paper and in a lot of other prior papers.

The assailant is a bad actor who sees this Nakamoto permissionless consensus is vulnerable to attack. What I can do is if I control 51% of the computational power for Bitcoin, or 51% or 67%, depends on the exact details, of the stake that's powering Ethereum or powering another proof of stake blockchain, I can manipulate the previously trusted data to my will. So I can, for example, send a lot of money and then unsend that money. So, I can create the of having sent billions, or tens or hundreds of billions of dollars around to various counterparties, get other assets in return, and then delete those transactions from the record. So, it'd be like if I sent $10 billion to JP Morgan, got $10 billion back of treasury bonds, and then deleted the initial transaction in which I sent them the $10 billion in the first place.

Hal Weitzman: Or in the babysitter's club, it would just be breaking into the spreadsheet and putting some erroneous information.

Eric Budish: Yeah, exactly. So, if you can control this database, you can steal a lot of money. And you can steal more and more as the system becomes more and more important.

Hal Weitzman: But I think the part that's confusing is, isn't the whole point is decentralized? Now you're talking about someone owning 2/3 of the system or whatever. So, who's that?

Eric Budish: It's decentralized, which the precise meaning is it's permissionless, anybody can enter or exit at any time. So in particular, I can enter with a lot of computers. So, if I want to enter the Bitcoin system with 800 million trillion computations per second, there's nothing in the protocol that stops me from doing so. The question I ask is, what are a bad actor's incentives to engage in that kind of attack of the system? And what I did that hadn't been done before was to think about that vulnerability of Nakamoto's novel form of trust as an economist, as creating an economic incentive compatibility constraint. Nakamoto's paper, in the abstract, talked about the vulnerability to a majority attacker, but what he didn't do, or she or they, or whoever didn't do is think about the equilibrium implications of that.

And what I mean is the if/then reasoning that's very natural to economists of, well, if the system gets a lot more important, then it'll become a lot more tempting to attack, therefore it's going to have to get a lot more expensive to secure. And let's think through the equilibrium implications of all that. It becomes something like a tax on keeping the system secure. So, my research was the first to do the fundamental economics of the fundamental computer science and say, wait a minute, if the trust is coming from the security guards and you can break the trust by coming at the bank with more assailants than there are security guards, let's really think through, what does it cost to keep the bank safe?

Hal Weitzman: And it wouldn't be illegal. You said it would be possible to turn up with all this computing power, but it also wouldn't be illegal to do that.

Eric Budish: That's a hard question. I think lawmakers have put themselves in a box, in a conundrum. A majority attack of Bitcoin, from the perspective of the protocol, is a illegal thing to do from the Bitcoin codes perspective, to come at the system with 800 million trillion computations per second and manipulate the data. If you have the view of code as law, I'm optimizing within the rules of the game, it's expected by the protocol that whatever is the longest chain of blocks, that's the truth. It's possible that there will be a dispute. You can win that dispute by having a majority.

All of these permissionless consensus protocols have a version of majority voting in them. It's not really described that way, but economically that's what it is. If you control a majority, you can adjudicate what the truth is from the perspective of the protocol. If you take a larger view and say, well, what about from the perspective of law enforcement? Well, if law enforcement in that JP Morgan example said, "Wait a minute, you can't just steal $10 billion from JP Morgan, we're going to put you in jail." That makes the system a lot more secure. But now the security is anchored in law enforcement, it's not anchored in Nakamoto's innovation.

Hal Weitzman: It's the opposite of the libertarian nirvana that you were describing.

Eric Budish: Yes. I think there's a real irony and a real conundrum for policy and that a lot of the safety of cryptocurrency at present, as we speak in 2024-ish, is, I think, implicitly supported by rule of law. The typical crypto trade is through Coinbase or Binance, which is a centralized financial intermediary supported by rule of law. Sometimes it doesn't work so well. A lot of trades were going through FTX and FTX turned out not to be very trustworthy. But the idea of this anonymous, decentralized, permissionless trust fantasy, that was Nakamoto, 15 years on, that's still not working at scale. And my research is skeptical that it ever will work at scale.

Hal Weitzman: But your example was it could never take over the global economy.

Eric Budish: Yes.

Hal Weitzman: But that's kind of an extreme-

Eric Budish: That's a high bar.

Hal Weitzman: Yeah, right. Or even the US economy, which is another really high bar. But we know there are countries in Latin America, they've tried to... A country, El Salvador, has tried to become a crypto economy. I mean, could it take over... We would think of the kind of places that people use a lot of crypto would be places that would receive money, let's say, from Europe or the United States. Would that be possible?

Eric Budish: My hope is that all of the interest in cryptocurrencies, anonymous decentralized trust, the blockchain data structure, will lead to better data structures and traditional finance with less economic rent to them. So that in your Latin America example, ordinary citizens of El Salvador wouldn't be using Bitcoin specifically to transfer money around, but that they'd have access to a low cost, electronic way of moving value. Now, that depends on either their government being competent and non-corrupt, or our government providing that service implicitly over the internet. But it doesn't have to be a cryptocurrency per se, good FinTech supported by traditional sources either in the home country or supported by the United States. I'd also be hopeful that all of the interest in... I joked about my dad saying I don't believe in Bitcoin, but I believe in the blockchain, it's like saying I believe in the Excel spreadsheet.

But traditional finance could benefit from having a lot better data architecture than they have to date. And a lot of the... IT is not a particularly sexy topic. Blockchain has been a pretty sexy topic. And that could spur a lot of interest in updating and improving a lot of the plumbing technology in the traditional financial system. So, I'm very optimistic about that. I'm very confused about how to think about whether blockchain or better data integrity will suck inefficiency out of the traditional financial system. One of my colleagues, Jacob Leshno, talks about how the global payments industry is $2 trillion a year. A lot of that is profit. That's not all the cost of moving money, right?

Hal Weitzman: It's credit card fees.

Eric Budish: Yeah. Credit card fees are high, so will blockchain put pressure on those fees? That would be great. I don't think it will do so through this alternative permissionless consensus fantasy. But how exactly this plays out, I'm very interested in and open-minded about and a little bit optimistic. But I'm not optimistic about crypto per se.

Hal Weitzman: Well, it's good to hit that you're optimistic. What does that mean, though, for people with die-hard crypto aficionados or enthusiasts? Do you think it's always going to be a niche thing?

Eric Budish: The thing that I have a hard time getting my head around is what I'll call the digital gold argument, that Bitcoin is valuable almost as a collectible in the same way that economists have a hard time telling you with confidence what the value of a Mickey Mantle rookie card ought to be, or a LeBron James rookie card ought to be.

Hal Weitzman: Or an Eric Budish rookie card.

Eric Budish: An Eric Budish autograph. Those are still very cheap. I can tell you the value of that. But we have a hard time valuing collectibles. And the argument that Bitcoin is effectively a financial collectible, that I have a hard time falsifying or believing. I find that just a confusing argument to make sense of. What I'm deeply skeptical about is cryptocurrency becoming a more important part of the global financial system. I think I'm repeating myself a little bit, but that's the thing I'm skeptical about. Having a confident prediction about Bitcoin's value, I've joked that that's the kind of thing that gets you fired from even your tenured position at the University of Chicago. But I will leave you with one directional prediction.

I mentioned the compensation to the security guards for Bitcoin comes in the form of block rewards. So really, of new Bitcoins that are the compensation paid to the 700 million trillion computations per second. That started at the outset of Bitcoin, 50 Bitcoins per new block. That quantity of compensation halves every four years or so. It's now about three and a quarter Bitcoins per new block, might be three and an eighth. I might have the math slightly wrong. Every four years it continues to halve. So by 2032, the compensation will be less than one Bitcoin per block. By 2044, it'll be less than 0.1 Bitcoins per block. By 2140, it will be zero Bitcoins per block.

So at some point, the compensation to the security guards outside of the bank is going to get really low. I guess the price of Bitcoin could just keep going up, and that's what, I think, believers hope for. But absent an increasingly dramatic increase in the price of Bitcoin, the compensation to the security guards is going to keep going down and that's going to make the system more and more and more vulnerable. So, I'm on record as predicting that Bitcoin will be zero by 2140, and I think I'm relatively okay with that prediction still.

Hal Weitzman: Okay.

Eric Budish: But you're going to have a hard time keeping me to that one.

Hal Weitzman: I was going to say, Eric, if we're still around then, we can have you back on the podcast to discuss, if there's still a podcast. Eric Budish, the LeBron James of batch auctions, thank you very much for coming again on the Chicago Booth Review Podcast.

Eric Budish: We all try to be the LeBron James of something. I think my kids still think I'm the LeBron James of something. So, we'll hold on to what we got.

Hal Weitzman: That's it for this episode of the Chicago Booth Review Podcast, part of the University of Chicago Podcast Network. For more research, analysis, and insights, visit our website at chicagobooth.edu/review. When you're there, sign up for our weekly newsletter so you never miss the latest in business-focused academic research. This episode was produced by Josh Stunkel. If you enjoyed it, please subscribe, and please do leave us a five-star review. Until next time, I'm Hal Weitzman. Thanks for listening.