Bitcoin, from first principles.
Bitcoin, from every angle
Cryptography, the coin, the math, the market — thirteen angles on one object, like walking around a sculpture. Jump in anywhere.
Somewhere, someone presses send. A heartbeat later that payment is racing machine to machine, hunting for a seat in the next block — the next page of the shared record.
One block, forming
Read it like an airport departures board: every square is a real Bitcoin payment that just happened, landing this second. Nothing is staged.
These are real transactions streaming off the network as you watch. Each square is one payment: size = data, and a single payment is a few hundred bytes. Colour = the money moving: cool blue for small amounts, warming through violet and amber to gold. They pile into the next block: the next page of the shared record, like seats on a train that leaves about every 10 minutes. A miner, a machine that competed for the right to write that page (lens 08 shows how), seals it. The whole thing flashes gold, settles, and a fresh page starts forming.
- each square is one real transaction that just landed on the network.
- size = data (virtual bytes): more inputs and outputs takes more room.
- colour = the money moving: cool blue for tiny amounts, warming to gold for the biggest.
- a gold ring = a whale: a transaction moving 10+ BTC.
The order book
An airport kiosk buys currency at one price and sells at another. The gap is its protection. Below, the same two numbers, with thousands of rivals competing that gap almost to zero.
An exchange is a marketplace app where people trade dollars for bitcoin. Every buyer posts the most they'll pay (a bid). Every seller posts the least they'll take (an ask). The gap between the best of each is the spread: the kiosk's cushion, competed thin. Whichever side has more coins waiting is the imbalance. And this is one exchange's book, live. Not the price, just a price.
—
—
—
the taller each wall, the more BTC waiting: the gold ₿ numbers show how much
- the green wall is demand: a running total of bids, adding up as price steps down. Taller = more buyers waiting.
- the coral wall is supply: the running total of asks as price steps up. Where it climbs steeply, sellers are thick.
- the gap in the middle is the spread: what it costs to cross from buyer to seller instantly.
- the imbalance bar shows which side has more coins waiting near the price. That waiting stock is the book's depth.
The book shows intentions, and intentions can be faked. Here's how professional desks read what's really happening in the numbers above: the signals that separate noise from a real move. (Market education, not financial advice.)
For the fans who want the whole story: tap any question to open it up.
What an order book actually is ▸
Why the spread is the market's honesty test ▸
The hidden game — spoofing, absorption & icebergs ▸
How a single trade moves the whole price ▸
Why the ticker says USDT, not USD ▸
The honest oracle
Your weather app's "70% chance of rain" is an honest machine forecast: re-run every morning, graded against the sky. This oracle is exactly that for one narrow Bitcoin question, built on free public data, coin-flip baseline and all.
A decision tree is a 20-questions flowchart: price rising? Swings widening? Each answer branches until a call drops out. Boosting stacks shallow trees, each new one trained on the last one's mistakes. That stack is a gradient-boosted forest reading 22 signals: momentum, volatility, distance from the long-run average price, and the network's vitals. Two of those, hashrate (the network's guessing speed) and difficulty (how hard that guessing is made), are unpacked at lenses 08 and 11. Its one daily question: over the next seven days, is the wind at Bitcoin's back or in its face? The call is LONG, or stand in cash. Every number below is out-of-sample, scored only on days it had never seen.
Today's call
This is the live signal, straight from the oracle. It is not advice. It's a forecast you can grade in real time, the way you grade the weather app against the sky.
The track record — measured, not promised
Anyone can draw a line that fits the past. The only score that matters comes from days the model has never touched, and two terms need unpacking. Sharpe is return per unit of rollercoaster: higher means a smoother ride for the same gain (a simplified reading, but the right instinct). Drawdown is the worst peak-to-valley fall you would have sat through.
coin-flip = 50.0%
buy & hold = 1.16
buy & hold = −85%
Why you can trust the number — walk-forward
A backtest is a rehearsal on past data, and the easiest way it lies is by letting the model peek at the future. This one can't. Three rules, enforced by the code itself:
- 1 · No lookahead. Every feature on a given day is built from data up to that day only — rolling windows and backward differences, never a value from the future.
- 2 · Only resolved labels. The model trains only on days whose 7-day outcome had already happened. It is never taught the answer to a question still open.
- 3 · Strictly unseen. Each prediction is made on a day after the last it trained on, and scored on the return that actually followed. No day is ever both a lesson and a test.
It retrains every day — here's exactly when
Bitcoin never sleeps, and neither does the data. Once a day, just after the network's UTC daily close, the oracle wakes, pulls the fresh day, and re-runs the entire walk-forward pipeline, 2009 to now. The close is when blockchain.com finalizes yesterday's on-chain numbers: the figures read straight from the shared record. Today's call is trained on everything up to yesterday, and not one minute more.
Why gradient-boosted trees, and not a neural network?
What does "out-of-sample" actually protect you from?
Why seven days, and why only long-or-cash?
Bitcoin flow
Every coin is a serial-numbered banknote with every hand-off logged. Paste a wallet address (a wallet holds keys, not coins) and follow the money: in, out, and how long it has sat still.
Your bank statement is private: you and the bank. Bitcoin inverts that — every balance and every move is public, forever, names swapped for addresses. An address is a generated name, not an account: no signup, no bank (lens 06 shows what generates it). The box below holds history's first address: Satoshi's, the pseudonymous creator's, from the genesis block, Bitcoin's very first, of January 3, 2009.
A thousand payments, one fingerprint
The last digit of a debit-card number is computed from the others. Change one digit and the check fails. Scale that check to 32 bytes and it works on any data at all. That's a hash: a fixed-size fingerprint of the data itself. Bitcoin's hashing recipe is named SHA-256. Change one letter, the whole fingerprint changes, and nothing runs backwards. That one tool will seal thousands of payments, and let a phone verify one without downloading the blockchain.
The structure is a Merkle tree, and it runs like a tournament bracket. Hash the payments in pairs, then hash the pairs, then the pairs of pairs, until one champion remains — the Merkle root. That root is stamped into the block's 80-byte cover sheet, where lens 08 will make it ruinously expensive to change. Below: build the tree and tamper with it, then prove a single payment is inside, using almost nothing.
The seal — and how tampering shows
Here are eight payments. Each one is hashed into a leaf. Every pair of leaves is hashed together, and so on up to the root, the bracket's champion. Tap any payment to tamper with it: change who got paid. Then watch its fingerprint, and every hash on the path above it, flip red all the way to the root. One altered payment can't hide.
The proof — prove one, download almost nothing
Now the payoff. To convince someone that your payment is in this block, you don't hand them all eight. You hand them a small branch: one sibling hash from each level. It's the tournament move: proving you played by showing only your own results, round by round. With those few hashes they re-climb the tree from your leaf and arrive at the exact root the block already published. Tap the payment you want to prove.
Why the proof stays tiny
The tree's power is the logarithm. Double the number of payments and the proof grows by just one hash. Slide the block up toward a million payments and watch the proof crawl to twenty.
log₂(1,000,000) ≈ 20. Verification cost barely moves while the block grows without limit. One 32-byte root at the top, a 20-hash ladder to reach any leaf. Enormous commitment, tiny proof.Where does the Merkle root actually live?
So how does a phone verify a payment without the whole chain?
Why hash in pairs instead of one big hash of everything?
What happens when there's an odd number of transactions?
What can a Merkle proof NOT tell you?
One number — and it's yours forever
Tap your debit card. The chip inside just proved it holds a secret, without revealing one bit of it. Bitcoin's ownership runs on the same trick, except now you hold the chip: one secret number, and whoever knows it owns the coins. No password reset. Just math.
We've followed coins between addresses anyone can look up. So one question is overdue: if the world can see your address, what stops it spending from it? A pair of keys. A private key you never reveal, a public key anyone can check, and a one-way street between them that no computer can walk backwards. Seeing costs nothing. Spending takes a signature only the private key can produce. Keeping that key yourself, like cash with no company in the middle, is self-custody. Everything below is real cryptography running in your browser right now. Roll a key, sign a message, then try to forge it.
The keypair
Press roll. Your browser picks a random 256-bit number: 256 coin flips, a number up to 78 digits long. That's your private key. One step of elliptic-curve arithmetic turns it into your public key: an arithmetic where forward is a single move and backward has no known shortcut. Hashing that gives your address. Down the ladder is easy. Nobody has ever climbed back up.
The signature
Now spend. Type a message and sign it with your private key. Out comes a signature: a scramble only your key could have produced for this exact message. Compare that to a password: a password must be shown to the checker, so the checker must be trusted. A signature is verified against your public key, and the secret never leaves your side.
The forgery that can't happen
Here's the flip no wax seal ever managed. A signet ring pressed in wax leaves a recognizable mark, but the mark says nothing about the letter beneath it, and wax can be forged. This seal is computed from the message itself. Change one character, Bob into Rob or 0.5 into 5.0, and the check instantly fails. That's why a payment can cross an open, hostile internet and nobody can tamper with a cent of it.
So a wallet doesn't actually hold coins?
How can the public key be public and still be safe?
Two keys? A padlock has one. Why the split?
How did two strangers ever agree on a secret in the open?
A = ga mod p and C = gc mod p. Then each raises the other's number to their own secret. By a tidy property of modular arithmetic they both land on the same shared secret, while an eavesdropper who copied every message sent still cannot compute it. Point that same one-way math at proving identity instead of hiding messages and you get digital signatures. And Diffie–Hellman gets its own lens just below.Bitcoin uses "secp256k1" — what is this page using?
crypto.subtle), so the signing and verifying you see are 100% real with zero downloads. Bitcoin uses a sibling curve called secp256k1: same idea, same one-way math, different constants chosen so the numbers are a touch faster to compute. The lesson is identical on either curve: a secret scalar (your private number), a public point, an unforgeable signature. When you graduate to a real wallet, it's the same three boxes on Act I's ladder.Isn't signing the same as encryption?
What is a seed phrase, then?
Wait — my debit card already does this?
Two strangers. One secret. In full view.
Alice and Bob have never met. They shout numbers at each other across a crowded room, and an eavesdropper writes down every word. By the end, the two of them hold a shared secret she cannot compute. Nothing was whispered. Nothing travelled hidden. In three acts, we build the trick with our own hands — then attack it ourselves.
One honest note before we start: Bitcoin does not run this exchange. It stands on the same one-way wall, and this is where that wall was first built — Diffie and Hellman, 1976, working in the open. The wall is a single lopsided operation: trivial to do forwards and hopeless to undo backwards. Build it by hand below. Then watch two people mint a shared key over an open wire, and try, and fail, to break it.
The one-way operation
Everything hinges on modular exponentiation: pick a base g, raise it to a power x, and keep only the remainder after dividing by a prime p — written gx mod p. Picture a clock with p hours. Counting forward is easy. But landing on hour 14 tells you nothing about how far you walked. Why a prime? The short answer — simplified, and flagged as such: a prime clock with a well-chosen base spreads the leaps across the whole ring, while a poor setup collapses the walk into a short repeating loop an attacker could map. Drag the power and watch the result leap around the ring with no pattern at all — even though each leap is a single cheap multiplication.
gx mod p, recovering the power x is the discrete logarithm problem. After fifty years of open attack, nobody has found a shortcut meaningfully faster than searching. With p at twenty-three, you could check every power by hand. Make p a few hundred digits long and that same search outlives the sun. That gap — cheap one way, ruinous the other — is the hinge the entire exchange swings on.The exchange
Now the exchange itself. g and p are public — everyone, eavesdropper included, knows them. Alice picks a private power a. Bob picks a private power b. Each announces only the result of their one-way walk. In clock terms: each says which hour they landed on, never how far they walked. Then each takes the hour they received and walks it forward by their own secret. They land on the same place. Change any dial and watch every number recompute.
Alice
Bob
Let the eavesdropper try
She holds g, p, A, B. Her only path to the secret is to crack one private power out of a public number — to solve gx mod p = A for x. Below, actually let her brute-force it. On a toy prime she wins in a blink. Switch to real scale and the same attack falls off a cliff.
Why do the two sides land on the exact same number?
g raised to the same product a·b, just in the opposite order — and multiplication does not care about order. So they must meet at one value. The remainder wrapping never breaks the equality, because arithmetic mod p respects multiplication. Two roads, one destination, and the destination was never spoken aloud.What exactly is a discrete logarithm, and why is it hard?
10^x = 1000 you smoothly reason "x is 3," and if the target were 1001 you'd know x is a hair over 3. The order is preserved, so you can home in. A discrete logarithm asks the same question after everything has been folded through mod p:
given g, p, and y = g^x mod p, find x.
But the mod wrapping shreds the ordering — consecutive powers scatter all over the ring (you saw it in Act I). There's no "warmer / colder," no slope to follow, no way to bisect. The best general methods still take roughly the square root of p steps. For a 256-bit prime that is about 2¹²⁸ guesses — and checking a trillion per second on a billion machines at once, you would need roughly ten billion years. For scale, the universe is about 13.8 billion years old. Easy to make, catastrophic to invert: that asymmetry is the raw material of modern cryptography.Is this the same math that protects Bitcoin?
mod p, where the one-way operation is exponentiation and the hard problem is the discrete logarithm. Bitcoin (and most of the modern web) swaps that playground for points on an elliptic curve — Bitcoin's curve is named secp256k1. There the one-way operation is adding a point to itself a secret number of times, and the hard problem is the elliptic-curve discrete logarithm — the same trapdoor shape, easy to fall through and effectively impossible to climb back, but so much stronger per digit that a 256-bit curve key rivals a 3,072-bit classical one. Your Bitcoin private key is exactly the "secret power". Your public key is the point you reach. And the signature that proves a coin is yours is this identical asymmetry, pointed at proving authorship instead of sharing a secret.Why must the secret powers be random and never reused?
p possibilities — she checks the few thousand likely ones and walks straight in. Worse, in the signing cousin of this scheme, reusing the one-time random value across two different messages leaks the private key outright through simple algebra — two equations, one unknown, solved. That is not hypothetical: in 2013, a flawed random-number generator on Android phones repeated those one-time values, and thieves ran that very algebra to recover private keys and drain real Bitcoin wallets. So real systems draw fresh secrets from a high-quality source of randomness for every operation. In cryptography, predictability is the vulnerability; a secret is only as strong as it is surprising.Could a future computer ever break it?
Have I ever used this exchange myself — and who found it first?
The lottery that seals every block
With no boss, someone still has to write the next page of the record. Bitcoin's answer is a raffle whose tickets cost electricity: more guesses, more chances. The winner writes the page and collects the block reward: a payout of newly created bitcoin. Machines now guess several hundred quintillion times a second, and a win still takes about ten minutes.
The raffle runs on SHA-256, the fingerprint machine from lens 05, where one 32-byte fingerprint stood for every payment in a block. Now we need its stranger habits. The same input always lands on the same fingerprint. Yet nobody can run it backwards, and nobody can steer it toward an output they want. The three parts below let you feel both facts — and feel why guess-and-check is the only way anyone has found to win.
The fingerprint
Type anything. Watch its 256-bit fingerprint appear: each of the 256 squares is one bit, lit if it's a 1. The same words always give the same tapestry, and a machine anywhere on Earth agrees to the last square.
The avalanche
Now change the tiniest thing — one letter — and watch. About half the 256 bits flip (≈128), scattered everywhere, no pattern. Each output bit behaves like an independent coin-flip, so any change at all reshuffles roughly half of them. This is the avalanche effect. It means there is no "warmer, colder" to follow toward a goal. Nobody can steer a fingerprint toward a value they want. The only move left is to try, look, and try again.
The lottery
A miner hashes the block header. That's 80 bytes holding the Merkle root, the previous block's fingerprint, and a spare number called the nonce. To win, the header's fingerprint must start with a run of zeros, the top-left squares all dark. That is 256 coin flips where the first few must all come up 0: no memory, no steering, only another nonce. Drag difficulty up by one and the target gets 16× rarer. Hit mine and feel the search.
- each of the 256 squares is one bit of the fingerprint: read left→right, top→bottom. Hue follows its row, so you can see where in the hash a bit lives.
- a dark square is a 0; a lit square is a 1.
- amber = a bit that just flipped from your last change (the avalanche).
- the gold frame is the target zone: in mining these squares must all be 0 to win.
The ledger nobody can rewrite
Your bank balance is a row in one company's database, and correcting it is a customer-service call. A bitcoin balance is agreed on by roughly 20,000 independent computers, and changing it against the rules is not a phone call. It's an energy bill.
A blockchain is a list of blocks, and each block is stamped with the fingerprint of the block before it — the same 32-byte fingerprint from lens 05. That one trick welds the list in order: alter any past entry and every stamp after it breaks, in plain view of the whole world. And each of those 20,000 computers keeps its own copy of the list, accepting only the version backed by the most work. So to rewrite history you would have to out-compute the entire planet, live, for as long as the lie must hold. Touch the blocks below and break it yourself.
How money is kept today — and how Bitcoin flips it
Your bank's ledger is one master copy in a vault, edited by one company. Bitcoin's ledger is roughly 20,000 matching photocopies, one per node: an ordinary computer running the free Bitcoin program. Each node holds the full ledger and checks every rule on every payment it hears. No node is in charge. Truth is whatever the honest copies agree on.
The vault
- One master ledger, held privately by the institution.
- They can edit, freeze, or reverse any entry.
- You must trust them — and their security, and their solvency.
- Open 9–5, borders apply, a single point of failure.
- Your access can be revoked by one decision.
The network
- Every node holds a full copy of the same ledger.
- Entries are append-only — written in pen, new lines only, no erasing.
- You trust math and a majority of work — not a vote, not any one party.
- 24/7, borderless, no single point to seize or shut.
- If you hold the key, no one can freeze you out.
The unrewritable ledger
Here's a tiny chain of four blocks, each already sealed: its fingerprint starts with three zeros, exactly the proof-of-work from lens 08. Each block also carries the previous block's hash, so they're welded in order. Now tamper. Change any block's data — turn Bob's 2.0 into 20.0 — and watch every block after it turn red. You just rewrote history, and the whole chain shows it.
Why every miner must agree
Thousands of nodes hold this chain. When two versions exist, the rule is mechanical: follow the chain with the most accumulated work, the "heaviest" chain. Notice what "majority" means here. It's a majority of guessing work, not a vote of people, and the honest side is always extending the real chain. So your tampered chain isn't just broken — it's in a race it cannot win unless you personally out-hash the rest of the planet. Drag the attacker's share of the world's mining power:
And underneath all of it sits one piece of math — the reason a lie is astronomically expensive to write but trivial to catch.
What actually stops me spending the same coin twice?
What is "the math" behind a one-way function?
How do prev-hashes actually weld the blocks together?
hash(N) depends on hash(N-1), and hash(N+1) depends on hash(N), the fingerprints form an unbroken chain back to the very first block (the "genesis" block). Alter anything in block N and its hash changes, which invalidates the stamp inside N+1, which invalidates N+2… all the way to the tip. That's the cascade you triggered in Act II — tamper-evidence for free, from a single line of math.How is this different from a bank's database?
If it's all public, how is anything private?
The waiting room
Stamps price the envelope's weight, never the cheque inside. Bitcoin fees work the same way: they price bytes, not value. And the queue below sorts itself by price per byte, live.
Bitcoin makes one block about every ten minutes, with room for roughly 4 million "weight units". That's lens 01's "1 million virtual bytes," just counted in finer units. Everyone waiting sits in the mempool, and miners fill each block highest fee-per-byte first. So it's a live auction for seats: surge pricing, except the algorithm is published. Below is the real mempool right now, and you can drop your own transaction in and watch where it lands.
Drop your transaction in
Your fee is quoted in sat/vByte: satoshis per virtual byte of payment size. A satoshi is Bitcoin's smallest unit: 100,000,000 of them make one bitcoin. Set yours, and watch which block you board and how long you'd wait. This is the choice every wallet makes for you, every time you send.
- each card is one upcoming block — one ~10-minute train, ~4M weight units of seats (4 units ≈ 1 virtual byte). The left-most is the next block.
- colour = the fee tier paid inside it — grey cheap, teal normal, amber priority, red urgent. Fare classes on the same train.
- the big number is that block's median fee (sat/vByte) — the middle payment's fee; below it, the fee range, transaction count, and the miner's fee reward.
- the gold "you" tag shows the block your transaction would fall into at the fee you set.
The ten-minute heartbeat
No one is in charge, yet a new block lands roughly every ten minutes: this year, last year, a decade ago. Miners flood in and vanish, hardware gets faster every season, and the puzzle is now more than 100 trillion times harder than in January 2009. Still ten minutes. How does a network with no conductor keep time?
The answer is a thermostat with no owner. More computing power would make blocks arrive faster. So every 2,016 blocks the network measures how fast it actually went and retunes the difficulty, dragging the pace back to ten minutes. Nobody decides it. Every machine computes the same setting from the same shared blocks, so the planet agrees without a meeting. The beat matters: it keeps settlement predictable, and the coin-minting schedule in the next lens counts on it. Play the thermostat, work the retarget sum, then watch the real pulse.
The thermostat with no owner
Block time depends on two things. The first is how much hashpower is searching: guesses per second, summed across every mining machine on Earth. The second is how hard the puzzle is set. Add miners and blocks come faster. Raise the difficulty and they slow down. Crank the hashpower and watch the pace shoot past the ten-minute mark. Then hit retarget and watch difficulty rise to chase it back to centre.
The retarget, every 2016 blocks
Every 2,016 blocks (about two weeks, a window called the difficulty epoch) the network does one sum. Those blocks should have taken exactly 20,160 minutes (2,016 × 10). It compares that ideal to how long they really took and scales difficulty by the ratio. Slide the real average block time and watch the next difficulty jump compute itself.
The live pulse
Right now, the network is somewhere inside its current difficulty epoch, running a little fast or a little slow. The next retarget is already taking shape. This is the real heartbeat, straight from the chain: the countdown to the moment difficulty next changes.
Why ten minutes — why not one, or sixty?
What actually is "hashrate"?
10²⁰ guesses every second. That's more than the number of grains of sand on Earth, each second. Hashrate is the raw muscle behind the chain, and the thing the difficulty is forever measuring itself against. More muscle would mean faster blocks, so difficulty rises to absorb it and hold the beat.Why retarget every 2016 blocks, not every block?
What if half the miners suddenly quit?
How does the network measure time with no trusted clock?
Twenty-one million. Never one more.
Walk toward a wall by covering half the remaining distance each step. You never arrive. Bitcoin's supply works the same way: each era mints half what the last one did, closing on a ceiling it can never cross: 21 million. A dollar's supply is set by a committee's decision and can grow at will. Here is where the countdown stands, live, right now.
Every currency before this one shared a flaw: whoever ran it could always make more, and eventually did. Bitcoin's answer is to write the entire issuance schedule into the code, forever. Issuance means the minting of new coins. Its monetary policy, the rules for how much money exists, is a formula, not a committee. New coins arrive only as the mining reward, that reward halves every four years, and the halves add up to a hard ceiling of 21 million. Watch the schedule, feel the halving, and see how little is left to mine.
The schedule, carved in code
New bitcoin enters the world one block at a time, and the amount per block is not a policy anyone votes on. It's a formula. It starts at 50 BTC per block and is cut in half every 210,000 blocks. Each such stretch is a halving era, the four-year cousin of the difficulty epoch you just left. Drag through the decades and watch the curve rush up, then flatten hard against the ceiling. That's because most of the coins that will ever exist already do.
Why the halves add up to exactly 21 million
Here is the wall from the top of the page, in numbers. The first era mints 10.5 million coins. The second mints half that, 5.25 million, and the third 2.625 million. Every era covers half the distance that remains. And a walk that only ever halves the gap can never arrive. Reveal the eras one by one and watch the running total climb toward a number it can never pass.
½ + ¼ + ⅛ + … can only ever reach 1.How little is left
Set against every dollar, peso, and pound, bitcoin's issuance is a closing door. All of them can be, and are, expanded by decision. Below is the live tally: how much has been mined, how little remains, and how slowly the last of it will trickle out over the next century.
Why 21 million — why that number?
What happens when the last bitcoin is mined?
Why does a halving happen every ~4 years?
210,000 × 10 minutes ≈ 4 years. It's not a calendar date: it's a block count, which is why the exact day drifts. So far it has always drifted early: blocks average about 9.6 minutes over Bitcoin's life, so every halving has landed weeks or months ahead of its four-year anniversary. Each one roughly halves the rate of new supply overnight, which is why halvings are watched so closely.Could the 21 million cap ever be raised?
What makes it "the hardest money"?
Bitcoin, right now
Twelve lenses of rules that hold still. Now, everything that moves: live headlines shaping sentiment (the market's mood).