Bitcoin — from every angle · a living data story

◈ 01 · The network — live transactions

Enough vision. Watch it happen — real payments dropping into a block, right now, on live mainnet.

One block, forming

Every square below is a real Bitcoin payment that just happened — landing live, this second, packing into the block being built right now.

These are real transactions streaming off the network as you watch. Each square is one payment: bigger = more data, and colour = how much money is moving — cool-blue for tiny amounts, warming through violet and amber to gold wherever real value flows. They pile into the next block until a miner seals it (~every 10 minutes) — then the whole thing flashes gold, settles, and a fresh block starts forming. This is money moving, live.

connecting to the live network…

the next block—

How to read the block

each square is one real transaction that just landed on the network.
size = data (virtual bytes) — more inputs and outputs takes more room.
colour = the money moving — cool blue for tiny amounts, warming to gold for the biggest.
a gold ring = a whale — a transaction moving 10+ BTC.

A block holds only about 1 million virtual bytes — roughly 2,000–4,000 transactions — sealed about every 10 minutes. That's the whole capacity of Bitcoin: a few thousand payments every ten minutes, worldwide. Scarce on purpose — which is exactly why the fee auction exists.

◈ 02 · Markets — the order book

A fixed supply, meeting endless demand. That collision has a price — watch it form, tick by tick.

The order book

A price isn't a fact — it's an argument. This is the live tug-of-war between everyone trying to buy and everyone trying to sell, right now.

Every buyer posts the most they'll pay (a bid); every seller the least they'll take (an ask). The best bid and best ask almost touch — the tiny gap between them is the spread, and whichever side is stacked deeper is winning: that's the imbalance. Watch it move, live from a real exchange.

$—BTC/USDT · live · Bybit

spread
—

best bid
—

best ask
—

—

buyers

— ₿

—

sellers

— ₿

—

the bar leans toward whoever holds more BTC near the price

— spread —

◀ buyers want it cheaper · the amber gap in the middle is the SPREAD · sellers want it dearer ▶
the taller each wall, the more BTC waiting — the gold ₿ numbers show how much

How to read the book

the green wall is demand — cumulative bids stacking up as price falls. Taller = more buyers waiting.
the coral wall is supply — cumulative asks as price rises. Where it's steep, sellers are thick.
the gap in the middle is the spread — the cost of crossing from buyer to seller instantly.
the imbalance bar shows which side holds more size near the price — a live read on pressure.

This is the real machine that sets the price you see everywhere. When a big buyer eats through the coral wall, price jumps; when sellers pile on, it sags. No oracle, no committee — just this auction, running every millisecond.

What a $100M desk watches — the tells

The book shows intentions, and intentions can be faked. Here's how the pros read what's really happening in the numbers above — the signals that separate noise from a real move. (Market education, not financial advice.)

The wall that runs

A giant order sits just ahead of price like a fortress — then vanishes the instant price nears. That was never real supply; it's a spoof, placed to scare you into acting. The tell: a wall that holds under pressure is real support; one that flees is theatre.

The wall that won't break

Price slams a level again and again and it doesn't move — someone huge is quietly absorbing every order thrown at it. Absorption is often the calm before a reversal: when the aggressors exhaust themselves against a hidden giant, price snaps the other way.

The level that keeps refilling

You watch a level get eaten — and it reappears, same size. Eat it again; it's back again. That's an iceberg: a massive order hidden behind a tiny visible tip, feeding in slice by slice. It marks where real institutional money has drawn its line.

Imbalance is a current

When one side stacks far deeper, price tends to drift toward the thin side — the path of least resistance, a vacuum that pulls price in. Watch the imbalance bar above. But beware: a sudden, extreme lean is often the spoof itself.

When the spread yawns

A calm market has a razor-thin spread. The moment it widens, the market makers are stepping back — pulling their quotes because they smell volatility. A widening spread is the market holding its breath; the big moves tend to follow.

The tape can't lie

The book can be faked — executed trades cannot. When aggressive market orders chew straight through the asks, that's real money taking real price. Desks trust the tape (what actually filled) over the book (what's merely posted). The book whispers; the tape shouts.

Go deeper

For the fans who want the whole story — tap any question to open it up.

What an order book actually is ▸

Strip away the charts and a market is just two lists: everyone willing to buy, with the price they'll pay (the bids), and everyone willing to sell, with the price they'll accept (the asks). A "price" is simply the last handshake between the two. Everything else — candlesticks, indicators, headlines — is downstream of this one living auction. When you watch the book above, you're watching price being made, not reported. It never stops, and it belongs to no one.

Why the spread is the market's honesty test ▸

The spread — the gap between the best bid and best ask — is what it costs to change your mind instantly. In a deep, confident market it's a rounding error. The moment fear or uncertainty arrives, market makers widen it to protect themselves, and it balloons. So the spread is a live confidence meter: tight means calm and liquid; wide means the market isn't sure of itself and is bracing for a move. Watch it before you trust a quiet chart.

The hidden game — spoofing, absorption & icebergs ▸

Because posting an order costs nothing until it fills, the book is a stage for bluffing. Spoofers post huge fake walls to nudge you, then yank them before they fill. Absorbers sit quietly soaking up everything at a level, hiding their true size until the other side exhausts itself. Icebergs show only a sliver and refill forever. Telling a real wall from a fake one is most of the skill — and the tape (the trades that actually executed) is the lie detector the bluffers can't beat.

How a single trade moves the whole price ▸

Price doesn't glide; it jumps up the ladder. A market buy takes the cheapest ask, then the next, then the next, climbing until it's filled. If the asks above are thin, a modest order can leap the price; if they're stacked thick, even a whale barely nudges it. That's why depth matters more than size — the exact same buy can be a firecracker or a dud, depending entirely on what's waiting above it. The depth chart above is that ladder, drawn.

◈ 03 · Markets — the prediction model

Everyone wants the one thing the market never hands over: tomorrow. Here's a model that reaches for it — and is honest about how little it can hold.

The honest oracle

No model reliably predicts Bitcoin's price — so this one doesn't pretend to. It builds a small, transparent edge on free public data, and reports it plainly, coin-flip baseline and all.

Under the hood it's a gradient-boosted forest of shallow decision trees reading 22 signals at once — price momentum, volatility, distance from the long moving averages, and the network's own on-chain pulse: hashrate, difficulty, active addresses, miner revenue, fees. Every day it answers one narrow question — over the next seven days, is the wind more likely at Bitcoin's back or in its face? The answer is a single call: LONG, or stand in cash. And every number below is out-of-sample — measured only on days the model had never seen.

Act I

Today's call

This is the live signal, straight from the oracle. It is not advice — it's a transparent experiment you can watch being right or wrong in real time.

reaching the oracle…

— — —

A LONG call means the model puts the odds of a higher price seven days out above 50/50; FLAT means it would rather hold cash than bet. The probability is how sure it is — and it's rarely very sure. That honesty is the point.

Act II

The track record — measured, not promised

Anyone can draw a line that fits the past. The only number that matters is how a model does on days it has never touched. Here is exactly that: years of strictly out-of-sample calls, against the honest baselines of a coin flip and of simply buying and holding.

53.5%

7-day direction, called right
coin-flip = 50.0%

1.50

strategy Sharpe
buy & hold = 1.16

−76%

worst drawdown
buy & hold = −85%

Read it honestly: 53.5% is barely better than a coin flip — and that sliver of edge, compounded and kept out of the worst crashes, is what lifts the risk-adjusted return above buy-and-hold. There is no magic here. A real edge in markets is small, or it isn't real.

Act III

Why you can trust the number — walk-forward

The easiest way to lie with a backtest is to let the model peek at the future. This one can't — three rules, enforced by the code itself:

1 · No lookahead. Every feature on a given day is built from data up to that day only — rolling windows and backward differences, never a value from the future.
2 · Only resolved labels. The model trains only on days whose 7-day outcome had already happened. It is never taught the answer to a question still open.
3 · Strictly unseen. Each prediction is made on a day after the last it trained on, and scored on the return that actually followed. No day is ever both a lesson and a test.

This is walk-forward validation, and it's the difference between a model and a fairy tale. It's why the numbers above are modest — a dishonest backtest is always spectacular, and always fake.

Act IV

It retrains every day — here's exactly when

Bitcoin never sleeps, and neither does the data. Once a day, just after the network's UTC daily close — when blockchain.com finalizes yesterday's on-chain numbers — the oracle wakes, pulls the fresh day, and re-runs the entire walk-forward pipeline, 2009 to now. Today's call is trained on everything up to yesterday, and not one minute more.

daily retrain · 00:30 UTC

in your time zone, that's —

next retrain in —

Why just after midnight UTC? Because that's when the day's on-chain figures — the hashrate, the fees, the active addresses the model leans on — are finalized. Retrain any earlier and you'd feed it a half-written day. The model waits for the ledger to settle, then reads it.

◆ go deeper · the machine behind the call

Why gradient-boosted trees, and not a neural network?

Because ten years of daily rows is a tiny dataset by machine-learning standards — a deep net would memorize it and call the noise a pattern. A forest of shallow trees (depth 3), heavily regularized, is forced to find only the coarse, repeatable structure. It also hands you permutation importances — an honest ranking of which signals actually earned their keep — so the model can explain itself. Interpretable and hard to overfit beats clever and opaque, every time, on data this scarce.

What does "out-of-sample" actually protect you from?

From the oldest lie in quant finance: fitting the past. Give a flexible model the full history and it draws a perfect line through it — then falls apart the moment real, unseen data arrives. Out-of-sample means the score you see was earned only on days the model had never been shown when it made the call. It's the difference between "here's how it would have done" (worthless) and "here's how it did, blind" (the only thing worth trusting).

Why seven days, and why only long-or-cash?

Seven days is long enough for a real on-chain shift to express itself, short enough to stay a directional question rather than a macro guess. And long-or-cash — never short — because the honest edge here is small and asymmetric: the model is better at spotting "probably not a good week to be exposed" than at timing a fall to profit from it. When it isn't confident, it steps aside. Doing nothing is a position, and often the right one.

Not financial advice — a transparent experiment. The point was never to beat the market; it's to show you, end to end, how an honest model is built on free data — and how modest a genuine edge looks when nobody's allowed to cheat. Believe the small number. Distrust the big one.

◈ 04 · On-chain — following the money

Every square was a payment. Pick one and follow it — see where money goes when no bank is watching.

Bitcoin flow

Every coin's whole life is public. Paste a wallet and follow the money — where it came from, where it went, and how long it's been sitting still.

Bitcoin's ledger hides nothing: for any address you can see everything that ever came in, everything that went out, and — because coins are dateable — how long the balance has slept. Paste an address (or tap an example) and watch its story unfold.

↓ Enter any wallet address to see its transactions

try: Satoshi's genesis address · Binance cold wallet · Bitfinex cold wallet

↓ in = money arrived from another wallet; ↑ out = money left to another wallet. The counterparty is who it came from / went to. Amounts are in BTC; time is how long ago it confirmed. Every move here is a permanent, public fact on the blockchain.

The "held for" line is the life of that bitcoin — how long the current coins have sat unmoved. A coin dormant for years is a holder's conviction made visible; a coin moving hourly is an exchange or a trader. Same ledger, two very different stories.

◈ 05 · Cryptography — the Merkle tree

Thousands of those payments crowd into one block. How do you stamp them all with a single fingerprint?

A thousand payments, one fingerprint

A single block can carry thousands of transactions — yet the whole bundle is sealed by just 32 bytes. Change one payment, anywhere in the pile, and that tiny seal changes completely, in a way nobody can fake. This is the quiet structure that lets a phone verify a payment without ever downloading the blockchain.

It's called a Merkle tree, and the idea is beautiful: don't hash the transactions into one lump — hash them in pairs, then hash the pairs, then the pairs of pairs, climbing up until a single hash remains: the Merkle root. That root is stamped into the block and locked by mining. Below: build the tree and tamper with it, then prove a single payment is inside — using almost nothing.

Act I

The seal — and how it screams

Here are eight transactions. Each is hashed into a leaf; every pair of leaves is hashed together, and so on up to the root. Tap any payment to tamper with it — change who got paid — and watch its fingerprint, and every hash on the path above it, flip to red all the way to the root. One altered payment can't hide.

▲ tap any bottom transaction to tamper with it

Eight payments, sealed into one root. Nothing tampered yet.

Only the hashes on the path from the changed leaf to the root recompute — about log₂(n) of them, not the whole tree. But that's enough: the root is different, and the root is what mining sealed and what every node checks. To make a forged payment "fit," you'd have to redo the proof-of-work for the entire block — the same wall from the mining lab.

Act II

The proof — prove one, download almost nothing

Now the real magic. To convince someone that your transaction is in this block, you don't hand them all eight — you hand them a tiny branch: one sibling hash at each level. With those few hashes they re-climb the tree from your leaf and arrive at the exact root the block already published. Tap the payment you want to prove.

▲ tap a transaction to see the gold sibling hashes that prove it

Tap a payment above to build its proof.

This is a Merkle proof (or "Merkle branch"), and it's why light wallets work. Your phone never stores the blockchain; it holds only the small block headers. To confirm a payment cleared, it asks a full node for the branch — a handful of hashes — recomputes the root, and checks it matches the header. Trustless verification, in kilobytes.

Act III

Why it scales like magic

The tree's power is the logarithm. Double the number of transactions and the proof grows by just one hash. Slide the block size up toward a million payments and watch the proof stay absurdly small.

transactions in the block

1,024

transactions

10

hashes to prove any one

32 bytes

to commit to them all

A block of a million transactions needs a proof of only ~20 hashes — under a kilobyte — to prove any single one is inside. That's the whole invention: log₂(1,000,000) ≈ 20. Verification cost barely moves while the block grows without limit. One 32-byte root at the top; a 20-hash ladder to reach any leaf. Enormous commitment, tiny proof.

◆ go deeper · the tree of hashes

Where does the Merkle root actually live?

Inside the block header — the compact 80-byte summary that miners actually hash in the proof-of-work lottery. The header holds the previous block's hash, a timestamp, the difficulty target, the nonce, and the Merkle root of all the block's transactions. Because mining hashes the header, and the header contains the root, the proof-of-work commits to every transaction at once. Change any payment and the root changes, the header changes, and the block's hard-won hash is void. The tree is the bridge between "thousands of transactions" and "one number worth mining over."

So how does a phone verify a payment without the whole chain?

It's called SPV — Simplified Payment Verification. A light wallet downloads only the chain of headers (about 80 bytes each — a few dozen megabytes for all of history), not the hundreds of gigabytes of full blocks. To check that a payment confirmed, it requests a Merkle branch for that transaction from a full node, recomputes the root from the leaf up, and confirms it equals the root already in the header it trusts. It never has to see the other transactions, and it can't be lied to: a fake branch simply won't hash to the published root. Minimal data, full cryptographic certainty of inclusion.

Why hash in pairs instead of one big hash of everything?

Because a single hash of the whole blob would be all-or-nothing: to check that one transaction is inside, you'd need all of them to recompute the hash. The pairwise tree buys you the compact proof. By splitting and re-hashing, the path from any leaf to the root touches only log₂(n) nodes, so you can prove membership with a handful of siblings instead of the entire set. The tree trades a negligible amount of extra hashing for an exponential saving in proof size. That trade is the entire reason the structure exists.

What happens when there's an odd number of transactions?

A binary tree wants pairs, so when a level has an odd count, Bitcoin simply duplicates the last hash and pairs it with itself, making the count even again. It's a small, pragmatic patch — and a famous early bug (a way to craft two different transaction lists that produced the same root) came from a subtle flaw in exactly this duplication rule, later fixed by tightening the validity checks. A reminder that in cryptography the edge cases are where the danger hides, and the odd-node corner is a classic one.

What can a Merkle proof NOT tell you?

It proves inclusion — that a transaction sits in a block with a given root — and nothing more. It does not prove the transaction was valid (that its signatures check out, that the coins weren't already spent, that the amounts add up). Those are checked by full nodes, which validate every rule for every transaction. A light wallet leans on the assumption that the most-worked chain is made of valid blocks, because miners won't waste energy sealing invalid ones. So a Merkle proof answers "is it in there?" with certainty, and defers "is it legitimate?" to the nodes that verify everything. Knowing that boundary is knowing what SPV really trusts.

◈ 06 · Cryptography — keys & digital signatures

The block proves what's inside it. But what proves a payment was yours to make?

One number — and it's yours forever

A bitcoin isn't kept in your wallet. What your wallet holds is a single secret number, and the whole world agrees: whoever knows it, owns the coins. No bank, no password reset, no permission. Just math.

This is self-custody, and it runs on a pair of keys. A private key you never reveal, a public key anyone can see, and a one-way street between them that no computer can walk backwards. With it you can sign a payment so the entire network knows it came from you — and can prove nobody altered a single character. Everything below is real cryptography running in your browser right now. Roll a key, sign a message, then try to forge it.

did you knowThere are 2²⁵⁶ possible private keys — about 10⁷⁷ of them, more than the estimated number of atoms in the observable universe. Guessing someone's key isn't hard; it's physically impossible.

Act I

The keypair

Press roll. Your browser picks a random 256-bit number — that's the private key. From it, one-way math derives a public key, and from that, your address. Easy to go down the ladder; impossible to climb back up. That impossibility is the whole game.

a brand-new identity, every press

🔑 private key never sharerolling…

↓ multiply a point on an elliptic curve · one-way

📢 public key share freely—

↓ hash it down · one-way

🏷 address your public name—

The private key is just a number between 1 and about 2²⁵⁶ — roughly 10⁷⁷, close to the number of atoms in the observable universe. That's why nobody can guess yours, and why you can generate a fresh, unclaimed key offline with no registry, no server, no permission. Own the number, own the coins.

Act II

The signature

Now spend. Write what you want to say and sign it with your private key. Out comes a signature — a scramble that only your key could have produced for this exact message. Anyone can then check it against your public key and confirm it's genuine — without ever seeing your secret.

message

— press sign to produce a signature —

The signature is checked against your public key. If it matches, the network knows the message truly came from the holder of the private key.

Notice: sign the same message twice and the signature looks different each time — yet both verify. A real signature carries a dash of randomness, so it can never be replayed or reverse-engineered into your key. It proves two things at once: you hold the key, and this message wasn't touched.

Act III

The forgery that can't happen

Here's the magic. Take the message you just signed and change one character — turn Bob into Rob, or 0.5 into 5.0. The signature was locked to the original down to the last letter, so the check instantly fails. This is why you can broadcast a payment across an open, hostile internet and nobody can tamper with a cent of it.

message on the wire

— sign a message in Act II first —

The signature and public key never change here — only the message does. Match the original exactly and it's VALID; nudge a single byte and it's FORGED. No middleman decides this. The math does, identically, on every machine on Earth.

◆ go deeper

So a wallet doesn't actually hold coins?

Correct — and this trips up almost everyone. The coins live on the blockchain, as entries that say "these are controlled by address X." Your wallet is really a keychain: it stores the private keys that can sign a valid instruction to move whatever those addresses control. Lose the key and the coins don't vanish — they're visible to all, forever — but they become unspendable, frozen in plain sight. "Not your keys, not your coins" is not a slogan; it's the literal mechanics.

How can the public key be public and still be safe?

Because the link runs one way only. Deriving the public key from the private key is a single multiplication on an elliptic curve — fast. Going backwards (the "discrete-log problem") means undoing that multiplication, and the best-known method would take longer than the age of the universe on all the computers ever built. So you can hand out your public key and address to the whole planet, and your secret stays secret. Easy one way, hopeless the other — the same asymmetry that powers mining powers ownership.

Two keys? A padlock has one. Why the split?

Older ciphers are symmetric: a single secret key both locks and unlocks, so both sides must already share it — which just raises a harder question, how did you deliver that secret safely in the first place? The breakthrough was asymmetric cryptography: a pair of keys where the public one is derived from the private one. Your private key stays with you alone; your public key can be shouted from the rooftops. Anyone can use the public half to verify your signatures or send you funds, but only the private half can spend. Bitcoin is asymmetric to its core — that's the entire reason you can publish an address to the world and still be the only one who can move the coins.

How did two strangers ever agree on a secret in the open?

This is the 1976 idea that made all of it possible — the Diffie–Hellman key exchange. Ada and Charles, who have never met, each pick a private number they never reveal. They swap a couple of public numbers completely in the clear — roughly A = g^a mod p and C = g^c mod p — then each raises the other's number to their own secret. By a small miracle of modular arithmetic they both land on the same shared secret, while an eavesdropper who copied every message sent still cannot compute it. Point that same one-way math at proving identity instead of hiding messages and you get digital signatures — and Diffie–Hellman gets its own lens just below.

Bitcoin uses "secp256k1" — what is this page using?

Straight answer: this lab uses P-256, the elliptic curve that ships built into every browser (crypto.subtle), so the signing and verifying you see are 100% real with zero downloads. Bitcoin uses a sibling curve called secp256k1 — same idea, same one-way math, different constants chosen so the numbers are a touch faster to compute. The lesson is identical on either curve: a secret scalar, a public point, an unforgeable signature. When you graduate to a real wallet, it's the same three boxes on Act I's ladder.

Isn't signing the same as encryption?

No — opposite jobs. Encryption hides a message so only the intended reader can open it. Signing does the reverse: it leaves the message in the clear but wraps it in proof of who wrote it and that nobody edited it. Bitcoin payments aren't secret — every one is public on the ledger — they just have to be unforgeable. That's why the whole system leans on signatures, not encryption.

What is a seed phrase, then?

Twelve or twenty-four words you may have seen written on a card. They're just a human-friendly backup of the master secret your wallet uses to generate all its private keys. Those words are the number from Act I — dressed up so a person can copy them without a typo. Anyone who reads them can rebuild every key and take everything, which is why they're guarded like the crown jewels. One number, many disguises.

◈ 07 · Cryptography — the Diffie–Hellman exchange

Signatures lean on something stranger still — two strangers minting a secret in the open.

Two strangers. One secret. In full view.

Alice and Bob have never met. They shout numbers at each other across a crowded room where an eavesdropper writes down every word — and by the end, the two of them share a secret she cannot possibly know. This isn't a trick. It's the piece of mathematics that quietly secures almost everything you do online.

The whole miracle rests on one lopsided operation: a sum that is trivial to do forwards and hopeless to undo backwards. Build that operation with your own hands below, watch two people mint a shared key over an open wire, then try — and fail — to break it. By the end you won't just believe it works; you'll feel exactly why.

Act I

The one-way operation

Everything hinges on modular exponentiation: pick a base g, raise it to a power x, and keep only the remainder after dividing by a prime p — written g^x mod p. Think of a clock with p hours: counting forward is easy, but landing on hour 14 tells you nothing about how far you walked. Drag the power and watch the result leap around the ring with no pattern at all — even though each leap is a single, cheap multiplication.

base g p = 23 · a 23-hour clock

power x

Forwards is one multiply. Backwards is the wall. Handed only the landing spot g^x mod p, recovering the power x is the discrete logarithm problem — and after fifty years of trying, nobody has found a shortcut faster than searching. With p just twenty-three you could check all of them by hand; make p a few hundred digits and that same search outlives the universe. That gap is the hinge the entire exchange swings on.

Act II

The exchange

Now the magic. g and p are public — everyone, eavesdropper included, knows them. Alice keeps a private power a; Bob keeps a private power b. Each sends the result of their one-way operation. Then each raises the number they received to their own secret — and they land on the same place. Change any dial and watch every number recompute.

public setting base g

Alice

picks a private power a

→ sends A across the open wire

Bob

picks a private power b

→ sends B across the open wire

👁 everything the eavesdropper sees

…and from those four public numbers, no known method recovers the shared secret.

the shared secret they both computed

—

Alice computes B^a mod p = (g^b)^a mod p = g^ba mod p

Bob computes A^b mod p = (g^a)^b mod p = g^ab mod p

and because multiplying powers just adds the exponents, g^ab = g^ba — the same number, reached from two different directions. Neither of them ever had to send it.

Read that again, because it's the entire idea: the secret g^ab is never transmitted. Alice knows a and the number Bob sent; Bob knows b and the number Alice sent. The eavesdropper knows g, p, A and B — but to finish the sum she'd need a or b, and those are locked behind the discrete-log wall from Act I.

Act III

Let the eavesdropper try

She has g, p, A, B in hand. Her only path to the secret is to crack one private power out of a public one — to solve g^x mod p = A for x. Below, actually let her brute-force it. On a toy prime she wins in a blink. Switch to real scale and the same attack falls off a cliff.

She'll walk the powers one by one, hunting for the exponent that reproduces A.

On p = 23 there are only twenty-two powers to try — of course she cracks it. That's the point: small numbers are toys. Every extra digit of p multiplies her workload; at real sizes (hundreds of digits) the number of guesses exceeds the atoms in the universe, and her fastest computer would still be searching long after the sun burns out. Same math, unbreakable — purely by scale.

◆ go deeper · the mathematics

Why do the two sides land on the exact same number?

One law of exponents does all the work: raising a power to a power multiplies the exponents. Alice: B^a = (g^b)^a = g^(b·a) Bob: A^b = (g^a)^b = g^(a·b) and a·b = b·a → g^(a·b) = g^(b·a) Both people compute g raised to the same product a·b, just in the opposite order — and multiplication doesn't care about order. So they inevitably meet at one value. The remainder-mod-p wrapping is applied at every step, but it never breaks the equality, because arithmetic mod p respects multiplication. Two roads, one destination, and the destination was never spoken aloud.

What exactly is a discrete logarithm, and why is it hard?

An ordinary logarithm undoes exponentiation on the number line: from 10^x = 1000 you smoothly reason "x is 3," and if the target were 1001 you'd know x is a hair over 3. The order is preserved, so you can home in. A discrete logarithm asks the same question after everything has been folded through mod p: given g, p, and y = g^x mod p, find x. But the mod wrapping shreds the ordering — consecutive powers scatter all over the ring (you saw it in Act I). There's no "warmer / colder," no slope to follow, no way to bisect. The best general methods still take roughly the square root of p steps, which for a 256-bit prime is about 2¹²⁸ — a number so large that checking a trillion per second, on a billion machines, you'd finish long after every star has died. Easy to make, catastrophic to invert: that asymmetry is the raw material of modern cryptography.

Is this the same math that protects Bitcoin?

It's the same shape of math, upgraded. Everything here uses numbers under mod p, where the one-way operation is exponentiation and the hard problem is the discrete logarithm. Bitcoin (and most of the modern web) swaps the playground of "numbers mod p" for the playground of points on an elliptic curve. There the one-way operation is adding a point to itself a secret number of times, and the hard problem is the elliptic-curve discrete logarithm — the same trapdoor, but so much stronger per digit that a 256-bit curve key rivals a 3000-bit classical one. Your Bitcoin private key is exactly the "secret power"; your public key is the point you reach; and the signature that proves a coin is yours is this identical asymmetry, pointed at proving authorship instead of sharing a secret.

Why must the secret powers be random and never reused?

The wall only stands if the attacker has to search the whole space. If your secret is small, predictable, or drawn from a habit, she doesn't brute-force p possibilities — she checks the few thousand likely ones and walks straight in. Worse, in the signing cousin of this scheme, reusing the one-time random value across two different messages leaks the private key outright through simple algebra — two equations, one unknown, solved. This is why real systems draw secrets from a high-quality source of randomness for every operation. In cryptography, predictability is the vulnerability; a secret is only as strong as it is surprising.

Could a future computer ever break it?

Against today's machines, no — the discrete-log wall holds by sheer scale. But a large-enough quantum computer changes the game: a known quantum algorithm can solve the discrete logarithm (and its elliptic-curve form) efficiently, collapsing the wall this whole scheme leans on. Such a machine doesn't exist at the needed size, and may not for a long while — but the risk is real enough that cryptographers are already standardising post-quantum methods built on entirely different hard problems (lattices, hashes, codes) that quantum computers don't obviously crush. The one-way idea survives; only the particular lock changes.

◈ 08 · Cryptography — SHA-256 & proof-of-work

That same one-way math decides who earns the right to write the next page of history.

The lottery that seals every block

Right now, machines across the planet are playing this exact game about 700,000,000,000,000,000,000 times every second — and it still takes ten minutes to win once. This is, quite literally, what Bitcoin is doing.

Every block is locked by SHA-256 — a fingerprint machine. Feed it anything; it hands back 256 bits that look utterly random yet are perfectly repeatable, can't be run backwards, and can't be guessed ahead. Touch the three parts below and you'll feel why that turns mining into a lottery — and why that lottery is the single thing keeping Bitcoin honest. No prior knowledge needed; just play.

right nowThe whole network is guessing about 700 quintillion hashes every second — 700,000,000,000,000,000,000 tries — and it still takes roughly ten minutes to win once. That is the difficulty, self-tuning to stay hard.

Act I

The fingerprint

Type anything. Watch its 256-bit fingerprint appear — each of the 256 squares is one bit, lit if it's a 1. The same words always give the same tapestry; a machine anywhere on Earth agrees to the last square.

message

256 bits means 2²⁵⁶ possible fingerprints — about 10⁷⁷, which is more than the atoms in the observable universe. Yet the same message always lands on the exact same one, on every machine on Earth, forever. That is what "deterministic" means — and why a fingerprint can stand in for the thing itself.

Act II

The avalanche

Now change the tiniest thing — one letter — and watch. About half the 256 bits flip (≈128), scattered everywhere, no pattern. Each output bit behaves like an independent coin-flip, so any change — a letter, a capital, a space — reshuffles roughly half of them. This is the avalanche effect: there's no "warmer / colder" to follow toward a goal, only chaos — which is exactly why nobody can steer a fingerprint toward a value they want.

message

0 of 256 bits flipped from a change of —

Make one edit above — a letter, a capital, a space — and the amber squares show every bit that changed.

Act III

The lottery

To seal a block a miner must find a fingerprint that starts with a run of zeros — the top-left squares must all go dark. There's no formula; the only move is to change a number (the nonce) and try again… and again. Drag difficulty up by one and the target gets 16× rarer. Hit mine and feel the search.

block

difficulty 2 leading zeros · 1 in 256

0 attempts 0 hashes/sec nonce 0

Here you need only a few zeros. Real Bitcoin currently demands about 19 — odds near 1 in 10²³ per block. Every miner on Earth together tries ~7×10²⁰ times a second, and it still averages ten minutes to win once. Finding the nonce is astronomical; checking it is a single hash. That gap — impossibly hard to make, trivial to verify — is proof-of-work, and it's why rewriting Bitcoin's history would cost more energy than the whole world could muster.

How to read the tapestry

each of the 256 squares is one bit of the fingerprint — read left→right, top→bottom. Hue follows its row, so you can see where in the hash a bit lives.
a dark square is a 0; a lit square is a 1.
amber = a bit that just flipped from your last change (the avalanche).
the gold frame is the target zone — in mining these squares must all be 0 to win.

◈ 09 · Consensus — the blockchain

Win the lottery, seal a block — then chain it to every block before it, and dare anyone to rewrite the past.

The ledger nobody can rewrite

Every bank keeps its ledger locked in a vault and asks you to trust it. Bitcoin does the exact opposite — it hands the same ledger to thousands of strangers, in the open, and makes lying mathematically pointless. This is how.

A blockchain is just a list of blocks, and each block is stamped with the fingerprint of the one before it. That single trick chains them together: alter any past entry and every stamp after it shatters, in plain view of the whole world. And because thousands of machines each hold the same list — and only ever accept the version backed by the most work — to rewrite history you'd have to out-compute the entire planet, live, forever. Touch the blocks below and break it yourself.

Act I

How money is kept today — and how Bitcoin flips it

Your bank balance is a row in a private database that one company owns and edits. It works because you trust them to be honest, online, and fair. Bitcoin removes the trust entirely: one public ledger, copied everywhere, owned by no one, guarded by math.

The vault

banks · card networks · today

One master ledger, held privately by the institution.
They can edit, freeze, or reverse any entry.
You must trust them — and their security, and their solvency.
Open 9–5, borders apply, a single point of failure.
Your access can be revoked by one decision.

The network

bitcoin · thousands of nodes · always-on

Every node holds a full copy of the same ledger.
Entries are append-only — no edit, no reverse, ever.
You trust math and majority, not any one party.
24/7, borderless, no single point to seize or shut.
If you hold the key, no one can freeze you out.

Same job — keep an honest list of who owns what — solved two opposite ways. The bank centralises trust. Bitcoin replaces it with proof. Everything below is that proof, made touchable.

Act II

The unrewritable ledger

Here's a tiny chain of four blocks, each already sealed (its fingerprint begins with three zeros — that's the proof-of-work). Each block carries the previous block's hash, so they're welded in order. Now tamper: change any block's data — turn Bob's 2.0 into 20.0 — and watch every block below it turn red. You just rewrote history, and the whole chain is screaming about it.

All four blocks are sealed and linked. Edit any data field to tamper with the past.

re-mining every block is the only way to repair a tamper

Why the cascade? Each hash is computed from the block's data plus the previous hash. Change block 2 and its hash changes; block 3 was stamped with block 2's old hash, so now it's wrong; that breaks block 4; and so on to the tip. To make the lie stick you must redo the proof-of-work for that block and every block after it — and, on the real network, do it faster than everyone else combined.

Act III

Why every miner must agree

Thousands of machines hold this chain. When two versions exist, the network follows one rule: accept the chain with the most accumulated work — the "heaviest" chain. An honest majority is always extending the real one. So your tampered chain isn't just broken; it's in a race it cannot win unless you personally out-hash the entire planet. Drag the attacker's share of the world's mining power:

attacker's share of all mining power 30%

51% line

This is the famous "51% attack." Below half, the honest chain outruns you and your rewrite never becomes truth — the probability of catching up falls off a cliff the more blocks deep your target is. Above half, you could in theory — but renting that much hardware and power would cost far more than almost any theft is worth, and would torch the value of the very coin you stole. The system pays honesty better than cheating.

And underneath all of it sits one piece of math — the reason a lie is astronomically expensive to write but trivial to catch.

1 hash

Verifying a block

your phone, instantly

~10²³ hashes

Forging a block

the whole planet, ten minutes

SHA-256 has no shortcut: the only way to find a fingerprint with the required zeros is to guess and check, over and over. Finding one takes on the order of 10²³ tries; checking a proposed answer takes exactly one. That gap — impossibly hard to make, instant to verify — is what lets a billion strangers agree on the truth without trusting each other. It is the whole invention.

◆ go deeper · the cryptography

What actually stops me spending the same coin twice?

The "double-spend" problem is the reason digital money was impossible for decades — a file can be copied, so what stops you paying two people with the same coin? Bitcoin's answer is the ledger itself. Every spend refers to a specific earlier receipt (an unspent output), and the network only accepts each one once. Send two conflicting spends and miners will only ever bake one into a block; the other is rejected by every honest node. There's no central referee — the shared, append-only history is the referee.

What is "the math" behind a one-way function?

A hash like SHA-256 is built to behave like a random oracle: feed it any input and it returns 256 bits that are fully determined yet look like a coin-flipped scramble. Two properties make it a lock: easy: hash(x) → y (one pass, microseconds) hard: find x such that hash(x) starts with N zeros There is no algebra to invert it and no "warmer / colder" gradient to climb — the avalanche effect means one flipped input bit reshuffles about half the output bits. So the only known method is brute force. To hit N leading hex zeros you expect about 16^N attempts; to check a claimed answer is a single hash. Difficulty is just the network dialling N up or down to keep blocks ~10 minutes apart.

How do prev-hashes actually weld the blocks together?

Each block's fingerprint is taken over its contents and the fingerprint of the block before it: hash(block N) = SHA256( data_N + hash(block N-1) + nonce_N ) Because hash(N) depends on hash(N-1), and hash(N+1) depends on hash(N), the fingerprints form an unbroken chain back to the very first block (the "genesis" block). Alter anything in block N and its hash changes, which invalidates the stamp inside N+1, which invalidates N+2… all the way to the tip. That's the cascade you triggered in Act II — tamper-evidence for free, from a single line of math.

How is this different from a bank's database?

A bank database is mutable and permissioned: rows can be changed, and a small set of admins are trusted to change them correctly. It's fast and convenient, but it rests entirely on trusting the institution — and one breach, order, or bankruptcy can rewrite or erase your balance. Bitcoin's ledger is append-only and permissionless: no one can alter a settled entry, and anyone can verify the whole thing from scratch. You trade the bank's convenience and reversibility for censorship-resistance and finality. Different tools for different fears.

If it's all public, how is anything private?

The ledger shows addresses, not names — a payment reads "address A sent 0.5 to address B," never "Alice paid Bob." That's pseudonymity: every transaction is visible forever, but the link between an address and a human isn't written on the chain. It can often be inferred (exchanges, reused addresses, analysis), which is why privacy is an active field — but the base layer's transparency is a feature: it's exactly what lets anyone audit that no coins were forged and no ledger rule was broken.

◈ 10 · The network — the mempool

Before a payment is sealed, it waits in a crowd — bidding for a seat in the next block.

The waiting room

Right now, tens of thousands of payments are bidding for one scarce thing — a seat in the next block. This is the auction that decides who gets in.

Bitcoin makes one block about every ten minutes, with room for roughly 4 million "weight units." Everyone waiting is in the mempool, and miners fill the block with the highest fee-per-byte first. So it's a live auction for space. Below is the real mempool right now — and you can drop your own transaction in and watch where it lands.

connecting to the live network…

Drop your transaction in

Set the fee you're willing to pay. Watch which block you land in — and how long you'd wait. This is exactly the choice every wallet makes for you, every time you send.

your fee 20 sat/vByte

—

How to read the queue

each card is one upcoming block (~4M units, ~10 min apart). The left-most is the next block.
colour = the fee tier paid inside it — grey cheap, teal normal, amber priority, red urgent.
the big number is that block's median fee (sat/vByte); below it, the fee range, tx count, and the miner's fee reward.
the gold "you" tag shows the block your transaction would fall into at the fee you set.

Block space is genuinely scarce: about 2,000–4,000 transactions fit per block, one every ~10 minutes. When the mempool is busy, that scarcity is why fees spike — you're not paying Bitcoin, you're out-bidding everyone else for the next seat. When it's quiet, even 1 sat/vByte gets in.

◈ 11 · The protocol — difficulty retargeting

Those seats open every ten minutes — held to time by a clock with no clockmaker.

The ten-minute heartbeat

No one is in charge, yet a new block lands roughly every ten minutes — this year, last year, a decade ago. Miners pour in and rush out, hardware gets a thousand times faster, whole countries ban and unban it — and still, ten minutes. How does a network with no conductor keep such steady time?

The trick is a thermostat with no owner. The more computing power races to find blocks, the faster they'd arrive — so every two weeks the network measures how fast it actually went and retunes the difficulty to drag the pace back to ten minutes. Nobody decides it; the rule runs itself on every machine. Play the thermostat, work the retarget math, then watch the real pulse ticking down to its next adjustment.

Act I

The thermostat with no owner

Block time depends on two things: how much hashpower is searching, and how hard the puzzle is set. Add miners and blocks come faster; raise the difficulty and they slow down. Crank the hashpower and watch the pace shoot past the ten-minute mark — then hit retarget and watch difficulty rise to chase it right back to centre.

network hashpower 1.0×

This is negative feedback — the same idea as a thermostat or cruise control. Push the system one way and it automatically pushes back. The genius is that no one runs it: each node computes the same adjustment from the same blocks, so the whole planet agrees on the new difficulty without a meeting, a vote, or a boss.

Act II

The retarget, every 2016 blocks

Every 2016 blocks — about two weeks — the network does one sum. Those blocks should have taken exactly 20,160 minutes (2016 × 10). It compares that ideal to how long they really took and scales difficulty by the ratio. Slide the real average block time and watch the next difficulty jump compute itself.

actual average block time, last 2016 blocks 9.0 min

The ratio is clamped: difficulty can rise at most 4× or fall to ¼ in a single retarget, so no fluke fortnight can whipsaw the network. Notice the self-correction — run fast and difficulty goes up (harder, so you slow down); run slow and it comes down (easier, so you speed up). Always dragging the average back toward ten minutes.

Act III

The live pulse

Right now, the network is somewhere inside its current two-week window, running a little fast or a little slow, with the next retarget already taking shape. This is the real heartbeat, straight from the chain — the countdown to the moment difficulty next changes.

reading the chain…

—

avg block time now

—

next difficulty change

—

blocks until retarget

—

through this epoch

—

The network is either running slightly fast (difficulty about to rise) or slightly slow (about to fall). Either way, in a couple of weeks it snaps back toward the ten-minute beat it has kept for its entire life — a clock that winds itself.

◆ go deeper · keeping time without a clock

Why ten minutes — why not one, or sixty?

It's a deliberate compromise. When a block is found it has to travel to every node on Earth before the next one starts, or two miners build competing blocks and the network briefly splits (an "orphan"). Too short an interval and blocks are found faster than they can spread — wasted work and constant forks. Too long and payments take forever to confirm. Ten minutes sits comfortably above global propagation time while still settling transactions within the hour. It's slow on purpose — the slowness is what keeps everyone agreeing on one history.

What actually is "hashrate"?

It's the number of guesses the whole network makes per second in the mining lottery — each guess a full SHA-256 hash, checked to see if it clears the target. Today that figure is measured in exahashes: on the order of 10²⁰ guesses every second, more than the number of grains of sand on Earth, each second. Hashrate is the raw muscle behind the chain — and the thing the difficulty is forever measuring itself against. More muscle would mean faster blocks, so difficulty rises to absorb it and hold the beat.

Why retarget every 2016 blocks, not every block?

Stability. If difficulty lurched after every block, a few lucky or unlucky finds in a row would send it swinging wildly, and miners could game the noise. Averaging over 2016 blocks (~two weeks) smooths out the randomness so the adjustment reflects a real change in hashpower, not a statistical blip. It's the same reason you judge a climate by seasons, not by this afternoon's weather. The price is responsiveness — a sudden drop in miners isn't fixed until the window ends — which is exactly what the next question is about.

What if half the miners suddenly quit?

Blocks slow down — with half the hashpower, they'd arrive every ~20 minutes instead of ten — and they stay slow until the current 2016-block window finishes, which now takes longer to reach. When it does, the retarget sees the sluggish pace and cuts difficulty, and the beat returns to ten minutes. People sometimes fear a "death spiral" where slow blocks trap the chain forever, but the math doesn't allow it: slower blocks simply guarantee an easier next retarget. The system is self-healing; it just heals on a two-week clock.

How does the network measure time with no trusted clock?

Each block carries a timestamp set by the miner, and the retarget uses the gap between the first and last block of the window. No miner is trusted individually — the rules only accept a timestamp that is greater than the median of the last eleven blocks and not more than two hours ahead of the network's rough time. Those bounds stop anyone from faking the elapsed time to swing difficulty in their favour. So "time" here isn't a wall clock; it's a loosely-agreed number the whole network polices together — good enough to keep a ten-minute beat across a planet with no shared clock.

One word, two meanings — so it never blurs. Bitcoin has two epochs. The difficulty epoch is 2,016 blocks (~2 weeks) — the heartbeat you just felt, retuning the puzzle. The halving epoch, or "era," is 210,000 blocks (~4 years) — the one that meters out new coins, and the one we turn to next.

◈ 12 · Monetary policy — the 21M cap

That same rhythm mints new coins — on a schedule that counts down to zero.

Twenty-one million. Never one more.

No president can print it, no bank can conjure it, no emergency can mint an extra coin into being. The supply was fixed at the very first block — and it has been counting down, exactly on schedule, ever since. Here is precisely where it stands, live, right now.

Every currency before this one shared a flaw: whoever ran it could always make more, and always eventually did. Bitcoin's answer is almost absurdly simple — write the entire issuance schedule into the code, forever. New coins arrive only as a mining reward, that reward halves every four years, and the halves add up to a hard ceiling of 21 million. Watch the schedule, feel the halving, and see how little is left to mine.

the far futureThe very last satoshi will be mined around the year 2140. After that the block reward is zero forever, and miners are paid entirely by transaction fees.

Act I

The schedule, carved in code

New bitcoin enters the world one block at a time, and the amount per block is not a policy anyone votes on — it's a formula. It starts at 50 BTC per block and is cut in half every 210,000 blocks (about four years). Drag through the decades and watch the curve rush up, then flatten hard against the ceiling — because most of the coins that will ever exist already do.

reading the chain…

scrub the halvings

2025

≈ era

3.125

BTC per block

19.69M

total mined

93.8%

of 21M

Look at the shape: it's nearly all uphill in the first two decades, then a long, flat crawl toward the ceiling it never quite touches. More than nine in ten bitcoin were mined in the first sixteen years. The scarcity isn't a promise about the future — it's mostly already happened.

Act II

Why the halves add up to exactly 21 million

Here's the quiet piece of mathematics that makes the cap inevitable. Each four-year era mints half as many new coins as the one before: the first era creates 10.5 million, the next 5.25, then 2.625… Reveal them one by one and watch the running total climb — always halving the gap that remains, forever approaching a number it can never pass.

era 1 = 10.5M21,000,000 ceiling →

eras elapsed 20.34M

This is a geometric series: 10.5M + 5.25M + 2.625M + … Halve a number again and again and the pieces sum to twice the first piece — and twice 10.5 million is 21 million. The ceiling isn't enforced by a rule that says "stop at 21M." It falls out of the halving itself, the way ½ + ¼ + ⅛ + … can only ever reach 1.

Act III

How little is left

Set against every dollar, peso, and pound — all of which can be, and are, printed at will — bitcoin's issuance is a closing door. Below is the live tally: how much has been mined, how little remains, and how slowly the last of it will trickle out over the next century.

—

bitcoin mined so far

—

left to ever mine

—

new BTC / day now

—

next halving

At the start, mining printed 7,200 new bitcoin a day. Today it's a fraction of that, and every four years it halves again. The final satoshi will be mined around the year 2140, after which no new bitcoin will ever be created — miners will be paid in fees alone. A dollar's supply is a decision; bitcoin's is a countdown. That is what "hard money" means.

◆ go deeper · the hardest money

Why 21 million — why that number?

It isn't a magic constant chosen for its own sake; it's the output of two simpler choices: start the reward at 50 BTC and halve it every 210,000 blocks. Do the arithmetic and the total is forced: 210,000 blocks × (50 + 25 + 12.5 + 6.25 + …) BTC = 210,000 × 100 = 21,000,000 The infinite halving series in the brackets sums to exactly 100, so the ceiling is 21 million. Pick different starting numbers and you'd get a different cap — but once those two dials were set in 2009, the final figure was already decided, down to the last satoshi.

What happens when the last bitcoin is mined?

Around 2140, the block reward — halved 33 times — finally rounds to zero, and issuance stops for good. Mining doesn't stop, though: miners keep sealing blocks and defending the chain, now paid entirely by the transaction fees users attach to their payments. The system was designed to hand the baton from new-coin subsidy to fees gradually over more than a century, so that by the time the printing ends, a fee market has long since grown up to keep miners in business.

Why does a halving happen every ~4 years?

Two numbers multiply into it. Blocks are mined about every 10 minutes (the difficulty adjusts to hold that pace), and the reward halves every 210,000 blocks. So: 210,000 × 10 minutes ≈ 4 years. It's not a calendar date — it's a block count, which is why the exact day drifts a little as mining speed wobbles, but always lands near the four-year mark. Each one roughly halves the rate of new supply overnight, which is why halvings are watched so closely.

Could the 21 million cap ever be raised?

Only if nearly everyone agreed to abandon it — and they won't, because the cap is the entire point. The limit isn't guarded by one authority you could lobby; it's checked independently by every full node on Earth. Each node validates that every block creates no more than the schedule allows, and rejects any block that tries to mint extra. To lift the cap you'd have to convince the whole network to run new software that inflates the money they're holding — a turkey voting for Christmas. The rule is enforced not by trust, but by millions of copies all refusing to bend.

What makes it "the hardest money"?

Economists measure hardness by stock-to-flow: how big the existing pile is versus how much new supply arrives each year. Gold is prized because its flow is tiny — you can't easily dig up much more. Bitcoin starts merely comparable, but every halving doubles its stock-to-flow, and unlike gold there is a known, absolute ceiling no discovery can breach. A currency that can be printed has a flow set by whoever holds the press; bitcoin's flow shrinks on a fixed schedule toward zero. That combination — predictable, diminishing, and finally capped — is what "hard" means, taken to its logical end.

◈ 13 · Signal — the live feed

And the world answers back — minute by minute.

Bitcoin, right now

The headlines shaping sentiment — pulled live from the outlets the market actually reads.

loading the latest…

The coloured chip is the source; each source keeps its own colour so you can spot who's saying what at a glance. Time is how long ago it broke. Tap any headline to read the full story at the source.

Aggregated live from the established Bitcoin outlets — CoinDesk, Cointelegraph and Bitcoin Magazine — over their public feeds. In production this can run through our own cached endpoint so a single source being down never breaks the feed.