As long as everyone agrees with the ongoing network rules, there is no fork. But Bitcoin still has very limited scalability, cannot do complex contracts, and doesn’t issue a fungible currency that’s truly censorship resistant. There isn’t even a system in place to veto the developers’ technical consensus: so if the code wizards make changes that you don’t like, the best you can do is operate and maintain old software that might just get deprecated or become incompatible in the future.

So when network participants have greater expectations from Satoshi’s design, for reasons which concern network upgrades or policy changes… well, that’s when the pain begins. The rebels have three choices: 

1. play the political game in order to try to convince everyone in Bitcoin to update the code; 
2. coordinate a breakaway movement which divides the network, but continues to mine blocks on a new parallel blockchain; 
3. start a new coin from the genesis block, with new rules and unique features.

If a large majority of participants agree with the change, they can leverage their power to blackmail the minority into upgrading. It’s very political, except that voting, violence and first class citizenship rights are replaced by Proof of Work mining and economic incentives.

Completing the first quest requires ”consensus”: a situation of unanimity in which no significant participant expresses any objection. The issue is, however, that significance is very difficult to define or measure. The largest holders don’t have authority because Bitcoin is not a Proof of Stake system. The miners try to avoid getting involved in politics unless they’re safe from ostracization… because they are afraid of losing individual hashers, and reputation is important for their revenue.

The nodes themselves don’t control the network because otherwise Bitcoin would get Sybil attacked. And the developers are usually unwilling to take responsibility for any controversial proposal because it affects their ability to receive grants and any resulting bug can diminish the market valuation of the project (therefore devaluing their personal savings too).

To put it plainly, Bitcoin is stuck in a game theory that makes it safe to do nothing. If anything, arguing in favor of protocol ossification and expressing concerns about any improvement proposal on very predictable grounds (increasing complexity, unknown exploits that nobody thought about yet) is respected enough to get rewarded by conference organizers and orthodox podcasters. Yes, Bitcoin is supposed to be hard to change and that’s part of the value proposition. But when the network participants can’t even agree on the necessity to deploy upgrades and there’s a fairly large faction that argues in favor of stagnation, that’s where the forking becomes legitimate.

But this game gets even more complicated once you realize that in Bitcoin, unlike traditional political systems, nobody wants to have an evident majority. Controlling a large share of the mining hash rate, routing a significant chunk of the economic activity, and even hiring too many developers can be perceived as a sign of centralization.

This centralization relies on trusted third parties and single points of failure… and the consequence is that the project at large gets perceived as being less valuable because it’s not sufficiently decentralized. If anyone takes too much action, it’s possible that the price of bitcoin will actually go down. So the question is: what is the right amount of action? Where do we strike a balance?

Bitcoin is the only political system in the world where nobody wants to form a majority, nobody wants to appear that they’re in charge, and nobody wants to be held accountable. It’s a weird and counterintuitive system whose resilience to change can also get exploited by its enemies: if this unprecedented form of internet money never becomes a threat to the mainstream financial system and actually gets coopted by those who would normally be obsoleted by such an innovative network, then nothing ever changes and all the libertarian dreams fade.

Printing money is cheap. Allocating a small amount of this money to keep Bitcoin under control is a trivial expense in the grand scheme. And for better and for worse, ”number go up” is the ultimate form of consensus… as everyone agrees that it’s good for the project and nobody will dare to fight against it. 

But as we’ve seen over the last decade, price increases do not guarantee that any meaningful development will happen. Bull markets do bring in more smart people, more developers willing to put their time and effort into making the project successful, and more academics who do research that pushes the limits of Satoshi’s design. Some of the best ideas receive funding and get deployed on test networks. Some of the brightest Bitcoin developers travel the world to explain their ideas on conference stages. The problem is that eternal ”bikeshedding” and a predictable repetition of the same critical concerns result in no meaningful progress. 

So once the improvement proposal never gets merged into the code due to lack of consensus, what should the developers do? Should they set years of their work on fire, never to attempt to test it on a financial network with real incentives? Should they accept defeat and move on to other things? Or perhaps they can prove the merits of their idea, while also collecting precious market information about the actual value of this upgrade. This is when forking becomes imperative.

Sure, most altcoins are doomed to fail. Historically, the Bitcoin hard forks haven’t been able to capture the same market valuation or network effect either. But in this world of free markets and free open source software, why not give it a try? Worst case scenario, the critics were right and the entire initiative was a mistake. But if it works out, Bitcoin can finally have a worthy competitor.

In an ideal scenario, everyone is on board with every meaningful upgrade. But in a decentralized network, it’s very difficult to reach consensus. As a matter of fact, the term ”consensus” is often cited in order to stall progress, or else effectively kill off an improvement initiative. There’s ”technical consensus” which stalled OP_CTV according to Dr. Adam Back. There’s social consensus which never allowed BIP101 and its sibling block increase proposals to get activated. There’s ”rough consensus” which is being used against OP_CAT and other attempts to restore Satoshi’s old disabled OP codes.

Faced with this reality, where the developers who maintain the Bitcoin project will only accept a utopian unanimity that any malevolent actor can break, we end up having forks: versions of Bitcoin that follow pretty much the same rules, try to reach the same goal, share most of the original codebase, but seek to accomplish the mission in a different way or through different technical or political means. Which is really beautiful for computer science nerds who are accustomed to the Linux model where every minor disagreement leads to the creation of a new distribution.

But for economists, it’s a confusing situation where competing currencies that are 90% identical are going through a multi-year price discovery phase in order to gain network effects and figure out the value of new ideas. Maybe one day one such fork will dethrone the original Bitcoin due to ingenuity of design and large-scale adoption on markets. Or maybe we will be stuck in this pet rock phase forever, making bets against inflating fiat currencies without ever replacing them.

While Satoshi Nakamoto was around, the world knew nothing but Bitcoin. But as soon as he left the project in the hands of the Core development team, political struggles emerged. And for every rejected proposal, we had a bunch of developers launching a new cryptocurrency network to experiment with the unpopular features. Many of these projects died over the years… yet today we still have a handful of them that survived and were able to find their own market and use cases.

From a rather practical and cynical perspective, one can argue that Bitcoin scales and adds new features through forks. So everything that builds on the same original codebase is a Bitcoin, the only inconvenience is that there are multiple currencies with different security models that are priced by the market individually according to their merits. If BTC doesn’t scale and doesn’t have privacy, one can use Zcash. If the fees are too high on the original chain, BCH and Litecoin come to the rescue. And if this whole movement appears to be too serious, with institutions and high-profile politicians getting involved, it can also become appealing to people looking to have some fun via Dogecoin.

The market provides options for everyone… but fundamentally, the technology is still Bitcoin. This is a hard pill to swallow for maximalists and a complex problem to solve by economists and game theoreticians. But the reality is that forks really do extend Bitcoin: they add capacity and features, but print money too.

Yet is it really so terrible if we replace the hundreds of political central bank-controlled fiat currencies with a dozen blockchains that provide utility to billions of users via cryptocurrencies that can be swapped at the global market rate? 1 billion censorship resistant coins with predictable monetary policy are definitely better than infinite numbers in Excel spreadsheets that the government can control. I like to call this way of thinking Bitcoin post-maximalism… but I guess that’s a subject for another magazine!

This magazine explores three types of forks: 

1. the hard forks and soft forks that improved the original Bitcoin chain;
2. the breakaway hard forks, which copied the UTXO set (coin ownership) but moved it to a new network with new rules and features: Bitcoin Cash, Bitcoin SV, Bitcoin Gold, Amaury Sechet’s eCash (XEC), Luke Dashjr’s Blake2b XBT, and Paul Sztorc’s BIP300 eCash (ECX);
3. the codebase forks, which took Satoshi Nakamoto’s code and tried something new by starting a new blockchain from scratch (Namecoin, Litecoin, Dogecoin, Dash, Decred, Zcash);

In order to make this publication unique, I used quotes from interviews with founders and developers which I have interviewed over the years on Bitcoin Takeover Podcast. Even though you can find the data about every fork elsewhere, it’s the personal input and commentary of the people involved that makes this effort truly one of a kind.

This magazine was designed in September 2026, and the plan had three stops: a digital demo at Token2049 in Singapore (October 7-8), a 5-article demo print at TABConf 8 in Atlanta (October 12-15), and the final version with all 13 articles and some bonuses at the Bitcoin Conference in Amsterdam (November 5-6). Every article is free to read on the Forks! magazine page, because research like this should not sit behind a paywall.

But the information without gorgeous eye-catching graphics can be boring. So I would like to thank Ani for doing the stunning watercolor painting for the cover and the clean graphics for the BTC article (with more work on the way). I also want to thank CM for jumping in to help: his work ethic is amazing, his comic book-style graphics are jaw-dropping, and without his ”one article per day” routine the demo wouldn’t have been ready on time. So kudos to both of them for turning my text into something that’s visually pleasing.

I would also like to thank my podcast sponsors Cake Wallet, LayerTwo Labs, Sideshift.ai, Orange Rock, and Braiins Hashpower for supporting my work over the years. It’s thanks to them that nice projects like this magazine can see the light of day (just like Vaultoro, Wasabi and Trezor made the first BTCTKVR magazine happen in 2021). Yes, HODLing is nice. But creating beautiful art is what gives life meaning and how others will remember us.

So is Bitcoin a monolithic project or a codebase? Did Satoshi Nakamoto give us the blueprint to create unstoppable internet currencies, or did he bring into existence the final form of money and the only one we will ever need? Is there any value in trying these forks? There is only one way to find out: through study, free markets and research, not dogma.

In the spring of 2013, cryptographers at Johns Hopkins University created Zerocoin in order to make Bitcoin private. But the Bitcoin Core developers said no, and mostly for understandable reasons. Three years later the researchers copied Bitcoin’s code, added the moon math themselves, and launched a separate chain. Ten years, two inflation bugs that most likely weren’t exploited and one torched laptop later, Zcash is the most promising codebase fork of Bitcoin shipped so far, and the clearest record we have of what private money really costs.

On a Sunday in May 2013, a nervous PhD student from Johns Hopkins walked onto the stage at the Bitcoin 2013 conference in San Jose. He apologised for being flustered: he had come straight from San Francisco, where his paper was about to be presented at the IEEE Symposium on Security and Privacy, one of the most selective venues in computer security. His name was Ian Miers. The paper was called Zerocoin, and he had about twenty minutes to tell a room full of early Bitcoiners that their favorite internet money was not as private as they believed.

He opened with a joke about copying. Making digital money that cannot be copied is nearly impossible, he said, and “if you think about how easy it is for a fourteen-year-old kid to pirate the latest Justin Bieber album, and you consider that a twenty-dollar bill is probably worth considerably more than Justin Bieber, you have some idea about the scope of the problem.” Then he made his point: Bitcoin was not anonymous at all.

It was pseudonymous, and pseudonyms leak. Two shops that see you under different names eventually notice that both names drive home to the same house. Data miners would link Bitcoin addresses the same way. Miers argued that this made Bitcoin worse than a bank account: “At least in the case of the bank, it was the bank and whoever they told that knew your stuff. Your neighbors didn’t, your family didn’t, your co-workers didn’t.” On Bitcoin, everyone would know.

His solution borrowed from David Chaum, the father of digital cash, and took away the bank. You would lock bitcoins into an “opaque envelope” recorded on the blockchain. Later you would prove, using a zero-knowledge proof, that you owned one of the envelopes in the pool, without revealing which one. He even had a way to explain it to children: you can prove you know where Waldo is by laying a huge sheet of paper with a small hole over the picture, so Waldo shows through the hole and nothing else does.

Miers was candid about where it might end up. “How does this get adopted as part of Bitcoin? Okay, that’s like the ideal, and not that likely,” he said. “As part of some alternative currency, maybe. Or it becomes its own alternative currency, that actually has the claim to fame that it’s really anonymous? I don’t know.” He described himself as living in “not quite an ivory tower. The roof leaks. It’s not that tall, but close enough.”

Then the questions started. As Zooko Wilcox remembered it to me in S16 E29 of the Bitcoin Takeover podcast, Peter Todd stood up first, and his question “was more of a statement”: “The Bitcoin Core developers are not going to integrate a hard forking, experimental, inefficient protocol upgrade into Bitcoin right now.” The room microphones barely caught it, but Miers’s reply survives on the recording: “Yeah, that’s a perfectly reasonable point.” Then someone asked about denominations. If everyone has to mint coins of the same fixed size, wouldn’t a payment of an unusual amount stand out? “That would be trivially traceable,” Miers admitted.

Within those twenty minutes was nearly the whole history that follows: the cryptography, the doubts, Bitcoin’s refusal, and an academic’s correct guess that the idea would have to leave home to survive.

The summer Bitcoin almost got private

For a few months in 2013, Zerocoin looked like Bitcoin’s future. Bitcoin Magazine, co-founded by a nineteen-year-old Vitalik Buterin, put it on the cover of its July 2013 issue: “Zerocoin: Bitcoin Privacy, Perfected.” It sat on newsstands next to an interview about the first Bitcoin ATM.

In August, Greg Maxwell posted CoinJoin to Bitcointalk. It was a far humbler technique: several users combine their payments into one transaction so an observer cannot easily tell whose coins went where. It needed no change to Bitcoin at all. Maxwell’s thread, which later hosted a CoinJoin bounty fund, is often remembered as a rejection of Zerocoin. It was really a mix of admiration and frustration:

“As a crypto and computer science geek I’m super excited by Zerocoin: the technology behind it is fascinating and important. But as a Bitcoin user and developer the promotion of it as the solution to improved privacy disappoints me.”

His objection was about engineering, not principle. Zerocoin “requires a soft-forking change to the Bitcoin protocol, which all full nodes must adopt, which would commit Bitcoin to a particular version of the Zerocoin protocol. This cannot happen fast, probably not within years, especially considering that there is so much potential for further refinement to the algorithm at lower costs.” CoinJoin, as he framed it, was what Bitcoin could do now, until something like Zerocoin was ready.

Someone else was paying attention. Hal Finney, the first person after Satoshi to run Bitcoin and the recipient of its first transaction, had always cared about privacy. In 1993 he wrote an essay called “Protecting Privacy with Electronic Cash.” In 1998 he demonstrated a zero-knowledge proof program of his own at the Crypto conference in Santa Barbara.

One of his earliest tweets about Bitcoin, in January 2009, read: “Looking at ways to add more anonymity to bitcoin.” By 2013 ALS had taken almost all his movement; he wrote with eye-tracking software. When I went through the accounts his profile followed, I found the people working on Zerocoin and Zerocash, and Zooko Wilcox among them. In the last months before he died, in August 2014, one of the most important people in Bitcoin’s history was watching the work that would become Zcash.

Explainer: Zerocoin versus Zerocash

Zerocoin proved that zero-knowledge privacy could work on a Bitcoin-style ledger. Zerocash made it practical.

The jump came from zk-SNARKs, a newer kind of proof that the four extra authors had been making efficient, building on systems such as Pinocchio and BCTV14. Instead of special-purpose proofs for each step, Zerocash used one general-purpose proof that a whole hidden transaction followed the rules. “Zerocash sort of threw SNARKs at the problem,” Sean Bowe told me in S16 E51. The trade-off was that Zerocash needed a trusted setup and newer cryptographic assumptions, and those were exactly the parts Bitcoin’s developers trusted least.

Zooko was in San Jose that weekend too. A two-person startup called Coinbase offered him a job as its security chief at a folding table, and he turned it down. He did not see Miers’s talk, but he says the Hopkins group and the four SNARK researchers met there; Ben-Sasson gave his own talk on succinct proofs at the same conference. In Zooko’s words, “the four scientists met the three scientists and joined forces and became the seven scientists.”

Satoshi’s unfinished wish

The idea was older than all of them. In August 2010, someone on Bitcointalk suggested that zero-knowledge proofs might help Bitcoin. Satoshi replied that it was hard to see how they would apply, but added that if a solution could be found, a much better, easier, more convenient implementation of Bitcoin would be possible. “And then four months after he posted that, he disappeared from the internet forever,” Zooko told me. “And then three years after that, these scientists, who didn’t include me, found a solution.”

Zooko had been waiting longer than most. In the 1990s he worked at David Chaum’s DigiCash in Amsterdam, chasing a decentralized version of Chaum’s cash in his spare time. “I was trying to invent Bitcoin for like 15 years unsuccessfully before Satoshi invented Bitcoin,” he said. When Zerocoin appeared, “my eyes lit up, and I said to myself, this is the first thing that could actually work.”

He saw Bitcoin’s transparency as a deep design flaw: “You can’t use Bitcoin for anything without unwillingly disclosing your current assets and all of your past transactions and all of your future transactions.” He also liked the name: “the word zero in the name Zerocoin is named after zero-knowledge proofs, which are named after leaking no information about you.”

In early 2014, Matthew Green presented Zerocash at the Real World Crypto conference. Zooko was first at the microphone. “This is great. This is awesome. Best thing ever,” he said. “But what about that trusted setup thing?” Green’s answer, a recorded ceremony and a destroyed computer, did not satisfy him, and he kept pressing. A few weeks later Green called and asked him to help turn Zerocash into a real currency. When the company appeared on AngelList in 2015, Wired reported its pitch in one line: “Bitcoin is HTTP for money. We are HTTPS.”

Were Bitcoin’s developers right?

On the narrow question, yes, and the decade since has proven it.

If Bitcoin had soft-forked Zerocoin in 2013, it would have inherited a protocol in which researchers found a cryptographic flaw in April 2018 that let an attacker destroy honest users’ coins, create coins from nothing, or steal them. If it had adopted Zerocash in 2014, it would have inherited the flaw in BCTV14 found in March 2018, which made counterfeiting possible for anyone who noticed some extra numbers in the setup transcript. It would also have been exposed to the 2026 Orchard bug, which sat undetected for four years. And it would have had to run a trusted setup and ask every Bitcoiner to believe the secret had been destroyed.

Bitcoin has had inflation bugs of its own, in 2010 and 2018, but in both cases anyone could see and count the damage. In a shielded pool, a counterfeit coin looks like every other coin. Peter Todd made the point again in 2026: “The privacy of Zcash makes inflation exploits far more dangerous.”

Even Zcash’s builders concede the point. “Bitcoin Core probably [was] right,” Josh Swihart said in S15 E62. “The cryptography was too novel at the time.” Sean Bowe never expected Bitcoin to say yes: “If you ever interacted with the Bitcoin developers back then, they were absolutely not going to ever add something like that.”

Why someone still had to try

Bitcoin’s caution was right for BTC. But someone had to run the experiment, because a paper cannot tell you two things: whether the technology survives contact with real money, and whether anybody wants it.

The first question is about refinement. Ideas get better when they are shipped. Bowe describes the trap Maxwell was pointing at: a conservative chain waits for the perfect version, and “a new paper’s going to come out and say, oh, I have a way to do it ten times faster and with better trust assumptions.” Zcash took the opposite view. “We’re willing to take what we have that we know works and change the protocol completely to implement it, as fast as we can safely,” he said.

Nearly every improvement he made came from fixing real problems in a live system: proofs fast enough for phones, setups with 87 participants instead of six, and finally Halo, which needed no setup at all. “You can be clever and everyone can praise you for your papers, and that’s great for your resume, but it doesn’t actually do anything,” he told me. “Shipping is crucial.”

The second question is about demand. A testnet gives you no answer, because nobody’s money is at stake. Zcash spent years as a technology everyone admired and almost nobody used. Then wallets made shielding the default, and the numbers changed. By late September 2026, according to CoinDesk, about 4.9 million ZEC, roughly 29 percent of issued coins, sat in shielded pools, and one week recorded about 63,000 shielded transactions, the busiest since 2022. Those numbers show demand that no academic paper could have measured.

Bitcoin itself learned something too. In S16 E51 I told Sean that when I asked Peter Todd to name altcoins he considered legitimate, he named Litecoin, Monero and Zcash. The technology was “actually interesting,” he said, “and they have made great progress.” In September 2026, researchers at [alloc] init published “Shielded Bitcoin,” a proposal for Zcash-style encrypted payments on Bitcoin that needs no consensus change. The idea Bitcoin declined in 2013 is being proposed again, partly because Zcash shipped it first.

The box under my bed

For me, this story became personal through a cardboard box sealed with duct tape.

In 2021, at the height of the NFT craze, I bought a collectible from Peter Todd for $1111 in bitcoin: the remains of the laptop he used in October 2016 to help create Zcash’s first shielded pool. It is one of six computers in the world that took part in the ceremony that launched Sprout. As far as I know, it is the only one sold to a collector. The processor is gone; Todd destroyed it on purpose.

What remains is a cooling fan, a heat sink still smeared with thermal paste, a gutted hard drive and a set of Verbatim DVDs. One envelope reads “burnt compute node remains,” sealed by Todd on 26 October 2016. Another is labelled “final MPC compute node, test burn #1, #2, Tails,” sealed “at midnight on Monday, October 24, 2016.” He drew his pen across every seal, so that opening one would break the line.

“On one hand amateurish, but rigorous,” I said on air while I cut it open with a pen. I kept it sealed under my bed for years, waiting for someone who could explain it properly. In S16 E29 I opened it on camera, with Zooko there to explain it.

The DVDs are the important part. Under Zooko’s rules, each ceremony computer had its Wi-Fi and Bluetooth removed and was never plugged into a network. The only way data could get in or out was a disc burner. “The six discs you have there,” Zooko told me, “are the only six messages that emitted from that compute node between the time it was random-purchased at the store and the time it was destroyed.” They let anyone check that the parameters Zcash nodes used were the ones the six participants actually produced.

For two years, those discs were dangerous. In March 2018, the cryptographer Ariel Gabizon found that the BCTV14 proof system behind Sprout had told the ceremony to generate some extra elements it never needed. Those elements ended up in the ceremony transcript, which was simply all six participants’ DVDs joined together, and they were enough to forge proofs.

Anyone who had the transcript, and understood what was in it, could have created counterfeit Sprout coins. According to Sean Bowe, one of the discs in my box, probably D or F, contains that data. From Zcash’s launch on 28 October 2016 until the Sapling upgrade on 28 October 2018, information that could break the money supply existed on optical discs scattered around the world, including the ones that later sat under my bed.

Eran Tromer had warned about exactly this. In 2016 he argued against publishing the transcript at all. “I was like, ah, Eran, you worry too much,” Zooko said. “I was totally wrong and Eran was totally right.” Once the flaw was found, the team deleted the public transcript.

Bowe encrypted what was probably the last complete copy and handed the key to Zooko, so that reaching it would take both of them. Then a small group fixed the problem in secret for eleven months. The Sapling upgrade moved Sprout onto a different proof system with new parameters, so the old elements could no longer forge anything.

ECC disclosed the flaw in February 2019. Afterwards, Bowe had to rebuild the transcript as a historical record from the participants’ discs. Todd declined to help. A videographer who had filmed the ceremony turned out to have downloaded the missing discs, some of them corrupted, and it was just enough. Since 2018, my DVDs have been a museum piece rather than a weapon.

There is no evidence the flaw was ever exploited. A rule Zcash had in place from launch, the turnstile (later formalised in ZIP 209), sets a hard limit: coins can leave a shielded pool only through the transparent side, so each pool’s balance is public, and no pool can pay out more than it ever took in. New deposits into Sprout were disabled by ZIP 211 in the Canopy upgrade in 2020, and the pool has since dwindled to about 25,600 ZEC. “There’s no way it was exploited, I think,” Bowe said, “and if it was, there’s a cap on the impact.”

That box is also where this year’s other project begins. I am making a documentary, Zcash: From Zidelined to Zillions, built from footage of my Bitcoin Takeover interviews with Zooko, Sean Bowe, Josh Swihart, Kris Nuttycombe and others, including the unboxing. It will be released around Zcash’s tenth anniversary, on 28 October 2026.

Vital statistics

Market data from 17 September 2026 (CoinMarketCap, CoinGecko); shielded data from 25 September 2026.

The ceremony

The zk-SNARKs of 2016 needed public parameters, and making them produced a secret by-product. “I decided to call the secret the toxic waste,” Zooko said. Anyone who kept it could print unlimited shielded ZEC without detection. It could not reveal anyone’s transactions; it could only counterfeit. The fix was a multi-party computation. “There’s these six different chemicals, and if you mix all of them together in the same room, they turn into this horrible toxic waste,” Zooko explained. “So what we’re going to do is keep the six precursors separate from each other and not allow them to mix.” If even one participant destroyed their share honestly, the waste could never be assembled.

Why six? “The protocol took hours, and if we had more people it would take more hours, and we couldn’t fit it into one weekend.” Zooko recruited eight or nine, then told all but six at the last moment that they had been decoys, there to distract hackers. He gave three of the six pseudonyms. Every participant had to buy a new computer in person and never let it out of sight, a practice Edward Snowden taught him called “random purchase.”

When Zooko visited Julian Assange in the Ecuadorian embassy, Assange’s advice was to “double down on the air gapping part.” Zooko’s own station was filmed around the clock by cameras bought used in Denver, because “you couldn’t buy a camera that didn’t have Wi-Fi in 2016.” The journalist Morgen Peck watched on site and wrote it up for IEEE Spectrum; her reporting also became Radiolab’s “The Ceremony”.

The six stations over the weekend of 22 and 23 October 2016 were:

• Zooko Wilcox, in Colorado.
• Peter Van Valkenburgh of Coin Center, who cut his RAM apart with tin snips.
• Derek Hinch of NCC Group.
• Andrew Miller.
• “John Dobbertin,” revealed in 2022 as Edward Snowden.
• Peter Todd, who ran his computation in a car driving across Canada and then burned the machine with a propane torch. “It was my goal to outdo every other station in Canadian cypherpunk glory,” he wrote in “Cypherpunk Desert Bus.”

Sean Bowe, then 23, coordinated the whole thing and, at one point, pasted a 4chan meme into the group chat by mistake: “I found out it was Edward Snowden much later. I was like, ah crap, that’s embarrassing.”

Todd later disowned his part, writing that the setup should not be “called a multiparty computation, which makes my involvement pointless.” His worry was the software: “There are lots of ways someone could have surreptitiously changed it.” Bowe’s reading: “It lent legitimacy to Zcash that he didn’t want to lend.”

Three pools and the end of the ceremony

Sprout (2016) was the proof of concept. “You couldn’t run it on a mobile device,” Zooko admitted. Making a transaction “used up all your RAM and heated up your CPU for like 40 seconds.”

Sapling (2018) made shielded payments work on phones, with parameters from the 87-contribution Powers of Tau ceremony that Bowe designed.

Orchard (2022) ended the ceremony entirely. Bowe, working with Jack Grigg and Daira-Emma Hopwood, found Halo in 2019, the first practical way to build recursive proofs without a trusted setup. Bowe says the removal was almost a side effect: “I would have actually been totally happy with Halo at first if it didn’t solve the trusted setup problem.” Halo 2 became Orchard’s foundation. Six years after Peter Todd’s torch, nobody had to destroy anything.

How Zcash differs from Bitcoin

Who pays for Zcash

For the first four years, 20 percent of every block subsidy went to founders, investors, staff and the Zcash Foundation. This was the Founders’ Reward, about 10 percent of the eventual supply. Critics called it a premine. Zooko calls it the reason Zcash kept improving: “We could have stopped in 2016, but that would have been a pretty meager contribution to mankind compared to what we’ve got today.” The Dev Fund that followed (ZIP 1014) split the 20 percent among the Electric Coin Company (ECC), the Zcash Foundation and a grants programme.

At the 2024 halving, Josh Swihart, who had taken over as ECC’s chief executive in December 2023, refused to renew ECC’s share. “I didn’t think for a public good it was appropriate for any organization’s addresses to be baked into the chain, nor to be guaranteed funding,” he said in S17 E28. Today 8 percent goes to Zcash Community Grants and 12 percent to a lockbox that coinholders have controlled since NU6.1 in November 2025.

In January 2026, after a dispute with the board of the Bootstrap Project, ECC’s nonprofit parent, the entire ECC team left. “Within a week” they had formed the Zcash Open Development Lab (ZODL), a for-profit that earns 50 basis points on in-wallet swaps. ECC is being wound down. Shielded Labs, where Zooko now leads product, is developing Crosslink, a hybrid of proof of stake and proof of work, and the Network Sustainability Mechanism.

The critics

Riccardo Spagni, the former Monero lead, told me in S17 E8 that he considers Zcash a “scam” in the same sense as Ethereum. He meant a project built by “technically competent people who make stupid decisions when it comes to architecture or design… in full knowledge.” His core argument is that privacy should be on by default: “You shouldn’t wait for scaremongering to happen to turn the switch on. The switch should be on from the get.”

On the funding: “If it was just researchers creating a thing that they hoped would become a model for Bitcoin, why did they raise money?” Zcash’s builders reply that a shielded transaction hides among the entire history of its pool, while a Monero ring signature hides among a handful of decoys. Zooko adds that “you cannot add privacy to money in flight, you can only add privacy to money at rest.”

The Orchard crisis of 2026

On 29 May 2026, Taylor Hornby, a security researcher working with Shielded Labs, reported a soundness bug in Orchard’s circuit. It had been live since 2022 and could have allowed coins to be minted inside the pool. A soft fork paused Orchard, and NU6.2 restored it on 3 June. ZEC roughly halved in price, and holders withdrew about 800,000 ZEC. Swihart defended disclosing everything in S17 E28: “It eroded some trust in the shielded pool, because people can’t see inside. But it increased the trust of the teams.”

Explainer: Ironwood and Tachyon

Ironwood (NU6.3, 28 July 2026) moved shielded funds to a corrected pool and made the old Orchard pool withdrawal-only. That turns the migration into an audit: every coin leaving Orchard passes the turnstile. It also comes with a machine-checked proof in more than 2,700 Lean theorems that the pool cannot create undetectable counterfeit coins. “Zcash’s new formal verification efforts eliminate undetectable counterfeiting bugs from the new Ironwood pool,” Bowe wrote. It also adds quantum-recoverable notes.

Tachyon is Bowe’s plan to scale private money in three parts:

• Oblivious synchronization. An outside service tracks the chain for your wallet without learning anything about it.
• No in-band secrets. Payment details travel directly between sender and recipient instead of being stored on chain.
• Shielded aggregation. A block’s shielded transactions are folded into a single recursive proof.

Validators could then delete old spending records instead of keeping them forever. “If privacy can’t scale now, then nothing can,” Bowe said in S16 E51. “So it’s math, and it’s also vibes.” Most of Tachyon is not live yet.

Who is who

The authors

• Ian Miers, Christina Garman, Matthew Green and Aviel Rubin, who designed Zerocoin at Johns Hopkins.
• Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer and Madars Virza, who joined them to create Zerocash.

The builders

• Zooko Wilcox-O’Hearn, Zcash’s founder.
• Nate Wilcox, his brother and business partner.
• Sean Bowe, who coordinated the ceremony and leads Halo and Tachyon work.
• Daira-Emma Hopwood and Jack Grigg, protocol designers.
• Ariel Gabizon, who found the 2018 flaw.
• Josh Swihart, head of ZODL.
• Kris Nuttycombe, wallet and SDK engineer.
• Taylor Hornby, who found the 2026 Orchard bug.

The ceremony

• Peter Todd, Edward Snowden, Peter Van Valkenburgh, Derek Hinch, Andrew Miller and Zooko Wilcox, with Morgen Peck as witness.

The skeptics

• Greg Maxwell, Peter Todd and Riccardo Spagni.

The watcher

• Hal Finney.

What Zcash proved

• Zero-knowledge proofs can secure real money. “There wasn’t a public product that used general-purpose zero-knowledge proofs, in any industry, that had ever shipped before Zcash,” Bowe says.
• Trusted setups can be retired. It took six years to go from six participants to none.
• Bitcoin’s caution was justified. Privacy hides bugs as well as payments.
• Turnstiles and formal proofs can restore trust in a private money supply.
• Experiments answer questions papers can’t. These include whether the cryptography holds up and whether people want it.

Will it flip Bitcoin?

No, and it does not really try. Zcash is worth about 1.5 percent of Bitcoin, its mining is less distributed, and its governance has been turbulent. Its claim is narrower and harder to dismiss: it is the privacy upgrade Bitcoin was offered in 2013, actually built, broken twice, and rebuilt around a mathematical proof. If Bitcoin ever decides it wants shielded payments, it will benefit from more than a decade of research data and hard fork in the field of zero knowledge proofs.

So adding it today is much safer than adding it in 2014 because the understanding of the technology is better and there are more experts around the world who can verify the code. Unfortunately, it appears that Bitcoin is stuck from a technical evolution point of view… which lends much more legitimacy to projects like Zcash and enables them to flourish in the markets where BTC is no longer competitive. So there is room for a battle for users and network effects, but it seems unlikely that ZEC will flip BTC any time soon.

Scorecard inputs

Sources

Bitcoin Takeover Podcast

• S16 E29: Zooko on Ecash, Bitcoin & Zcash
• S16 E51: Sean Bowe on Bitcoin, Zcash, Scaling & Privacy
• S15 E62 (Josh Swihart and Kris Nuttycombe), S17 E8 (Riccardo Spagni), S17 E26 (Bitcoin Cash developers) and S17 E28 (Josh Swihart), all in the podcast archive
• Bitcoin Forks, Described by Dorks, the timestamped quote archive

Papers

• Miers, Garman, Green and Rubin, “Zerocoin: Anonymous Distributed E-Cash from Bitcoin”, IEEE S&P 2013
• Ben-Sasson et al., “Zerocash: Decentralized Anonymous Payments from Bitcoin”, IEEE S&P 2014
• Pinocchio and BCTV14
• Gabizon, “On the security of the BCTV Pinocchio zk-SNARK variant”
• Bowe, Grigg and Hopwood, “Recursive Proof Composition without a Trusted Setup” (Halo)
• Biryukov and Khovratovich, “Equihash”
• Back et al., “Enabling Blockchain Innovations with Pegged Sidechains”

Primary posts, talks and documents

• Ian Miers, “Zerocoin: A New Anonymous eCash Extension for Bitcoin”, Bitcoin 2013, San Jose
• Zerocoin Project talks and press
• Greg Maxwell, “CoinJoin: Bitcoin privacy for the real world”, August 2013
• Satoshi Nakamoto on zero-knowledge proofs, August 2010
• Hal Finney, “Looking at ways to add more anonymity to bitcoin” and “Bitcoin and Me”
• Bitcoin Magazine Issue #12, July 2013
• Peter Todd, “Cypherpunk Desert Bus”
• Zcash parameter generation
• ECC, “Zcash Counterfeiting Vulnerability Successfully Remediated”, February 2019
• Zcash protocol specification, ZIP index, ZIP 209, ZIP 211 and ZIP 1014
• Upgrade pages: Sapling, Blossom, Canopy, NU5 and NU6.1
• ECC on the 2023 leadership change and the 2024 halving
• Project Tachyon, “Ironwood verification complete”
• Sean Bowe, “Tachyon: Scaling Zcash with Oblivious Synchronization”
• Halo 2 book, Zebra and Shielded Labs NSM
• Bitcoin’s own bugs: the 2010 value overflow incident and CVE-2018-17144

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

After eleven years of trying to convince Bitcoin to adopt Drivechains, the man who invented them stopped asking. His eCash fork copies Bitcoin’s ledger, adds as many sidechains as miners are willing to support, reallocates half of Satoshi’s stash, and goes live on Halloween 2026. In many ways, ECX is the most ambitious of all fork in this magazine… and the one Bitcoin developers should watch most closely.

I have known Paul Sztorc since 2018, and I have had him on Bitcoin Takeover podcast about 11 times without ever repeating the same interview talking points. So I have watched his work grow and improve over time. What I like about Paul is that he is focused on being technically correct, cares about finding the truth, but still finds the time to use funny or interesting metaphors to describe his ideas. When someone objects on the grounds of vibes or personal disagreements, Paul brings the conversation back to objective facts. He doesn’t get emotional about technology and he is willing to be proven wrong. Which is something that’s truly rare in the space.

Paul Sztorc first described Drivechains in 2015, formalized the concept as BIP-300 in 2017 and BIP-301 in 2019 alongside his friend BitAxe, and spent the following decade arguing for them in blog posts, conference talks, and podcasts. Then he started a company named LayerTwo Labs, used the money to pay his harshest critics (Peter Todd and Luke Dashjr) to do professional reviews of his ideas, and then funded developers to build the piece of software that lets miners activate BIP300 without asking permission from Core (CUSF, or the Core Untouched Soft Fork).

None of it turned out to be fruitful. BIP-300 is still a Draft. So in April 2026, Paul formally announced he was done waiting, and that he would fork Bitcoin himself.

This is the short version of the story about the new eCash, whose ticker is ECX. It is also the story of a friend who has been right about a remarkable number of things and has too often made it hard for people to notice or acknowledge.

Disclosure: LayerTwo Labs, Paul’s company, sponsors the Bitcoin Takeover podcast and this magazine. I have tried to hold this article to the same standard as the others in the issue. You can judge whether I succeeded.

Vital statistics

Data as of 28 September 2026. The permanent chain does not exist yet, so most of these figures describe the rehearsals.

Eleven years of asking

To understand the fork you have to understand how much time Paul spent developing the idea and trying to promote it in the developer circles.

He first rose to Bitcoin prominence through prediction markets. In 2014 he published the Truthcoin whitepaper, later renamed Bitcoin Hivemind: a way to run betting markets whose outcomes are decided by a decentralized vote instead of a trusted oracle. In order to scale, it needed a home that was not the Bitcoin main chain. Nobody would let a prediction market clutter Bitcoin’s base layer, and rightly so. Drivechains were envisioned as that home. A sidechain would hold BTC, run whatever rules its users wanted, and send the coins back to the main chain when they were done, with Bitcoin’s miners acting as the custodians.

BIP-300, “Hashrate Escrows,” co-authored with CryptAxe, was assigned in August 2017, the same month the big blockers left for Bitcoin Cash. That timing is not incidental. Paul has argued for years that Drivechains were the peaceful answer to the block size war: let the people who want big blocks have a big-block sidechain, pegged to real BTC, and nobody has to fork. BIP-301, “Blind Merged Mining,” followed in 2019, so miners could collect sidechain fees without running every sidechain’s software.

In December 2022 Paul, CryptAxe and former Kraken executive Austin Alexander launched LayerTwo Labs with a $3 million seed round to build the software. In 2023 Luke Dashjr, of all people, opened a pull request to Bitcoin Core implementing BIP-300 (#28311). It was closed in March 2024 without being merged. That October the company paid Peter Todd, one of Drivechain’s most persistent critics, to write a detailed technical analysis. He wrote it, but didn’t put much effort into it. Paul eventually spent more time dissecting it than it took for Peter Todd to write it.

By late 2024 Paul had a new plan, which he explained in detail on Bitcoin Takeover Podcast S15 E68: a “Core Untouched Soft Fork,” or CUSF. Miners would run a small enforcer program beside an unmodified Bitcoin Core, and if a majority of hashrate did so, Drivechains would activate without a single line entering Core’s repository. Critics called it a way around peer review. Paul called it the only way left. His explanation of why is still the best summary of Bitcoin’s development pace I have recorded:

“We used to do a soft fork every six months… in the first like seven to eight year period, we did 16. In the second seven to eight year period, we did two. And one was SegWit, 26 months, and then [Taproot] 40 months. So it’s just been getting slower and slower.”

Miners did not run the enforcer. So in April 2026, Paul announced the hard fork.

Right, early, and hard to listen to

I want to be fair to Paul here, because the Bitcoin conversation usually isn’t.

He was right that Bitcoin’s upgrade pipeline was drying up. Taproot activated in November 2021, and nothing has activated since. His own project’s website puts it bluntly: “bitcoin has ossified.” You can argue ossification is a feature and find virtues in a protocol that doesn’t change. But you cannot argue that it isn’t happening.

He was right that people wanted more from Bitcoin than Bitcoin offered. Ordinals, Runes, BitVM, Citrea, Spark, the whole 2024 rush toward “Bitcoin L2s”: every one of them confirmed that users and developers wanted programmability, privacy and scale attached to BTC. Most of them got there through federations or trust assumptions Drivechains were designed to avoid.

He was right about prediction markets. In 2014 they were a libertarian curiosity. By 2024 Polymarket was a household name during an American election. The ecashblog marked the eve of the Alpha with a reunion between Paul and Robin Hanson, the economist whose work started the field. That felt earned.

Paul Sztorc is also right that the argument against Drivechains has often been cultural rather than technical. Peter Todd’s critique was technical, serious, but half-baked and excessively paranoid about miners that otherwise have all the incentives to remain honest actors. But a lot of the debate was disappointingly ideological.

However, Paul does not like it easy. Here is how his own fork’s website explains the decision to leave:

“I would prefer not to. But it’s not up to me. Other people are damaging the Bitcoin project. Core developers have become timid, self-interested, lazy, and corrupt. Miners have abdicated their duty… Bitcoin culture has many entrenched errors, and is probably unfixable at this point.”

It then sums up the cost of the fork: “The downside is small: some drama, plus every Bitcoiner gets some free money.”

That is Paul in two sentences. The first is a shot at the people he spent a decade trying to persuade. The second is a genuinely good point, phrased as a taunt. I have seen people who agreed with every technical argument about Drivechains walk away because of paragraphs like that (or tweets that express a similar attitude). I have also seen Paul be patient, generous and funny for three hours on a microphone. Both versions are real. But only one tends to end up in screenshots.

The Satoshi coins

The detail that made the April announcement explode had nothing to do with Drivechains.

Roughly 1.1 million BTC sit in early coinbase outputs that follow the “Patoshi” mining pattern, and are widely assumed to be Satoshi’s. They have never moved. On the ECX ledger, which copies Bitcoin’s, they would appear exactly as they are. Paul’s plan is to leave about 600,000 of them where they are and use 220 hard-coded transactions, valid without the original signatures, to reassign about 500,000 to investors who fund the project before launch. His justification was that without early capital, eCash would become a “zombie project”: half built, underfunded, and quietly controlled by whoever happened to show up.

Peter McCormack called it “theft and disrespectful.” Paul’s answer was short: “We do not take any of Satoshi’s BTC.” Technically he is correct. Not one satoshi moves on Bitcoin. Jameson Lopp made the same point, while adding that the marketing seemed designed to provoke. But the objection was never really technical. Bitcoin’s culture treats an unspent output as sacred, and Satoshi’s outputs most of all. Rewriting their copy on another chain, even a chain nobody is obliged to use, crosses a line many people did not know they cared about until it was crossed.

There is a quiet irony worth noting. In S17 E19, Amaury Séchet told me that what alarms him most about Bitcoin today is how casually its developers now discuss freezing Satoshi’s coins to defend against quantum computers: “10 years ago people would laugh in your face. But now apparently it is on the table.” On Bitcoin itself, the idea of touching those coins went from unthinkable to debatable in a decade. Paul simply did it first, on his own chain, in the open, and put a price on it.

Alpha, Beta, Mainnet

The original plan was one permanent fork on 23 August. On 8 August Paul changed it to three. His stated reasons: rehearse the software, encourage a market for practice coins to find a price, and keep a way to abort if something went badly wrong. He was frank about the risk of bugs in rapidly written, partly machine-assisted code, which he called “LLM bug chaos.” No Bitcoin fork in this magazine was launched this cautiously. Bitcoin Cash forked in one shot in 2017, and so did everything after it. But then again, none of them were this ambitious in scope either.

Alpha forked just after midnight UTC on 23 August, at difficulty 1. The first week ran on rented hashrate, which pushed difficulty up fast. When the rental contracts ended, difficulty stayed high. By 27 August the network needed about 30.7 PH/s to produce ten-minute blocks and had about 5. The ecashpool.tech mining dashboard’s weather forecast became a community joke: “mostly slow, chance of drift.” Orphan blocks, a production incident, and a lot of arguing about where to point the hash followed.

Then came the part that matters for Bitcoin history. During the Alpha, community-built drivechains were activated under proof of work, and the first withdrawal bundle was proposed on a live BIP-300 chain. For eleven years Drivechains existed only in documents, testnets and arguments. For a few weeks in September 2026, they existed on a chain with real miners and coins that people were willing to buy.

Before Beta, about 150,000 pECX (practice ecash) were burned by holders. Practice coins from Alpha and Beta are meant to be redeemable for permanent ECX at a steep discount. Paul has been quoted describing a ratio of 1,000 pECX to 10 ECX. Beta fired on 19 September on schedule. Mainnet is the only stage that creates permanent ECX, from a fresh Bitcoin snapshot around block 973,728. That snapshot is what gives every Bitcoin holder their coins. The Alpha and Beta snapshots do not count.

How Drivechains work

Here is the idea in plain terms.

A sidechain is a separate blockchain that uses BTC (here, ECX) as its money. To move coins onto it, you send them to a special escrow output on the main chain. The sidechain sees the deposit and credits you. That part is easy.

The hard part is coming back, because the main chain cannot read the sidechain’s rules. Drivechains solve this by making miners the judges. When the sidechain wants to release coins from escrow, it publishes a withdrawal bundle: one transaction that pays out everyone leaving. Main-chain miners then vote on it block by block. Under BIP-300 a bundle needs 13,150 votes of approval within a window of 26,300 blocks, about three to six months. If it gets them, the escrow pays out. If it doesn’t, the bundle expires.

BIP-301 handles the other half. Sidechain blocks are produced by people who bid for the right to have their block hash included in a main-chain block. Miners collect the bid as a fee without running any sidechain software, which is why it is called blind merged mining.

The design choice is the whole argument. There are no fraud proofs and no federation. The coins in escrow are protected by the fact that stealing them would take a majority of miners voting dishonestly, in public, for months, while everyone watches. Supporters say that is the same security Bitcoin already has: miners could always reorganize the chain, and they don’t. Critics, Peter Todd foremost, say it turns miners into custodians of every sidechain, adds a new kind of power and liability to mining, and gives them a reason to consolidate. Both sides are describing the same mechanism. For eleven years they could only argue about it. Now there is a chain where the argument can be tested.

The seven ”official” sidechains

Look at that list and you see Paul’s answer to the altcoin market. Almost every successful altcoin does one thing Bitcoin won’t: privacy, tokens, names, fast payments, quantum resistance. Paul’s claim is that each of those should be a sidechain of Bitcoin’s money instead of a separate coin with its own supply and its own premine. Truthcoin is on the list because the whole journey started there.

Two forks, two philosophies

The summer of 2026 produced two serious departures from Bitcoin within weeks of each other, both led by developers with long grievances, and both airdropping coins to every Bitcoin holder. They are opposites in almost every way.

Luke Dashjr’s BLAKE2b fork is a conservation project. It exists to remove things: arbitrary data, large scripts, Taproot’s extension points, even two thirds of the block size. It changed its proof of work so that Bitcoin’s miners could no longer participate, and within weeks it was drawing up rules to punish the miners it did attract. Its idea of Bitcoin is a narrow one: money, and nothing but money.

Paul’s eCash is a construction project. It keeps SHA-256d so that Bitcoin’s miners can come along. It keeps Bitcoin Core’s code almost untouched so it can keep merging Core’s changes. Everything new goes into optional sidechains that nobody is obliged to use. Its idea of Bitcoin is a broad one: the most trustworthy money, with every useful feature built on top of it.

The two founders overlap in odd places. Luke wrote a Core implementation of BIP-300 in 2023. Both believe Bitcoin Core’s process is broken. Both forked in the same month. But when a large pool arrived on Luke’s chain, his community debated blacklisting its address at the consensus level. Paul’s chain is designed so that miners are paid to be judges. One fork is afraid of what miners might do. The other is betting everything on what they won’t.

The eCash community noticed the contrast, not always charitably. In their chat the BLAKE2b chain was promptly renamed “Lukecoin,” and one member predicted in early September that it “will probably have its own contentious hardfork within a year. Purity spiral.” Within days, the puritan fork was fighting over its biggest pool.

eCash against Bitcoin and Bitcoin Cash

Against Bitcoin, eCash is the road not taken: the same chain, the same rules, the same code, plus the one upgrade Bitcoin declined. If Drivechains work, eCash is the proof. If they fail, it is the warning.

Against Bitcoin Cash, the contrast is sharper, because Paul has always said Drivechains would have made Bitcoin Cash unnecessary. Bitcoin Cash made every user carry bigger blocks. Thunder offers large blocks only to the people who choose them, pegged to the main chain’s coin. The big blockers of 2017 split the network, the community and the brand to get what Paul argues they could have had as a sidechain. Nine years later he is testing that claim with real money.

Why eCash matters, even if it fails

This is the part I hope Bitcoin developers will read.

For a decade, the debate over Drivechains has been about hypotheticals. Will miners steal? Will they collude? Will blind merged mining centralize pools? Will anyone use the sidechains? Will withdrawal bundles of thousands of payouts get through in practice? Every one of those questions is empirical, and until August 2026 there was no data, only testnets and blog posts.

eCash is a free experiment for Bitcoin. It costs Bitcoin nothing: no code change, no activation, no risk to a single BTC. Its node is so close to Bitcoin Core that its accomplishments will be easy to adopt… if there’s ever consensus for it. If miners on eCash honestly approve withdrawal bundles for a year, that is useful feedback for the incentive model.

If the miners try to steal, that is good evidence too. If Thunder attracts real payments, or zSide real privacy users, or Truthcoin real markets, this tells Bitcoin something no amount of mailing-list debates can. And the project’s own FAQ says it will call itself off if Bitcoin activates BIP-300 and BIP-301 first, which makes the whole fork a standing offer as much as an exit.

This is also why the staging matters. Alpha and Beta are the first time a Bitcoin fork has been rehearsed in public, on mainnet hashrate, with a kill switch. Whatever you think of Paul’s opinions, this is a method other developers can borrow.

The name problem

This magazine now covers two coins called eCash. Amaury Séchet renamed Bitcoin Cash ABC to eCash in 2021, and it trades as XEC. Paul owns the ecash.com domain and chose the ticker ECX. The name comes from Milton Friedman’s 1999 remark that the missing piece of the internet was a reliable “e-cash,” and from Satoshi’s first draft of the whitepaper, which circulated as ecash.pdf. When I asked the Bitcoin Cash developers about it in S17 E26, Steve Thurmond called it “a dick move.” Calin Culianu reduced the dispute to one line of Python: "ecash" == "ecash".

The collision is not only an insult. It is a phishing opportunity. Exchanges and wallet providers have already warned about fake “claim your ECX” sites. The rule is simple: if you hold BTC in self-custody at the Mainnet snapshot, you already have ECX under the same keys. Nobody needs your seed phrase. Anyone who asks for it is a thief.

There is one small, strange grace note. In the same S17 E19 conversation, I asked Amaury what he would work on if his eCash didn’t exist. “I probably would have to join Paul and work on Drivechain.”

The risks

Before Mainnet, here is what everyone should know:

• Replay. Protection is opt-in. A Bitcoin transaction broadcast after the split may be valid on eCash too, unless you deliberately split your coins. Paul has said plainly that unprotected transactions will be replayed.
• Security. On the Alpha, the whole chain ran on about 0.001 percent of Bitcoin’s hashrate. Any SHA-256 miner of moderate size could reorganize it. Sidechain escrows are only as safe as the honesty of a majority of that small hashrate.
• Exchanges. If your BTC sits on an exchange at the snapshot, the exchange controls your ECX, and many exchanges have said they will not credit it. Japanese venues including Coincheck, GMO, SBI and Zaif took a cautious line during the Alpha.
• Withdrawal speed. Leaving a sidechain through the main peg takes months by design. Faster exits exist only through services that front you the money, which means trusting them.
• Concentration. One company, one node implementation, one lead, and a genesis distribution that includes about 500,000 reassigned coins held by pre-launch investors.

Who is who

The fork

• Paul Sztorc (“Truthcoin”), author of BIP-300 and BIP-301, founder and CEO of LayerTwo Labs, creator of Bitcoin Hivemind. The public face, the chief strategist and, often, his own sharpest critic’s best material.
• CryptAxe, co-author of BIP-300 and BIP-301 and LayerTwo Labs co-founder, responsible for much of the code.
• Austin Alexander, LayerTwo Labs co-founder, formerly of Kraken.
• LayerTree, the pool tag on the first Alpha block.
• The eCash community, whose running Alpha diaries on ecashblog.com are the best record of the rehearsal, and who are, understandably, not neutral.

The critics and the context

• Peter Todd, whose 2023 analysis, paid for by LayerTwo Labs, remains the most discussed technical case against Drivechains.
• Luke Dashjr, who wrote a Core implementation of BIP-300, then led the rival fork of 2026.
• Bitcoin Core maintainers, who never merged BIP-300.
• Peter McCormack and Jameson Lopp, who led the reaction to the Patoshi reassignment from opposite angles.
• Amaury Séchet, whose eCash (XEC) got to the name first.

What eCash has proved so far

It is early, so this list is short, and honest about that.

• Drive chains can run. Sidechains activated under proof of work and a withdrawal bundle was proposed on a live chain. What eleven years of argument could not settle was brought by a few weeks of rehearsal.
• A fork can be rehearsed. Alpha and Beta showed that a split can be tested on real hashrate before it becomes permanent.
• Difficulty is the first enemy of a minority SHA-256 chain. Rented hashrate arrived, pushed difficulty up, left, and stranded the network at a sixth of the hashrate it needed.
• Genesis choices are forever. Whatever eCash achieves, the reassigned Patoshi coins will be the first thing people mention.
• Hold your forks. Keep your BTC in self-custody before block 973,728 and you will own ECX under the same keys, for free, whether or not you choose to touch it.

Will it flip Bitcoin?

No. Paul doesn’t claim it will either. He says he intends to keep his BTC, and he recommends you do the same. The main net eCash chain does not exist yet, the rehearsal ran on a thousandth of a percent of Bitcoin’s hashrate, and the market for its coins is informal at best.

The better question is whether eCash will change Bitcoin. That depends on what happens after Halloween. If miners judge withdrawal bundles honestly, sidechains find users, and the chain survives its first attempted theft, Bitcoin will have for the first time real evidence about an upgrade it has argued over since 2015. If it fails, Bitcoin will have learned that cheaply too. Either way, after eleven years of being told his idea was dangerous, Paul will finally have data instead of opinions. I suspect he will say so, loudly, and in a way that annoys all skeptics. I also suspect that most of the time, he will be right.

Scorecard inputs

Sources

ecash.com and its pages Why hard fork, What to expect, How to claim and Coin splitting; ecash-com/fast-facts integration guide; drivechain.info; BIP-300 and BIP-301; truthcoin.info, including “Blockstream’s Big Mistake” (December 2025); ecashblog.com: “eCash ECX Hard Fork 101”, “The eCash Alpha, Days 4 to 15”, “Days 16 to 28”, “Two Bitcoin Forks, Two Philosophies”, and posts on Photon, Truthcoin and CoinShift; eCash Alpha explorer; mempool.space for fork-anchor hashes; Peter Todd, “Drivechains: A Detailed Analysis” (October 2023); CoinDesk on the LayerTwo Labs seed round (December 2022) and the Patoshi reassignment (April 2026); Bitcoin.com News on the announcement and the three-stage launch; CryptoSlate on the Alpha and exchange notices (August 2026); Because Bitcoin on the Patoshi debate; Bitrue on ECX scam warnings; Bitcoin Takeover Podcast S15 E68 and S17 E21 (Paul Sztorc), S17 E19 (Amaury Séchet), S17 E26 (Calin Culianu and Steve Thurmond).

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

How Luke Dashjr’s anti-spam soft fork won 2.53 percent of the hashrate, died in eight blocks, came back with a new proof of work chosen by lottery, and now wants to lock its own miners’ rewards for 45 days

In May, eight hours into my Bitcoin Cash marathon with Calin Culianu and Steve Thurmond (S17 E26), the conversation drifted toward Luke Dashjr. Someone asked whether I agreed with the fork he was threatening to unleash. I said I didn’t: “If you want to fork off, at least add something that’s technologically interesting. He’s going backwards.” I even added the detail that made the room laugh: “He wants 333 kilobytes.” Calin, who maintains Bitcoin Cash Node, was less polite. “I can fork Bitcoin Core tomorrow. It’s not that hard. It’s like 95 percent the same code anyway.”

Three months later Luke forked Bitcoin, and the blocks on his chain are capped at about 300 kilobytes. I had been wrong about one thing: the fork does contain something technologically interesting. It just arrived wrapped in the strangest governance I have covered in this magazine. The new proof-of-work algorithm was picked by lottery, where the last hex digits of Testnet4 blocks sealed the project’s fate. Activation required a New York Post headline in the coinbase: ”blake2b_headline=8-30 NYPost Deride and Conquer”. Its developers call the chain they left “Spamcoin” and the exchanges that list it “incompetent.” Now the fork is going after its own miners.

Of every chain in this issue, this is the youngest and the most volatile, and it may prove the most short-lived. It is also the only one that began as an attempt to make Bitcoin smaller and less scalable. Which is ironic, as so-called Bitcoin maximalists are trying to minimize the design.

Vital statistics

Snapshot data from 17 to 21 September 2026. This chain changes weekly, so read every figure with its date.

BIP-110: the soft fork that wanted a smaller Bitcoin

The story begins with a grievance that has nothing to do with block size, at least on its surface. Since the Ordinals wave of 2023, a vocal part of Bitcoin’s community has regarded inscriptions, large OP_RETURN outputs, and other non-monetary data as spam that burdens node operators and crowds out payments. Bitcoin Core disagreed, and in 2025 it went the other way, loosening its OP_RETURN policy. Bitcoin Knots, the alternative client Luke Dashjr has maintained for over a decade, became the home of the opposition.

Kurt Wuckert Jr told me on S17 E39 that his own political awakening came from the same wound, from the other direction. Around 2014 his OP_RETURN tokenization prototype stopped working when Core cut the data carrier size, and his first reaction was to go looking for who this Luke Dashjr person was. A decade later, the anti-data camp and the pro-data camp were both still fighting over the same 80 bytes.

BIP-110, the “Reduced Data Temporary Softfork,” was written by Dathon Ohm and credits Luke for the original draft. For about a year, it would have limited new output scripts to 34 bytes (OP_RETURN to 83), capped data pushes at 256 bytes, banned the Taproot annex, deep control blocks, OP_SUCCESS opcodes and OP_IF inside Tapscript, and grandfathered all existing coins. Activation needed 55 percent of miners signaling on bit 4. If they refused, Knots nodes would begin rejecting every block that did not signal at height 961,632.

They refused. Signaling peaked at 2.53 percent. On 8 August the mandatory period began, Knots nodes rejected the next block the majority mined, and the chain split. More than 99 percent of hashrate stayed on Bitcoin.

The minority chain inherited Bitcoin’s full difficulty, which meant it needed roughly Bitcoin’s hashrate to produce a block every ten minutes. It produced two blocks in eight hours and then almost nothing: the Roughnecks pool mined four in the first week, then single blocks arrived on 17, 21, 23 and 28 August.

The last, tagged OCEAN, came from the pool Luke co-founded, which had pointed its customers’ hashrate at the minority chain for about 18 hours without clear consent. OCEAN’s hashrate fell 96 percent in August. Its customers demanded new leadership, and on 29 August Luke resigned as chairman, CTO and director, with OCEAN buying back his equity.

The stalled chain also had no replay protection. By mid-August more than 400,000 transactions were sitting in its mempool, most of them ordinary Bitcoin transactions that users had broadcast without realizing they were valid on both chains.

Bitcoin’s developers moved faster than its miners. On 9 August Mark “Murch” Erhardt filed a motion to remove Luke as a BIP editor, citing his central role in “a new forkcoin spun out of Bitcoin under his leadership.” The other editors approved it within days. Luke’s reply: “They have no authority to do so.” The official BIP-110 document was marked Closed “following a chain split with stalled mining.” The advocacy site bip110.org, meanwhile, still says BIP-110 “has been activated at the block height 961632 on 8 August 2026 successfully.” Both statements are technically true, which tells you everything about how this fork uses language.

The lottery, the headline and the rehearsal

A chain that cannot attract SHA-256 miners has one way out: stop needing them. On 10 August, at a Bitcoin Knots development meeting on the project’s official Discord, supporters divided up the work. Luke took the new block header and proof of work. A developer known as Kyle took replay protection. Chris Guida, who had already updated a proof-of-work change plan Luke wrote in 2017, took the job of carrying BIP-110’s rules into the new chain.

The algorithm itself was chosen by lottery. On 11 August Knots ran a commit-reveal process on Testnet4 to pick among six candidates: BLAKE2b-256, SHA3x, BLAKE2s, Scrypt, BLAKE3x2 and Eaglesong. BLAKE2b won the next day. The choice mattered, because BLAKE2b is the algorithm of Siacoin, which means a secondhand market of ASICs (Bitmain’s Antminer A3, Goldshell’s SC5 and SC Lite) already existed.

Peter Todd accused Luke of choosing Testnet4 for the draw because its blocks are easy to manipulate, and pointed out that people close to the fork, such as the account @BitcoinSith, showed off freshly acquired BLAKE2b machines barely a week later, when delivery normally takes two to three weeks. That is Todd’s allegation, not a finding, but it is the kind of question a proof of work chosen by dice invites.

Then came the rehearsal. On 29 August Luke asked the remaining SHA-256 miners to stop, and release candidate rc4 was set to mark the last SHA-256 block. On 30 August he published the parameter that would seal activation: blake2b_headline=8-30 NYPost Deride And Conquer. The first BLAKE2b block had to carry that day’s New York Post headline in its coinbase, echoing the Times headline Satoshi placed in Bitcoin’s genesis block. SilentWave mined it at 06:14 UTC. Within two hours SilentWave, PyBLOCK, Helios, PythonPool, TrueNorth, Connor’s Lab and a solo miner had produced fourteen more, each just under the new 800,000 weight unit cap. The rehearsal became the launch, and the final Knots release followed on 2 September.

What changed at the fork

The BLAKE2b hard fork is not BIP-110. The project’s own FAQ says so, and the distinction matters: BIP-110 was a temporary soft fork; this is a permanent new chain.

1. A new proof of work. BLAKE2b replaces SHA-256d from block 961,640. Every Bitcoin ASIC in the world became useless on this chain overnight.
2. A 164-byte header. Bitcoin’s header is 80 bytes. The new one adds the block height, a transaction count, larger nonce fields, ASIC profiles, time-offset data, an XOR key and a field reserved for merge mining.
3. A transaction-count commitment. Committing to the number of transactions in the header closes the Merkle tree ambiguity behind CVE-2017-12842, a fix Bitcoin Cash already has and Bitcoin still lacks.
4. Block-withholding protection. A pool can hash with a secret XOR key so its workers cannot tell when they have found a valid block and quietly withhold it.
5. Opt-in replay protection. SIGHASH_UNIFIED (bit 0x20) commits to every input amount and works across legacy, SegWit and Taproot inputs. It only protects users who choose it; ordinary signatures remain valid on both chains.
6. The reduced-data rules. BIP-110’s restrictions apply until the parent block’s median time passes 1 September 2027, alongside a block weight cap of 800,000 units, about 300 kB. Luke has wanted smaller blocks since at least 2017, when he proposed cutting Bitcoin’s base block to 300 kB. He now has them.
7. A low starting difficulty. The initial target was set for roughly 218 TH/s. Because far more BLAKE2b hashrate arrived than that, blocks came in seconds until the 2,016-block retarget caught up, four times harder at each step. That is why this chain is now thousands of blocks ahead of Bitcoin.

Addresses, keys, ports and the network magic were not changed. A BTCB2 address looks exactly like a Bitcoin address, so exchanges have to identify the chain by its fork-anchor hashes, not by appearance.

Timeline

Where it trades

No major exchange lists the coin, and neither CoinGecko nor CoinMarketCap tracks it. Everything that exists trades on three small venues, each under a different name.

A naive calculation (20 million coins times $300) produces a market cap of about USD 6 billion. It is meaningless. A handful of order books with six-figure daily volume cannot price 20 million coins, most of which have never moved since the split and belong to people who do not know or care that they own them.

Neoxa’s own debut was chaotic. A pro-BIP-110 website published a warning that it was “a high-risk, unverified custodial exchange,” and Neoxa’s staff answered by threatening to delist the coin over the controversy. Within a week it was the fork’s main market.

The war with the exchanges

Every fork in this magazine eventually fights about its name. This one fought about its name before it had a price.

Luke’s position is that nothing was forked away from Bitcoin at all. “There’s no reason for Bitcoin to change its name,” he wrote in August, and he has since published a timeline of Bitcoin’s history in which the majority chain becomes “Spamcoin” from 8 August 2026. On X he argues that the BTC ticker has belonged to Bitcoin for over a decade, and Bitcoin has now moved to BLAKE2b.

When Swan co-founder Yan Pritzker asked whether he really believed exchanges don’t run their own nodes, Luke answered that competent operators would never have listed the SHA-256 chain: “If they did, they wouldn’t be selling fake bitcoins now. Unless you’re saying it’s intentional fraud.” Chris Guida has told supporters to avoid KYC exchanges entirely and acquire the coin through goods and services.

The exchanges were unmoved. Not one venue agreed to list the fork as BTC. Neoxa’s explanation was simple: “We didn’t use BTC because we already have a BTC ticker on the exchange.”

Instead it used XBT, the ISO 4217-style code Kraken and much of the institutional world have used for bitcoin for years. That produced its own backlash. “XBT is the ISO-compliant currency code for Bitcoin,” wrote Coinjoined Chris of Seedor and Bitsurance fame.

“Blake Bitcoin is not Bitcoin is not XBT.” Neoxa replied that “projects choose tickers,” that the team had asked for XBT, and that it had done its due diligence and “there was nothing illegal about calling it XBT.” The project also uses an old version of the Bitcoin logo.

So the same asset now answers to BTCB2, XBT, BIP110, “Bitcoin BLAKE2b,” “Bitcoin BIP110” and, according to its founder, BTC. That is not a branding problem, but an outright operational hazard: the addresses are identical to Bitcoin’s, and the ticker on at least one exchange is a synonym for Bitcoin’s own.

The war with its own miners

The fork’s founding complaint was that Bitcoin’s miners refused to enforce rules its users wanted. Its first month showed that the complaint travels.

In the vocabulary of this camp, a miner is whoever builds the block template, meaning chooses the transactions. Someone who points an ASIC at a pool and hashes whatever the pool hands them is not really mining. They are “blind hashing.” This is why the fork’s mining stack is built around DATUM, the OCEAN-developed protocol that lets individual miners build their own templates, and why several pools now subsidize it. Lazarus Pool raised its public stratum fee from 15 to 25 percent from block 973,750, giving half of the increase to miners who run their own DATUM gateway.

On 8 September one pool, Alphapool, briefly controlled more than half of the fork’s hashrate. On the Knots Discord, supporters argued over whether that was an attack or just miners chasing cheap blocks. Some told Alphapool on X to “stop mining.” A proposal appeared on GitHub to blacklist Alphapool’s payout address at the consensus level, which would have made its blocks invalid.

Luke labeled that patch “DO NOT RUN THIS CODE.” Alphapool, bewildered, wrote: “Never in all my years have I seen submitting hashrate and securing a blockchain protocol in and of itself perceived as a ‘hostile attack.’” In the same Discord it promised to cap itself at 30 percent of network hashrate and refuse new connections above that. By the afternoon it had fallen below 18 percent.

Luke’s own answer was more structural. On 15 September he opened Knots PR #419, “Long coinbase maturity,” a temporary soft fork merged on 21 September. On Bitcoin a miner can spend a block reward after 100 confirmations. On this chain, rewards mined between blocks 973,440 and 979,920 cannot be spent for 6,480 blocks, about 45 days.

Node policy keeps the long-maturity check for relay even after the window ends. The release notes accuse some operators of blind hashing, and describe the change as the first of three phases against pool concentration. Later phases, according to the project’s own material, could stretch maturity to a full year, and blocks produced by “non-miners” would forfeit their rewards if the network reaches consensus.

The logic is coherent on its own terms. A hashrate renter who has to wait 45 days, or a year, to sell is exposed to the coin’s price for that entire time, which makes a hit-and-run attack less attractive. It also makes mining this chain a long position that nobody can hedge, on a coin that fell 84 percent in two weeks.

One irony was pointed out during code review. On 18 September a reviewer warned that nodes running the new maturity rule without the backing of most hashrate could end up isolated on an accidental fork. That is a fair description of what happened to BIP-110 on 8 August.

Governance by Discord

For a movement that exists because it believes Bitcoin Core makes decisions without real consensus, the fork’s own decision-making has been unusually informal. The work plan was divided in a Discord meeting. The proof of work was drawn by lottery. The activation block was defined by a newspaper headline posted on X. The response to a dominant pool was debated in Discord, and the pool’s promise to limit itself was made in Discord too. The planned rule under which “non-miners” lose their rewards applies only “if the network reaches consensus,” and I could find no public document explaining how that consensus will be measured, who counts as a non-miner, or who decides.

This is not unusual for a chain six weeks old. It is unusual for a chain whose founders call the other side “centrally managed.”

How it differs from Bitcoin today

On consensus. The two chains share every block up until 961,631. After that, this chain has a different proof of work, a different header, temporary data restrictions, a 300 kB block cap, opt-in unified signatures and, from 22 September, a 45-day coinbase lock. Its script system is otherwise Bitcoin’s, including SegWit and Taproot, but with Taproot’s extension points switched off during the reduced-data window.

On scaling philosophy. Every other fork in this issue wanted more room: Bitcoin Cash, Bitcoin SV and eCash with bigger blocks, Bitcoin Gold with fairer mining. This is the first to want less. Blocks are a third the size of Bitcoin’s base block, and the explicit goal is block space for money only. Tip blocks I have observed so far carry anywhere from a dozen to a little over a thousand transactions.

On security. Changing the proof of work did what it was supposed to do: Bitcoin’s ASIC fleet can no longer attack this chain, or support it. The fork is now defended by roughly 17 PH/s of BLAKE2b, a figure that means little to anyone outside the Siacoin market, and by a pool ecosystem in which one operator could, and briefly did, command a majority. The 45-day maturity is the fork’s answer to rented hashrate. Bitcoin Gold’s experience in this magazine suggests that exchanges will also demand very deep confirmations.

On decentralization. One client, Knots, maintained by the person who designed the fork, chose its algorithm, announced its activation string and wrote its maturity rule. The miner base is new, enthusiastic and concentrated. The project’s answer is DATUM: many small miners building their own templates. Whether that holds when the coin is worth less than the electricity is the next test.

On adoption. Three small exchanges, three tickers, no aggregator listing, and no wallet support beyond Knots itself and a few community projects. The fork’s leaders are openly hostile to the exchanges that would normally bring liquidity, and those exchanges have shown no interest in coming.

Who is who

The fork

• Luke Dashjr, maintainer of Bitcoin Knots and one of Bitcoin’s earliest contributors. Credited on BIP-110, author of the BLAKE2b header, the activation headline and the coinbase maturity rule. Removed as a BIP editor and resigned from OCEAN in August; now leads CONVOY Mining. Calls the original majority chain Spamcoin.
• Dathon Ohm, author of the BIP-110 specification.
• Chris Guida, developer who updated the 2017 PoW change plan and ported BIP-110’s rules to the new chain; the most outspoken voice against KYC exchanges.
• Kyle, developer assigned replay protection at the 10 August meeting.
• Loogart, supporter whose X exchange with David Schwartz became the fork’s most quoted defense: “We accepted that we lost the attempt to fix the legacy chain, so we continued Bitcoin elsewhere.”
• SilentWave, miner of the first BLAKE2b block.
• Alphapool, the largest pool by hashrate, briefly above 50 percent; now self-capped at 30 percent.
• Lazarus, PyBLOCK, Mycology, Pow.re, XorPool, Blockvase and others, the 27-odd pools and solo miners of the first month.
• Neoxa, the exchange that listed the coin first and renamed it XBT.

The other side

• Bitcoin Core and the BIP editors, led in this episode by Mark “Murch” Erhardt, who filed the motion to remove Luke.
• OCEAN, the pool Luke co-founded, which lost 96 percent of its hashrate after sending customers’ work to the minority chain.
• Adam Back, Blockstream CEO: BIP-110 was “idiocracy” in July, and after the split, “Live by the fork, die by the fork.”
• David Schwartz, Ripple’s former CTO, to Loogart: “You switched from participating in governance to attacking when you refused to accept that you lost.”
• Peter Todd, who accused the PoW lottery of being rigged by incompetence and malice.
• Coinjoined Chris, who led the protest against the XBT ticker.

What Bitcoin BLAKE2b proved

• A user-activated soft fork without miners is a hard fork with extra steps. At 2.53 percent support, mandatory signaling did not enforce anything on Bitcoin. It created a second chain and stranded its users’ transactions.
• You can change Bitcoin’s proof of work in three weeks. From the lottery on 11 August to the first BLAKE2b block on 30 August took nineteen days. Whatever else you think of this fork, that was a fast piece of engineering.
• The header can be fixed. The transaction-count commitment and the XOR key address real, known problems in Bitcoin’s design that Core has not addressed.
• Firing the miners doesn’t end the argument with miners. Within six weeks the chain that left Bitcoin over miner power was fighting a dominant pool and drawing up rules to take rewards from “non-miners.”
• The market decides the ticker. No exchange agreed to call this chain BTC, just as no exchange agreed to call Bitcoin Cash or Bitcoin SV by that name.
• Hold your forks. If you held Bitcoin in self-custody on 8 August, you own this coin under your existing keys. Anyone asking for your seed phrase to “claim” it is a thief.

Will it flip Bitcoin?

No. The fork has no aggregator listing, three thin order books under three different names, a hashrate measured in a different unit from Bitcoin’s, a single-client governance model, and a price that fell 84 percent in its first three weeks. It also has something every other fork in this issue lacked at birth: a founder with fifteen years of Bitcoin development behind him and a following that genuinely believes the majority chain has been captured.

The honest verdict comes in two parts. As a claim to be Bitcoin, it is already over; the exchanges have spoken, and so has more than 99 percent of the hashrate. As an experiment, it is barely six weeks old, and the questions it asks are real: whether a small, data-restricted chain can keep miners honest by locking their rewards, and whether template-building miners can replace pool operators. Treat flip talk as advocacy. Watch block 979,920.

Scorecard inputs

Sources

BIP-110 specification and bip110.org; Bitcoin BIP110 technical reference; Bitcoin BLAKE2b FAQ; Bitcoin Knots 29.4.1 release; mempool.guide explorer and mempool.space for fork-anchor hashes; blake2bminer.com block-by-block chronology; awesome-bitcoin-blake; Bitcoin.com News on the revival, the USD 1,799 peak, the XBT ticker and Alphapool fight and the 45-day maturity; Crypto Economy on PR #419; BeInCrypto on OCEAN, Adam Back and the “fake bitcoins” exchange; crypto.news on the 2.53 percent signaling peak and the Schwartz exchange; Observatorio Blockchain on the Discord meeting and PoW lottery; CriptoNoticias on the “Spamcoin” timeline; Odaily on the stalled chain; LeedMiner name map; Lazarus Pool; Jimmy Song on replay and maturity economics; Bitcoin Takeover Podcast S17 E26 (Calin Culianu, Steve Thurmond and guests, May 2026) and S17 E39 (Kurt Wuckert Jr, August 2026).

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

Amaury Séchet built the software that split Bitcoin in 2017, lost the chain he created over an 8 percent developer fund in 2020, and has spent the next six years turning the losing side into the only Bitcoin fork with Avalanche finality and staking rewards. Here is what that experiment has and has not proved.

Halfway through my eight-hour Bitcoin Cash marathon in S17 E26, after Calin Culianu had spent five hours defending the big block cause against every argument Bitcoin maximalists have ever made, I asked him about Amaury Séchet. He did not hold back. “The Greg Maxwell of big blockers,” he called him.

I have interviewed Amaury twice, in S15 E28 and again in S17 E19, and I understand why he stirs that reaction: he is the most consequential developer in the big block story. He wrote the client that forked Bitcoin in August 2017, he led the Bitcoin Cash side through the 2018 hash war against Craig Wright, and in 2020 he tried to make his own team’s funding part of the consensus rules. The rest of Bitcoin Cash refused, and he left with a minority chain that nobody expected to survive. It survived. It is called eCash now, it trades under the ticker XEC, and it has shipped two network upgrades a year ever since.

This article is about the new big blocker chain: what it changed, how it pays for itself, and whether an overlay of staked coins can really do the job that hashrate does on Bitcoin.

Vital statistics

Market figures are a snapshot from 17 September 2026. They will be stale by the time you read this, so treat them as a sense of scale.

Three forks, one founder

Every big block article in this magazine eventually runs into Amaury. The Bitcoin Cash article covers 2017, when the big block camp left Bitcoin. The Bitcoin SV article covers 2018, when nChain left Bitcoin Cash. This one covers 2020, when Bitcoin Cash pushed away the man who had written the software for both of the previous fights.

Bitcoin ABC was built for a single purpose. In S15 E28 Amaury told me that the original plan was more modest: “the original proposal was to implement the extension block. But then, when it didn’t work… [we] started implementing the BCH fork. And this is how Bitcoin ABC happened.” In the three years that followed he became the dominant voice in Bitcoin Cash development. Kurt Wuckert Jr, who fought against him in the 2018 hash war, remembers the reputation he had then: “at the time Amaury was very much the, oh no, he’s the genius in the room.”

The same qualities that made him effective made him hard to work with. His Twitter bio called him Bitcoin ABC’s “benevolent dictator,” and eCash’s own blog has used the title without irony. Two years later that title would decide the whole dispute.

The 8 percent

In August 2020 Amaury announced that Bitcoin ABC’s November upgrade would include a new consensus rule, the Coinbase Rule. Every block would have to send 8 percent of its reward to an address controlled by Bitcoin ABC. The idea was called the Infrastructure Funding Plan, or IFP. Any miner who did not pay would have their blocks rejected by ABC nodes.

His argument is one I take seriously, and eCash still makes it on its funding policy page. Open source money has never solved its funding problem. OpenSSL protected most of the internet’s traffic with one full-time developer until the Heartbleed bug in 2014. Bitcoin’s answer was Blockstream, which took venture capital from the same financial institutions Bitcoin was supposed to route around. Donations do not pay for senior cryptographers. If a protocol wants professional engineering, the cleanest place to fund it from is the protocol itself.

The rest of Bitcoin Cash did not hear a funding argument. They heard a tax. Calin’s account in S17 E26 is the sharpest I have recorded: Amaury “announced at the eleventh hour that the consensus rules would send 8 percent of the block subsidy to his own wallet,” with no community process. “We quickly scrambled to form another dev team, told all the miners which software to install, and he got the boot.”

Marc De Mesel, who funded Bitcoin Cash development out of his own pocket after the split, gave me the most balanced version in S17 E44. He does not like calling it a dev tax. Dash pioneered the treasury model, Zcash runs a version of it, and he considers the idea genuinely smart. His objection was the implementation.

The money went to an address Amaury controlled, Amaury decided how it was spent, and that clashed with the Bitcoin tradition in which development was always paid for by voluntary contribution. Marc believes that funding a project ruled with that hard a hand would have killed Bitcoin Cash faster than the market could. The community’s answer was Flipstarter, a non-custodial crowdfunding tool in which the money moves only once a campaign reaches its goal.

On 15 November 2020 the new client, Bitcoin Cash Node, shipped the scheduled upgrade without the Coinbase Rule. Most hashrate and every major exchange went with it. From block 661,648 the two chains went separate ways. The majority kept the BCH ticker. The chain enforcing the 8 percent traded as BCHA, Bitcoin Cash ABC, wherever an exchange bothered to list it.

Amaury, for his part, said he would not fight for the name. “No. Such fighting is ultimately destructive for both parties, no matter who wins,” he told Nicole Grinstead around the time of the split. In the eCash interview that followed he described leaving in almost parental terms: “It is always difficult to let your child go, but in this case, there is nothing more I can do to save this child. It has chosen its path.”

Both sides paid for it. Marc counts it as the second of the two splits that broke Bitcoin Cash. BSV took one faction in 2018 and ABC took another in 2020, and each departure cost the community people it could not replace. Several of the Bitcoin Cash developers I spoke to said this was the split that made them walk away for a while.

A million to one

On 1 July 2021 Bitcoin ABC did something no fork had tried before. It renamed the coin eCash, changed the ticker to XEC and the address prefix to ecash:, and moved the decimal point six places. One BCHA became one million XEC.

Nothing changed on the blockchain. According to the project’s own rebrand page there was no token swap and no new chain. The unit you see in your wallet was renamed from BCHA to “bits,” with two decimal places. One XEC is exactly 100 satoshis. Binance and the other exchanges converted balances on their own books, and no coin moved.

Amaury was open about the reasoning. “No other money has eight decimal places. Why should crypto? Cryptocurrencies with a lower unit price also enjoy higher bull market appreciation. Because the eCash team is incentivized by both tech and price improvement, this improvement was a no-brainer.” On relaunch day BCHA ranked 217th by market cap at about $587 million. Bitcoin Cash ranked 12th at $9.2 billion.

The logic is plain once you see it. A coin priced at fractions of a cent, with two decimals, looks like cash. A coin called Bitcoin Cash ABC looks like the side that lost an argument about Bitcoin Cash.

What actually forked

At first, there wasn’t much of a difference. Both chains activated the same November 2020 upgrade, including Jonathan Toomim’s ASERT difficulty algorithm. Everything Bitcoin Cash had at that point stayed on both chains: CTOR, Schnorr signatures, OP_CHECKDATASIG and a 32 MB block limit. Only three things differed:

1. The Coinbase Rule. ABC nodes rejected any block that did not pay 8 percent to the fund. BCHN nodes rejected any block that did. That was the entire fork.
2. No new replay protection. Both chains kept the SIGHASH_FORKID scheme from 2017, so a transaction was often valid on both. Users and exchanges separated their coins by spending them in ways that only one chain would accept, just as they had after the 2018 split.
3. The same software lineage. Bitcoin ABC stayed a Bitcoin Cash client, until it began adding the features that would make it something else.

Those features came later, and Bitcoin Cash never followed them.

Six years of upgrades

eCash upgrades on 15 May and 15 November, the schedule Bitcoin Cash set in 2017.

Pay attention to the November 2023 row. The fork was about 8 percent. Three years later, 42 percent of every block goes to someone other than the miner. Sixteen percent goes to Bitcoin ABC, 16 percent to the Global Network Council, which funds ecosystem projects, and 10 percent to stakers.

Avalanche, and what it isn’t

eCash’s Avalanche is not AVAX. Both are based on the consensus protocol from the 2018 Avalanche whitepaper by the pseudonymous Team Rocket. The Bitcoin ABC team built its own version from scratch, and it shares no validators, token or network with Ava Labs’ chain. The project repeats this in almost every announcement because exchanges and journalists still confuse the two.

Miners still produce every block with proof of work. Avalanche is a voting layer that sits on top. Any node that has proven a stake of at least 100 million XEC can join, and those nodes repeatedly poll each other about which blocks and which transactions they accept. Once enough of them agree, the decision is final and no longer reversible, however much hashrate an attacker brings later. eCash calls this Avalanche-enhanced proof of work. Critics call it proof of stake bolted onto a Bitcoin fork. Both descriptions are accurate, and the security model depends on both halves.

There is one piece of history the eCash literature leaves out. Kurt Wuckert Jr remembers Amaury pitching Avalanche pre-consensus to Bitcoin Cash during the 2018 hash war, and he reads it as provocation: “I think they were designed specifically to trigger Craig. As soon as the chain split, those conversations went away.” Bitcoin Cash never adopted it. When I asked its developers why, they said they were exploring a proposal called Sunlight “without a proof-of-stake component.” The idea Amaury raised in 2018 shipped seven years later, on the one chain where he had the final say.

When Pre-Consensus went live, Amaury called it “a milestone not just for eCash, but for digital cash technology in general.” In a narrow sense he is right. No other chain in this magazine finalizes a payment in seconds without a second layer.

The funding policy today

Since May 2023 the development fund has not been a consensus rule. It is a miner policy, and the Avalanche layer enforces it by refusing to finalize blocks that break the policy. eCash presents this as flexibility. In its own words, network participants “can collectively change addresses, increase or reduce amounts, and even remove the funding model entirely by changing just a few lines of code in the node software.”

Read that sentence twice. The recipients can change and the funding can be removed, but only through software written by Bitcoin ABC, which is itself one of the recipients, and only through the votes of a staking quorum dominated by the largest holders. Supporters see governance without chain splits, which Bitcoin Cash never achieved. Critics see a development team that has built itself a salary, and the rules that protect it. Both are describing the same mechanism.

How ECX differs from Bitcoin today

Consensus. eCash shares Bitcoin’s blocks to 478,558 and Bitcoin Cash’s to 661,647. After that it looks like a late-2020 Bitcoin Cash chain with three large additions: a four-way block reward, an Avalanche finality layer, and a display unit that turns one coin into a million. It has no SegWit, no Taproot, no Lightning and no CashTokens. Its tokens, called eTokens, live in OP_RETURN data that Chronik indexes rather than in consensus. A “postage” feature lets a sponsor pay the XEC fee so a token user never has to hold XEC.

Scaling. Bitcoin Cash’s answer to Bitcoin is bigger blocks. eCash’s answer is bigger blocks plus faster finality. The published roadmap promises growth from about 100 to 5 million transactions per second through subnets, including a planned EVM subnet and a zero-knowledge privacy subnet. That is still an ambition. Actual traffic fills a small fraction of a 32 MB block.

Security. At 0.005 percent of Bitcoin’s difficulty, about 47 petahashes, eCash’s proof of work alone would be cheap to rent and attack. The project argues that it no longer matters. To reverse a finalized block, it says, an attacker needs a hashrate majority and about seven eighths of the stake, which must also sit unmoved for two weeks. That is a real barrier, but it is smaller than the marketing suggests. At September 2026 prices, 350 billion staked XEC is worth about $2.5 million, or roughly 1.7 percent of the supply. A chain secured by its own coin is only as secure as that coin is valuable, and its stake is worth less than a modest mining farm.

Decentralization. There is one client, Bitcoin ABC, written by a team that receives 16 percent of every block. The entry ticket to staking is 100 million XEC, about $714. That is cheap, but in practice the quorum is small: the project counted 94 staking nodes in 2024. And the funding policy can be changed by the software of the team that benefits from it.

Adoption. eCash’s most concrete achievement is a boring one, and it is real. XEC is listed on Binance, Upbit, Bithumb, HTX and CoinEx. A growing list of exchanges, tracked at scorecard.cash, credits deposits after one confirmation because they trust Avalanche finality. Korbit cut its requirement from thirteen confirmations to one. The Cashtab wallet, the PayButton merchant tool (1,311 transactions on its best day), the Agora token market and eCashChat are all maintained and all work. Whether anyone uses them as money rather than as demonstrations is the same question every chain in this issue faces. With a few million dollars in daily trading volume, eCash’s answer so far is: not many people yet.

Amaury on Bitcoin, six years later

What stays with me from S17 E19 is not only a series of statements about eCash. It is how alarmed Amaury is about what Bitcoin has become. For years he was the man small blockers accused of wanting to change the rules. Now he watches Bitcoin developers seriously debate freezing Satoshi’s coins to defend against quantum computers:

“We went from, like, not even that is possible, this stuff is sacred code… to, well, we’re going to freeze Satoshi’s coins. Which I find to be a staggering change. Ten years ago people would laugh in your face. But now apparently it is on the table, and that scares me much more than a quantum computer at this point.”

When I asked what he would work on if eCash did not exist, the answer surprised me: “Aside from eCash, I probably would have to join Paul [Sztorc] and work on Drivechain.” Nine years after leaving Bitcoin, the man who forked it would still rather extend it than abandon it.

The name problem

A disclosure first: LayerTwo Labs sponsors this magazine. In August 2026 it launched its own hard fork of Bitcoin, Paul Sztorc’s chain with BIP 300 drivechains built in, and named it eCash. When I asked the Bitcoin Cash developers about it, Steve Thurmond called it “a dick move,” a self-inflicted wound before the fight had even begun, and mentioned “murmurs of litigation.” Calin reduced the whole dispute to a line of Python: "ecash" == "ecash" is true, while "bitcoin" == "bitcoin cash" is false. Bitcoin Cash, he pointed out, at least renamed itself on day two.

Then he aimed a parting shot at his old colleague: “It’s the punishment that comes to Amaury. He deserves it.” I said it more gently on air. A man who forked Bitcoin as the real Bitcoin, then launched eCash, is now watching someone fork Bitcoin as the real eCash.

The word predates all of them. David Chaum’s DigiCash sold a product called eCash in the 1990s: private but centralized, exactly the design Bitcoin set out to improve on. Cashu and Fedimint call their Lightning-backed tokens ecash. XEC chose a generic word in 2021 on the grounds that nobody owns a generic word, and in 2026 it is on the receiving end of the same argument. Four things are now called eCash. Check the ticker before the name.

Who is who

Bitcoin ABC and eCash

• Amaury Séchet (“deadalnix”), former Facebook engineer, founder of Bitcoin ABC, author of the 2017 fork that created Bitcoin Cash and of the 2020 Coinbase Rule. Still eCash’s founder and public face; he announced Pre-Consensus at the Electronic Cash Conference in Barcelona in October 2025.
• Antony Zegers, CEO of Bitcoin ABC since 2020.
• Fabcien, lead developer of the Bitcoin ABC node.
• Joey King, lead developer of the Cashtab wallet.
• PiRK, maintainer of the node and its tooling.
• David Klakurka, strategy; his company Blockchain Ventures runs PayButton and Coin Dance.
• The Global Network Council, which gives out the 16 percent ecosystem share of every block.

The other side of the split

• freetrader, pseudonymous lead maintainer of Bitcoin Cash Node, the client assembled in weeks to ship the November 2020 upgrade without the Coinbase Rule.
• Calin Culianu, Bitcoin Cash Node developer, who worked alongside Amaury for years and remains his sharpest critic.
• Marc De Mesel, the investor who funded Bitcoin Cash development after the split and who likes the treasury idea but opposed who controlled the money.
• Jonathan Toomim, whose ASERT algorithm both chains activated on the day they parted.
• The exchanges, which gave BCH to the majority chain in 2020 and quietly converted BCHA to XEC at a million to one in 2021.

The namesakes: David Chaum’s eCash (1990s), Cashu and Fedimint ecash (2020s), and LayerTwo Labs’ eCash (2026).

What eCash proved

• A minority chain can outlive losing its ticker. Bitcoin ABC lost the BCH name, most of the hashrate and most of the community, and six years later it still ships two upgrades a year. Bitcoin SV showed in 2018 that a chain could survive losing the argument. eCash showed in 2020 that it could survive losing the name.
• A rebrand can happen entirely in the display layer. No swap, no new chain, no migration: a million-to-one redenomination that exchanges carried out on their own books.
• Protocol-funded development pays the bills, at a cost. The team has stayed funded through two bear markets without venture capital. In exchange, 42 percent of every block goes somewhere other than the miner, and the recipients write the software that decides where it goes.
• Fast finality on a proof-of-work chain is possible. Pre-Consensus has been live since November 2025, and exchanges rely on it. Whether a staked voting layer belongs in anything called Bitcoin is a fair question, and it remains open.
• Staking security is only as strong as the stake’s market value. About $2.5 million of XEC stands between an attacker and a finalized block. That is more than zero, and far less than the word “secure” suggests.
• Hold your forks. Anyone who held Bitcoin Cash on 15 November 2020 now holds a million XEC per coin, and it cost them nothing.

Will it flip Bitcoin?

No. eCash is worth 0.0094 percent of Bitcoin’s market value, has 0.005 percent of its difficulty, and is a thirtieth the size of its own parent. It is not on a path to overtake Bitcoin Cash, let alone Bitcoin, and its own marketing doesn’t claim otherwise in numbers.

What eCash can claim is narrower and worth saying precisely. It is the only chain descended from Bitcoin that finalizes payments in seconds without a second layer, and it has paid for its own engineering without a venture round or a treasury built from a premine. The price is a block reward shared four ways and a security budget that depends mostly on the value of the coin it secures. The market’s verdict so far is a ranking in the low two hundreds. The accomplishment is that the losing side of the 2020 split is still here, still shipping upgrades, and still arguing.

Scorecard inputs

Sources

Bitcoin ABC, “BCHA has been rebranded to eCash” (bitcoinabc.org/bcha) and May 2026 upgrade notice; e.cash blog posts “Avalanche Post-Consensus on eCash” (September 2022), “One Month of eCash Staking Rewards” (December 2023), “eCash Year in Review 2023,” “eCash Day 2024,” “Avalanche Pre-Consensus Launches on eCash” (November 2025), “eCash Year in Review 2025,” “eCash Day 2026,” “The Infrastructure Funding Policy” (August 2025), “Bitcoin ABC Rebrands to eCash” (2021) and “Interview with Amaury Sechet, Financial Freedom Fighter”; e.cash/staking; Nicole Grinstead, “Amaury Séchet on Evolution, Governance & Religion” (Medium, 2020); Cointelegraph on the July 2021 rebrand; CoinGecko and CoinMarketCap eCash pages, 17 September 2026; Coin Dance eCash statistics; mempool.space; Decrypt, CoinDesk and Bitcoin.com News on 15 November 2020; Bitcoin Takeover Podcast S15 E28 and S17 E19 (Amaury Séchet), S17 E26 (Calin Culianu, Steve Thurmond and the Bitcoin Cash developers), S17 E39 (Kurt Wuckert Jr), S17 E44 (Marc De Mesel) and S16 E13 (Corbin Fraser).

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

The 2017 fork that tried to take mining back from the ASIC factories, got robbed three times for its trouble, and now exists twice

When Kurt Wuckert Jr and I spent three hours and forty minutes on the history of Bitcoin’s forks, Bitcoin Gold came up once, in half a sentence, as a chain on a family-tree chart that “was not so prominent.” That is roughly its standing across the whole industry. Bitcoin Cash has a constituency and Bitcoin SV has a villain; Bitcoin Gold has an anniversary.

Yet it was, for a few weeks in late 2017, the fifth largest cryptocurrency in the world, and it remains the first fork in this issue that changed the thing Bitcoin’s other schisms never touched: the proof of work itself. If it weren’t for Luke-jr’s experiment with Blake2b, Bitcoin Gold would have retained the title of being the only UTXO fork of Bitcoin to ”fire the miners”.

I did not interview anyone from the Bitcoin Gold team for this article, and by the end of it you will understand why that was difficult. The project currently has two websites, two founders’ factions and, depending on whom you believe, either one chain or a chain and a token. What follows is reconstructed from block explorers, the project’s own GitHub, court-of-public-opinion documents on both sides, and the reporting of the three occasions on which someone rented enough graphics cards to rewrite its history.

Vital statistics

Market figures are a snapshot from 17 September 2026. For a coin this thinly traded, treat them as an order of magnitude.

Why it split: the politics

Bitcoin Gold belongs to a different genre from the two chains before it in this issue. Bitcoin Cash and Bitcoin SV were civil wars, fought by people who had shared a chain and could no longer share a rulebook. Bitcoin Gold was a product of the autumn of 2017, when the success of the Bitcoin Cash airdrop taught the market that any snapshot of Bitcoin’s ledger could be sold as free money, and a dozen projects rushed to take one. Most of them (Bitcoin Diamond, Super Bitcoin, Bitcoin God, and so on) are footnotes. Bitcoin Gold survived because it attached itself to a genuine grievance.

The grievance was ASICs. By 2017 SHA-256 mining had consolidated into a few manufacturers, chiefly Bitmain, and a few pools, most of them Chinese, and the scaling war had shown that those miners had opinions and votes. The Bitcoin Gold pitch was to swap SHA-256 for Equihash, the memory-intensive algorithm Zcash used, which at the time ran best on consumer graphics cards. The marketed ideal was simple and catchy: “make Bitcoin decentralized again.” The hashtag was #1CPU1VOTE, a phrase lifted from the whitepaper. This idea was not new; Satoshi’s own writings assumed CPU mining, and every altcoin since Litecoin had tried some version of it. What was new was applying it to Bitcoin’s own ledger.

The irony was noted immediately: the founder and public face, Jack Liao, was the chief executive of LightningASIC, a Hong Kong seller of mining hardware. He assembled a board of six co-founders, most of them pseudonymous at launch, the lead developer among them going by h4x3rotab. The code was not public when the snapshot was announced, which prompted Coinbase and Bittrex to publish warnings that they would not support a coin whose replay protection they could not audit.

The official website was knocked offline by a denial of service attack on fork day. Within a month a fake wallet promoted through the project’s own channels had drained about $3.3 million from users who trusted it. And then there was the endowment: 8,000 blocks mined privately at minimum difficulty before the public launch, producing 100,000 BTG for the project’s multisig.

The team called it a post-mine, insisted it was 0.6 percent of supply, and locked most of it on a three-year vesting schedule. Critics called it a premine and never stopped. BitMEX Research, which tracked the fork’s coin flows, concluded the allocation had damaged the project’s integrity relative to Bitcoin Cash, which had none.

None of this stopped the price. BTG traded above USD 450 within weeks of launch on the strength of the free-airdrop mania that peaked that December. It has never been within a factor of ten of that price since 2018.

What changed at the fork: the technical delta

Bitcoin Gold is the cleanest example in this issue of how to fork Bitcoin without hurting anyone by accident, which makes the security disaster that followed all the more instructive.

1. A new proof of work. Equihash (200,9) replaced SHA-256. The block header was reformatted to match Zcash’s, with a 256-bit nonce, a height field and a solution field, so that existing Zcash mining software worked out of the box. Bitcoin ASICs were useless on the new chain; Bitcoin’s hashrate could not follow, defend or attack it.
2. Full replay protection. Every post-fork transaction signs with SIGHASH_FORKID and fork ID 79, so a BTG transaction is invalid on Bitcoin and vice versa.
3. Unique addresses. BTG addresses begin with G or A, and the Bech32 prefix is btg. Bitcoin Cash did not fix its address confusion until CashAddr in January 2018; Bitcoin SV never did.
4. Per-block difficulty adjustment. Bitcoin retargets every 2,016 blocks. A minority chain with a rentable algorithm cannot afford that, so BTG adjusts every block. This decision saved the chain from stalling and, as we will see, did nothing to save it from anything else.
5. SegWit kept. Where the big blockers rejected SegWit as the reason for their departure, Bitcoin Gold kept it and promised Lightning compatibility. The team announced a Lightning payment on its testnet in 2019. I could find no evidence of a functioning mainnet Lightning network on BTG at any point.

Everything else, block size and subsidy and halving schedule included, was Bitcoin’s.

The roadmap since

Bitcoin Gold’s history is not written in upgrades. It is written in attacks and delistings, with one upgrade in the middle that was a response to the first attack.

The price of ASIC resistance

Here is the argument Bitcoin Gold made, in its own words, in 2018: Zhash “uses more memory than an ASIC can muster, but runs fine on many graphics cards.” Here is what that meant in practice. If the hardware that mines your chain is the same hardware that mines a dozen other chains and sits idle in gaming PCs the world over, then anyone can rent it by the hour. NiceHash exists precisely to let them. And a chain worth a few hundred million dollars with a few gigahashes of Equihash securing it is a chain whose entire hashrate can be rented for less than the value of one exchange deposit.

That is what happened in May 2018. Between 15 and 18 May the network’s hashrate roughly tripled as an unknown party brought rented power to bear, mined a private chain, deposited BTG at exchanges on the public one, withdrew other assets, then released the private chain and erased the deposits. The team published the attacker’s address and begged exchanges to raise their confirmation requirements.

By the time the attacker’s wallet went quiet it held 388,201 BTG, about $18 million at the time. Six weeks later the team hard-forked to Equihash (144,5), a parameter set that needs about 2.5 GB of memory per mining thread, chosen to break compatibility with Bitmain’s newly announced Equihash ASIC and with the shared (200,9) rental market. It did the second, briefly. It could not change the underlying economics.

The Bittrex episode that followed is worth dwelling on because it asked a question no fork had faced before: who pays when a blockchain is attacked? Bittrex had absorbed 12,372 BTG of the losses and told the team that “taking responsibility for your chain” meant reimbursing it, later offering to eat half.

The board refused, arguing that it was “not empowered to make a disbursement from the Endowment for the purpose of covering a private company’s losses from their own security failures,” offered a loan instead, and was delisted on 14 September 2018. Both positions were coherent. A team that had kept a 100,000 BTG war chest for the project’s benefit was a strange team to plead poverty. An exchange that accepted deposits on a minority chain after six confirmations had, in fact, misjudged its own risk.

In January 2020 it happened again, on a smaller scale and with better forensics. James Lovejoy, then at MIT’s Digital Currency Initiative, documented two reorganizations of 14 and 15 blocks on 23 and 24 January that redirected 1,900 and about 5,267 BTG. Using NiceHash’s published prices for Zhash he estimated each reorganization cost about 0.2 BTC, roughly $1,700, and that the attacker recovered about the same in block rewards. In other words, the attack was free if the double spends failed and profitable if they succeeded.

Binance, the counterparty, had been crediting deposits after six confirmations and allowing withdrawals after twelve; it moved to twenty. Lovejoy’s conclusion was that “a confirmation requirement on the order of tens of blocks for BTG is still far too few.” After the Upbit delisting in 2025 the Liao site itself advertised that exchanges by then required 300 confirmations, about two days, which it offered as a reason to leave the chain.

The third attempt, in July 2020, is the one the team counts as a success and its critics count as the end of the pretense. Developers noticed an attacker mining a private chain from 1 July, circulated a client with a hard-coded checkpoint at block 640,650 to exchanges and pools on 2 July… and when the attacker released a 1,300-block chain on 10 July, the honest network ignored it. The chain was saved by a small group of developers deciding which blocks were valid in advance, which is to say by the thing proof of work was designed to make unnecessary. Bitcoin Gold’s website reported 108 reachable nodes that week.

I want to be fair to the argument here, because it is a real one. The team maintained throughout that the attacks were not bugs, that the code was Bitcoin’s code, and that the security of a minority proof-of-work chain is a matter of economics that exchanges must price. All true.

But the founding claim of Bitcoin Gold was that commodity hardware would make mining more decentralized and therefore safer. What it demonstrated instead is that commodity hardware makes hashrate a rental market, and a rental market has no loyalty to the chain that happens to be using it this afternoon. Bitcoin’s ASICs are ugly, concentrated and useless for anything else. That last property turns out to be a security feature.

How it differs from Bitcoin today

On consensus. Bitcoin Gold shares Bitcoin’s history to block 491,406 and its rulebook almost entirely afterward: same 1 MB base and 4 million weight units, same SegWit, same subsidy, same script. What differs is the algorithm miners must hash, the header they solve it in, the fork ID in every signature, plus the letters at the front of every address. It is, of all the forks in this issue, the one that made the least significant changes to the original design.

On scaling philosophy. There is none to speak of. BTG adopted Bitcoin’s position wholesale: small base blocks, SegWit, and Lightning as the eventual answer. The blocks at the tip of the chain in September 2026 typically carry one transaction, the coinbase.

On security. This is the whole story and it is told above. Bitcoin Gold’s security budget is independent of Bitcoin’s, which protects it from the fate Bitcoin Cash and Bitcoin SV theoretically face, a redirection of a fraction of Bitcoin’s ASICs. It is exposed instead to the entire GPU rental market, and it has been exploited three times for a combined loss in the tens of millions of dollars. Since 2020 it has lived with hard-coded checkpoints and 300-confirmation deposit policies, which is to say it is secured by the assumption that nobody bothers to attack.

On decentralization. The team’s 2020 count of 108 reachable nodes is the highest number I could find in the BTG contest. Mining is by definition whoever is renting Zhash at the moment. Governance, since July 2024, is contested between two groups each claiming to be the project.

On adoption. Bitcoin Gold’s last meaningful market was South Korea. In December 2024 Upbit alone was reporting daily BTG volume of about $147 million against a market cap of $226 million, a ratio that tells you the coin was a trading instrument for Korean retail and nothing else. When Upbit flagged it for “transparency of operations and sustainability of the project” and delisted it a month later, the price fell from about $15 to, eventually, under fifty cents. CoinGecko stopped updating its BTG feed in July 2026. When the aggregators stop bothering, the market has spoken.

The two Bitcoin Golds

Which brings us to the strangest chapter, and the reason this article cannot end with a clean verdict.

For six years after Jack Liao left the board in November 2018, Bitcoin Gold was run by the remaining co-founders: Hang Yin as lead developer, Martin Kuvandzhiev on operations, Franco Niebles on design, with Edward Iskra as communications director and the author of most of the project’s public statements. Development slowed to a crawl. The last node release with new features, v0.17.3, shipped in August 2020; a v0.21.3 beta appeared in December 2024 and the explorer I sampled still reports 0.17.3 at the tip. The last roadmap was published in 2019. Hang Yin, for his part, co-founded Phala Network, a privacy-computing project on Polkadot, and announced a partnership between it and BTG in 2021.

Then, according to the BTCGPU wiki and the project’s X account, on 15 July 2024 Liao “stole the domain bitcoingold.org and redirected DNS to his own account.” Every service behind that name went dark for the existing team, which moved to btgofficial.org. Liao’s version, published on a Medium account with leaked WeChat logs, is that after Binance delisted the coin he tried to push a dormant team to do something, anything, and when they would not, he reclaimed the project he had founded. Both accounts agree on the facts: one man took the website, the rest kept the code.

What Liao did with the website is the part I cannot fully verify because the website appears to be down. So I will present Liao’s claims. From April 2024 his site describes a mission to “merge back to Bitcoin.” On 22 January 2025, the day before Upbit’s delisting took effect, it announced a “strategic upgrade” after which balances of the old coin, which it labels BTGO, on cooperating exchanges would be swapped one for one into a new BTG, apparently a Bitcoin-native token of the Ordinals or Runes variety, since the site lists it on Magic Eden, UniSat and OKX’s Bitcoin marketplaces. The pitch: the same security as Bitcoin, “zero inflation,” a stablecoin called USDG with a 70 percent collateral ratio, and a future for GPU miners doing “AI reasoning.” At least one Indian exchange delisted BTG in early 2025 citing a token migration whose plans “were later updated and not supported by offshore crypto exchanges.” Meanwhile the Equihash chain at btgofficial.org continues to produce a block every ten minutes… most of them empty, as if it switched places with Blockstream’s Liquid federation.

So there are two Bitcoin Golds. One is a proof-of-work chain with nine years of history, three attacks, a dozen active volunteers and a market cap you could raise at a small angel round. The other is a token issued on Bitcoin by the man who founded the first one, claiming its name, its ticker and its holders. Neither can stop the other. I can tell you which one the block explorer follows. I cannot tell you which one the aggregators are pricing at $0.47… and I suspect they cannot either.

Who is who

The founders

• Jack Liao, chief executive of LightningASIC and the “first founder” who recruited the other five. Left the board for an advisory role in November 2018; returned in 2024 by taking the domain and launching the merge-back campaign. Posts as @realSatoshiGold. Listed as “Co-Founder, Inactive” on the team page of the site he does not control.
• Hang Yin (h4x3rotab), lead developer, co-founder and board member. Fudan computer science graduate and former Google engineer who de-anonymized himself in November 2018. Later co-founded Phala Network.
• Martin Kuvandzhiev, operations lead, co-founder and board member, Bulgaria.
• Franco Niebles, lead designer, co-founder and board member, Colombia.
• Alejandro Regojo and Robert Kuhne, co-founders listed as inactive.
• Edward Iskra, communications director and board member; author of the “Responding to Attacks” and Bittrex statements in 2018 and of the July 2024 domain notice on the wiki. The nearest thing the project has to an institutional memory.

The other side of the ledger

• The attackers, never identified. The May 2018 wallet ended with 388,201 BTG; the January 2020 blocks were mined to a single address beginning GWrW5d.
• James Lovejoy, then of MIT’s Digital Currency Initiative and lead maintainer of Vertcoin, whose reorganization tracker documented the 2020 attacks and priced them at 0.2 BTC each.
• Bittrex, the first exchange to ask a fork’s developers to pay for its losses, and also the first business to delist BTG.
• Upbit, the exchange whose January 2025 delisting removed the last liquid market.
• NiceHash, the hashrate marketplace named by the team in 2018 and 2020 as the likely source of the attacking power; it has never been accused of wrongdoing, only of existing.

What Bitcoin Gold proved

• You can fork Bitcoin’s proof of work cleanly. The header format, the fork ID, the address prefixes and the per-block retarget all worked exactly as designed. Nobody lost coins to replay or to sending BTG to a BTC address. That is a better technical implementation than Bitcoin SV’s.
• ASIC resistance is rental exposure. Three attacks in 26 months, two of them profitable, established the economics that every small proof-of-work chain now lives with: if your hashrate can be rented, your confirmation depth is a negotiation.
• Checkpoints are the price of survival for a minority chain. The July 2020 defense worked, and it worked by developers deciding in advance which chain was honest. Bitcoin Gold was the first Bitcoin fork to do this openly; it will not be the last.
• Exchanges will eventually ask who pays. The Bittrex demand was unprecedented in 2018. The question has not gone away.
• A brand can outlive its chain. The 2024 domain dispute and the 2025 “merge” show that a fork’s name, ticker and holder list have value independent of the blocks, and that whoever holds the website holds the narrative.
• Hold your forks anyway. Anyone who held Bitcoin on 24 October 2017 still holds Bitcoin Gold, on both of its chains, and it cost them nothing. As Kurt said in the previous article, that entitlement to every branch of the tree is the one piece of fork-era advice that has aged well.

Will it flip Bitcoin?

At 0.00054 percent of Bitcoin’s market value, a hashrate that can be rented for the price of a used car, a founding team split across two websites, and its last major exchange gone, Bitcoin Gold is not going to flip anything, and I am not aware of anyone who claims it will. The interesting question is the other one. Bitcoin Gold set out to answer whether Bitcoin’s ledger could be made safer by making it minable on ordinary hardware. Nine years of data say no, and they say it more conclusively than any argument ever did. The most valuable thing the chain has produced is that answer.

Scorecard inputs

Sources

mempool.space API for Bitcoin block 491,406; BTCGPU README and Technical Spec wiki (edited 3 February 2025); BTCGPU chainparams.cpp; btgexplorer.com Blockbook status, 20 September 2026; btgofficial.org team page; Bitcoin Gold project posts “Responding to Attacks,” “A Successful Network Upgrade,” “Statement Regarding Bittrex” and “Leadership for Another Year” (2018); James Lovejoy’s gist “Bitcoin Gold (BTG) was 51% attacked” (January 2020); CoinDesk, 24 October 2017, 27 January 2020 and 11 July 2020; BitMEX Research, “Bitcoin Gold investment flow data”; ZDNet and The Next Web on the Bittrex delisting, September 2018; Binance delisting notice, October 2022; Bitfinex support notice on the BTG delisting; Upbit notice of 24 December 2024 and coverage by crypto.news and Cryptonews; bitcoingold.org “BTG Roadmap 2025” and “Merge back Bitcoin” pages and the bitcoingoldorg/mergebackbitcoin repository (Liao faction); CoinMarketCap data API for BTG and BTC, 17 September 2026; Bitcoin Takeover Podcast S17 E39.

Want to learn more about Bitcoin UTXO forks? Read the previous articles on Bitcoin Cash and Bitcoin SV. And if you want to learn everything about the 10 forks that BTC underwent, there’s an article about them too!

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

How the big block camp split in two, why the losing side kept building, and what a chain with no limits and a confiscation rule has actually proved

If Bitcoin Cash was the fork everyone argued about, Bitcoin SV is the fork everyone agreed to stop mentioning. In most of the industry it survives as a punchline: the coin of the man who could not prove he was Satoshi, delisted from the exchanges that matter and kept alive by a gambling billionaire’s patience. That summary is what most people know about BSV. But it not the whole story, and a magazine that claims to be exhaustive about forks cannot skip the one that took the big block idea further than anyone else dared.

On Bitcoin Takeover Podcast S17 E39, I invited Kurt Wuckert Jr to talk about it for the same reason I have invited Roger Ver, Amaury Séchet and Paul Sztorc over the years: you cannot understand where Bitcoin is today without understanding the roads it refused to take, and Kurt has been walking the big block road for nearly a decade. He was a big blocker before Bitcoin Cash existed, a Bitcoin Cash supporter before BSV existed, and a BSV miner after the rest of the world stopped paying attention. Halfway through our three hours and forty minutes, Hodlonaut posted that the stream was “exhibit 837 on the absolute decay of culture and principles in the Bitcoin space” and insulted me in a way that I will not print. I mention this because it is the cost of writing this article at all, and because it tells you something about the subject: nine years after the first split, the BSV question still cannot be raised in polite company. So let’s raise it.

BSV Facts

Market figures are a snapshot from 17 September 2026 and will be stale by the time this is printed. Treat them as a scale reference, not a quote.

Why BSV Split: The Politics

The Bitcoin Cash article in this issue describes the first civil war of the big block camp, the one against Bitcoin Core. This is the second one, fought inside the camp, fifteen months after the first ended.

By mid-2018 Bitcoin Cash was upgrading on a fixed schedule, and the November upgrade written by Bitcoin ABC contained two changes that nobody outside the ABC team had asked for: canonical transaction ordering (CTOR), which sorts the transactions in a block by hash instead of by dependency, and a new opcode, OP_CHECKDATASIG, that lets a script verify a signature over arbitrary data. ABC said CTOR would enable faster block propagation.

Craig Wright’s nChain said it was an unauthorized redesign of a protocol that should have been frozen, and in August 2018 announced its own client, Bitcoin SV, “Satoshi’s Vision,” which would reject both changes, raise the default block size from 32 MB to 128 MB and restore more of the opcodes Satoshi had disabled in 2010. Calvin Ayre’s CoinGeek pool and his media outlet of the same name backed it. The rhetoric escalated quickly to threats of mining empty blocks on the other side’s chain, which is where the phrase “hash war” comes from.

Kurt was on the BCH side of that argument until the night it happened, hosting a Bitcoin.com sponsored meetup in Chicago. His account of why he switched is the most specific one I have heard, and I will present it as such. He believes the split was planned by ABC and not by nChain, and he offers three pieces of evidence. First, the SV node had existed for barely five or six weeks and shipped without replay protection or any of the tooling a faction intending to secede would prepare; when the chain split, SV-side wallets and apps broke and their developers scrambled. Second, the SV-aligned pools had been signaling for about ten days by diverting real hashrate at real cost, while the hashrate that tipped the ABC side appeared, in his telling, in the final hour. Third, and this is the part that is a matter of code rather than memory, Bitcoin ABC shipped a patch in the middle of the fight that treated blocks as final after ten confirmations, which made a reorganization by competing hashrate mechanically impossible regardless of who had more of it.

Andreas Brekken was live on the Bitcoin.com stream when that patch went out and, according to Kurt, reacted with the line of the night: “Ooh, we fucked up.” Kurt’s gloss is harsher. “We’re not having a hash war. This was all a ceremony.” He watched twenty blocks confirm and went to bed at two in the morning. The next day, he says, the two sides felt like a breakup only one party had packed for: Ryan X. Charles, an early Coinbase engineer, unsure whether to turn Money Button into a BSV wallet; Steve Shadders and Daniel Connolly at nChain deciding to make the split permanent because cooperation had clearly been declined; and his friends on the Bitcoin Cash side cracking champagne on stream. “I thought this was a competition among people who disagreed but respected each other. It turns out it was a coup against people that you hate and don’t want to talk to anymore.”

Amaury Séchet has given his version during S15 E28 of the Bitcoin Takeover Podcast, and it differs in the ways you would expect: CTOR was engineering, the SV people were disrupting an agreed upgrade process, and a man claiming to be Satoshi had become impossible to work with. Both versions agree on one thing. The conflict was not, at bottom, about transaction ordering. Kurt: “It’s really interesting that it wasn’t technical per se and it was more about a bunch of people not liking each other.” The numbers on day one, as Bitcoin.com News reported them, were about 8.9 exahashes for ABC against 3.5 for SV, with the ABC chain more than fifty blocks ahead within a day. BitMEX Research’s fork monitor estimated both sides were mining at a loss for the privilege.

Then came the part of the story that shaped BSV’s market access more than any block size ever did. In April 2019 Craig Wright sent libel threats to Peter McCormack and to the pseudonymous Hodlonaut, with CoinGeek offering a reward for Hodlonaut’s identity. Changpeng Zhao responded by delisting BSV from Binance on 15 April, effective 22 April, with a tweet calling Wright a fraud. Kraken polled its users and followed, closing trading on 29 April and withdrawals on 5 June. ShapeShift and the Blockchain.com wallet dropped support the same week. Coinbase never listed it.

Kurt’s most interesting observation on this was his praise for, of all people, Paolo Ardoino of Bitfinex, who kept BSV listed on the grounds that price discovery requires more than one venue. His broader point deserves a hearing even from people who cheered the delisting: “Corporations sue each other all the time, but the CEOs don’t stop having dinner. NASDAQ is not going to cut somebody out because you called him an asshole on the internet and then sued.” Crypto did. Kurt’s diagnosis is that the industry was still a village pretending to be a decentralized market.

I will add some personal notes too: I consider Hodlonaut a friend. The doxing campaign against him was disgraceful and the Oslo trial, which he won in October 2022, broke something in him. Kurt photographed him in that courtroom on a CoinGeek press pass and published the pictures. On my show, without being cornered, he repeated a public apology he had written before: that he was cavalier, that he added pressure to a man with a family, that he tried to shake Hodlonaut’s hand after the trial and was refused with a raised palm. He also said Hodlonaut’s recent writing on Bitcoin Core’s funding is spot on. Cypherpunks write code. They should not have to meet in courtrooms.

What Changed at the Fork: BSV’s Technical Delta

Unlike the 2017 split, the November 2018 divorce did not introduce a new signature scheme or fork ID. Both chains kept SIGHASH_FORKID from the UAHF, which means a transaction valid on one was, for a while, often valid on the other. So users split their coins by spending them with chain-specific opcodes rather than by wallet software doing it for them. The separation came from four mutually invalid rules.

1. No canonical ordering. SV nodes kept the topological ordering Bitcoin has always used and rejected CTOR blocks; ABC nodes rejected non-CTOR blocks. This alone guaranteed the chains could not reconverge.
2. No OP_CHECKDATASIG. SV treated the new opcode as invalid. Bitcoin Cash’s later CashTokens and DeFi stack grew out of this opcode; BSV chose a different path to the same capabilities.
3. More restored opcodes. OP_MUL, OP_INVERT, OP_LSHIFT and OP_RSHIFT came back, and the limit on operations per script rose from 201 to 500.
4. 128 MB by default, as policy. This is the point most often misreported. The 128 MB figure was a configuration default in the SV client, not a consensus ceiling, and that distinction turned out to be the whole BSV philosophy in miniature. Kurt put it plainly: “The most important thing about BSV is that we don’t have a hard block size limit, we don’t have a hard script limit. It’s up to the operator.” Gorilla Pool, his company, runs its own policy settings and has accepted a single 350 MB transaction because someone asked. Fourteen months later, Genesis made this the law of the chain.

The Roadmap Since

Bitcoin SV upgrades rarely, and when it does the changes are large. In between, the chain’s history is written in court dates and delistings as much as in block heights… so this table records both.

A necessary clarification about “restoring Satoshi’s protocol.”: this is the phrase BSV’s advocates use for Genesis and Chronicle, and it is half true. Many of the opcodes Satoshi disabled in the weeks around the August 2010 overflow bug, the one that minted 184 billion bitcoin in block 74,638, are back, and the limits he added in a hurry are gone. Kurt’s history here is accurate and worth quoting: “He gave us an invention, then turned off 80% of it, and nobody ever tinkered with it. What happens if we tinker with it?”

But Genesis also removed things that were never Satoshi’s to begin with and that both other Bitcoins still rely on. P2SH, the pay-to-script-hash format from 2012 that every multisig wallet uses, is invalid on BSV. The CLTV and CSV timelocks, the primitives behind Lightning channels and most modern covenants, are no-ops. This is a selective redesign with a strong point of view, not a bit-for-bit replay of 2009. Consequently, this article treats it as such. Kurt’s claim that “all but two” disabled opcodes are now live is broadly right after Chronicle; the practical question is what people build with them.

How BSV Differs from Bitcoin in 2026

On consensus. BSV shares every block with Bitcoin up to 478,558 and every block with Bitcoin Cash up to 556,766. After that, it diverges in a direction the other two consider reckless: no fixed block size, a 1 GB transaction limit, scripts bounded only by memory accounting, and a signature hashing scheme that can be either the 2009 original or the BIP143 variant on a per-input basis. No SegWit, no Taproot, no CashTokens, no CTOR. The address format is Bitcoin’s original base58, which means a BSV address looks exactly like a legacy Bitcoin address, a source of misdirected coins for years.

On scaling philosophy. Bitcoin bets on scarce base blocks and second layers. Bitcoin Cash bets on a large, algorithmically growing base block. BSV bets on no limit at all, with miners deciding what they will accept, and it is the only one of the three that has actually mined gigabyte blocks on mainnet. Kurt’s pitch is that this makes second layers unnecessary rather than impossible: “You can open a channel that works quite a bit like a Lightning channel except that it lives in Bitcoin script. No quote-unquote L2 necessary.”

He extends this to privacy: script templates for ring signatures and zero-knowledge proofs exist, and a wallet could in principle generate a proof per transaction. These are claims about what the script system permits, and I could find the templates but not a production wallet doing it. His critique of Bitcoin Cash’s ABLA is the mirror image of the BCH team’s critique of him: “You want to build the perfect robot. But an honest node is a node operated by an honest person. If there’s a lot of traffic, you can just raise the limit on your node. That’s a one-line change.” The BCH answer, that a one-line change every node operator makes independently is how you get a chain split, is the entire history of this section of the magazine.

On security. At 0.021% of Bitcoin’s difficulty, BSV is protected by roughly 195 petahashes… which a single large pool could redirect on a whim. The chain has been hit before: in mid-2021 it suffered a series of block reorganizations that the Bitcoin Association attributed to a deliberate attacker. The response, coordinating honest miners to invalidate the attacker’s chain, previewed the coordination-based security model that later became explicit in the confiscation rules. The hash war itself is the precedent for miners spending money to lose: BitMEX’s fork monitor estimated both camps mined at a loss in November 2018.

On decentralization. There is one node implementation that matters, SV Node, plus Teranode from the same association. Mining is concentrated; TAAL, Calvin Ayre’s company, is visibly the largest miner on Coin Dance samples, and Kurt’s Gorilla Pool is among the few independents. BSV’s defenders answer that this is the design: Satoshi’s writings describe nodes as professional operations and users as SPV clients, and a chain optimized for gigabyte blocks was never going to be validated on a laptop. Critics answer that a chain whose largest miner, largest media outlet and largest funder are the same person has decided the decentralization question already.

On adoption. I asked the impolite question directly: is anyone here besides Calvin Ayre? Kurt’s answer was candid in both directions. “To say that it’s just Calvin is unfair, but it would be wrong to say that Calvin is not the most significant person that’s put money into BSV.” He estimates Ayre’s total across mining, nChain and the ecosystem in the hundreds of millions, and notes that nChain, which once employed around three hundred people, is considerably smaller now.

The independent roster he offered: Twetch, a social protocol built by a friend of his and named for “tweets etched,” relaunching on the open Bitcoin Schema protocol that also powers Tree Chat; Tokenovate, run by a London Stock Exchange alumnus, hashing the state of institutional trading books to the chain so counterparties can verify them with proof of work; his own Gorilla Pool selling data provenance to what has become the AI integrity market; and a presentation he says he gave on the seventieth floor of a large New York bank about running its around-the-clock settlement on BSV tokens, which he acknowledges people on X did not believe. Someone recently wrote the entire Monero codebase into the chain, and Kurt’s framing of that is the purest statement of the data-ledger thesis: “We have a database that can accept really contentious software and host it forever, and nobody can take it down.” What is measurable is that BSV trades on second-tier exchanges only, that its market cap is a rounding error against Bitcoin’s, and that the enterprise deals are announced far more often than they are audited.

The Confiscation Question

This is the section that makes BSV genuinely different from every other coin in this magazine, and it deserves more care than the usual one-line dismissal.

Since November 2022 the BSV protocol includes a transaction class that can move coins without a valid signature. The mechanism, as documented in the protocol specification and as Kurt described it, works like this. A court order is obtained in some jurisdiction and digitized. Nodes receive it and decide, individually, whether to honor it; the coins are first frozen by consensus, then a confiscation transaction identified by an OP_RETURN carrying the protocol ID cftx and a hash of the order is whitelisted, and it becomes valid at a specified height.

The output cannot be spent for a further 1,000 blocks. Kurt’s counsel told him that Gorilla Pool, a Florida LLC, could not legally act on an order that had not been domesticated in Florida, and that agreeing to one would itself be theft. “So we have the ability to essentially vote no, and we signal that to the network.” His conclusion after reading the Network Access Rules that govern the process: “Frankly, the way it’s designed, I don’t think it will ever happen or ever be used.” As of this writing, he is right. No confiscation transaction has been mined.

His defense of the idea is that Bitcoin’s immutability was always social. Satoshi coordinated a rollback in 2010. Pieter Wuille coordinated one in 2013, phoning miners to downgrade during the Berkeley DB split. “If nodes agree to any state of the network, that’s the state of the network.” He adds that the system has already passed the hardest test anyone could design for it: the person with more leverage in BSV than anyone alive, a man half the community believed was Satoshi, went to court to have coins recognized as his, and the court said no. “It doesn’t matter how strong your cult is. If your proof isn’t proof, that’s the whole conversation.”

My objection is the one I read him from the whitepaper’s abstract: the network forms “a record that cannot be changed without redoing the proof of work.” A confiscation transaction changes the record without redoing anything. Kurt agreed that this is what he dislikes about it, and compared it to the alert key, a pragmatic emergency power that Satoshi built and that later ended up in the hands of Mark Karpelès before Core removed it. My second objection is procedural. Courts deal with land and contracts; a judge presented with forged evidence about dormant coins whose owner is dead or silent has no cryptographic way to detect the lie, and there is no appeal from a mined block. Kurt’s answer is that the threshold, the liability written into the rules for anyone who abuses them, and the sheer cost of domesticating orders in every mining jurisdiction make abuse “infinitesimally close to zero.” We left it there. The reader can weigh a tool that has never been used against a principle that has never been violated on the other two chains, and decide which they trust more.

The Satoshi Question

No BSV article can avoid it, so here is the record, followed by the two positions.

Craig Wright was named as Satoshi Nakamoto by Wired and Gizmodo in December 2015 and confirmed it himself in May 2016, with a private signing session that persuaded Gavin Andresen, who later said he had been “bamboozled.” In December 2021 a Florida jury in Kleiman v Wright rejected most of the estate’s claims but ordered Wright to pay $100 million to W&K Info Defense Research. In August 2022 he won his libel case against Peter McCormack and was awarded one pound, because the judge found he had given deliberately false evidence.

In October 2022 the Oslo District Court ruled for Hodlonaut. On 14 March 2024, in COPA v Wright, Mr Justice Mellor declared that Wright is not the author of the whitepaper, not the author of the original software, and not Satoshi Nakamoto; the written judgment followed in May, injunctions barring him from repeating the claim followed in July, and in December 2024 he received a twelve-month suspended sentence for contempt after filing a new £911 billion claim in defiance of them. He has since largely disappeared from public life; Kurt says he is farming somewhere in Southeast Asia and posting photographs of oversized cucumbers.

Kurt still believes he is Satoshi, “within an order of magnitude.” His case rests on people rather than keys: around fifteen interviews with family, colleagues and former partners of Dave Kleiman, several of whom, he says, corroborate Wright’s story while despising him, and none of whom will speak publicly. He believes Wright had the idea and a team of roughly five did much of the implementation, that Wright is lying about parts of the story, and that the alternative, a man choosing the hardest possible path to a scam when a hundred-million-dollar ICO advisory role was available for the asking, makes less sense. He has never had Wright on his own show and has declined to appear alongside him. “It has never been about Craig. It has always been about the Bitcoin experiment for me.”

My position is that stories are not data, and the data points the other way. Martti Malmi, who worked with Satoshi, told me on this podcast it was not Wright. Perry Metzger, who ran the cryptography mailing list, told me the same. Thomas Voegtlin, who wrote Electrum, checked his download logs for the day of the Andresen signing session and found nothing. A man I met in person last year told me one of the addresses Wright claimed in court was his, mined in 2010, and that he stayed silent because he knew Wright would lose anyway. Satoshi’s writing has been matched stylometrically to Nick Szabo’s, though Kurt’s counter, that Szabo appeared not to know Bitcoin script could be made Turing complete when he sat next to Wright on a 2015 panel, is a fair one. And the simplest test remains available: sign with a genesis-era key, as Charlie Lee did for Litecoin, or send a coin from one of the addresses. I offered to accept one on air. The offer stands.

Both of us agree on one thing, and it is the thing this article needs. Kurt: “If Craig never showed up on the scene and the rest of the Bitcoin civil war played out the way it did, we’d be sitting here on a BSV-looking chain anyway.” The big block experiment, the unbounded script, the enterprise data ledger, were all ideas before Wright and would have found a chain without him. What he brought was the money, the patents, the lawsuits and the toxicity, and whether that was a net positive for the chain that carries his initials is a question its own supporters answer quietly in the negative. “He’s been a massive asset and a huge albatross.”

Who is who

The principals

• Craig Wright, the public face of Satoshi’s Vision, nChain’s former chief scientist, and the reason the chain exists in its current form. Claims to be Satoshi Nakamoto; declared by the UK High Court in 2024 not to be. No longer active in the ecosystem.
• Calvin Ayre, the online gambling billionaire behind CoinGeek, the media outlet and the mining pool, and TAAL, the largest miner. The single most significant funder of BSV since 2018, by his supporters’ own admission.
• nChain, the research and patent firm that built the SV node and employed Wright; at its peak around three hundred people, now considerably fewer after the leadership turmoil of 2023 and 2024.
• Steve Shadders and Daniel Connolly, the technical director and lead developer who made the split permanent and shipped Genesis.
• Jimmy Nguyen, founding president of the bComm Association, later the Bitcoin Association, and the man who announced the dragon gold logo on the tenth anniversary of the genesis block. Historical figure; he left the association in 2022.
• The BSV Association, the Swiss non-profit that now governs the protocol under managing director Ásgeir Óskarsson; rebranded in June 2025 and released Teranode in October 2025.
• Kurt Wuckert Jr, CoinGeek’s chief historian, co-founder of Gorilla Pool and of Open Protocol Labs, which maintains Bitcoin Schema and the Sigma identity protocol. Chicago born, Florida based, jiu-jitsu practitioner, Smashing Pumpkins fan, which is where he and I found common ground. A former BTC maximalist’s nightmare guest and, on the record, one of the few people in this space who will apologize in public.
• Ryan X. Charles, early Coinbase engineer and founder of Money Button, the wallet that chose BSV after the split; later one of the community members who publicly said he had been fooled by Wright after COPA.
• TAAL, SVPool, Mempool and CoinGeek, the pools that mined the first SV blocks and, in TAAL’s case, the record-sized ones.

The other side of the war

• Amaury Séchet, Bitcoin ABC’s lead developer, whose CTOR upgrade and ten-block finalization patch decided the hash war. Kurt calls him “a backstabbing psychopath”; the Bitcoin Cash community that expelled him two years later uses similar language, for different reasons.
• Roger Ver, whose Bitcoin.com pool tipped the ABC side and who released a video days before the split explaining why he had concluded Wright was not Satoshi. Wright’s UK libel suit against him was thrown out on jurisdictional grounds in 2019.
• Changpeng Zhao, whose delisting tweet started the April 2019 cascade.
• Hodlonaut and Peter McCormack, the two men Wright sued for saying he was a fraud, who both won, at a personal cost that the winners in this story tend not to mention.
• COPA, the Crypto Open Patent Alliance, which brought the case that ended the identity question in law. Its members include Jack Dorsey’s Block.
• Arthur van Pelt, the researcher whose years of documentation of Wright’s forgeries fed the COPA case. Kurt’s summary of him, unprompted: “We have the Smashing Pumpkins in common.”

What Bitcoin SV Proved

Whatever you think of the chain, it produced results the rest of this magazine keeps returning to.

• Gigabyte blocks can be mined. Dan Kaminsky described them at a hacker congress in 2011. BSV mined a 3.87 GB block in 2022. Whether anyone needs them is a separate question, but “impossible” is no longer an available argument.
• Exchange politics can override engineering. BSV’s fiat rails were destroyed in one week in April 2019 by a lawsuit and a tweet, not by a bug or a fee spike. Every fork that came after has had to think about that.
• Policy can replace consensus. BSV is the only chain in this issue where block size is a per-miner setting, and it has run that way since 2020 without the chaos its critics predicted, largely because so few miners are involved. The experiment is real; the sample size is small.
• Confiscation machinery can exist without being used. Four years of a legal recovery process on chain and zero uses is a data point for both sides of the immutability debate.
• Ideas leak. Wright spent 2016 and 2017 telling Bitcoin developers that script was more powerful than they believed. Robin Linus and Super Testnet proved a version of that claim on BTC with BitVM in 2023. Kurt’s point, that “if you can’t learn from somebody just because you don’t like them, that’s your problem,” is uncomfortable and not wrong.
• Hold your forks. Kurt follows Daniel Krawisz’s advice and keeps his oldest coins unsplit, entitled to every branch of the tree, so his portfolio never votes in his arguments. With two more Bitcoin forks arriving this year, it is the best practical advice in this entire issue.

Will it Flip Bitcoin?

No, and nobody in the BSV camp I spoke to claims otherwise. At 0.021% of Bitcoin’s market value and roughly the same fraction of its hashrate, fourteen times smaller than the Bitcoin Cash it split from, with no top-tier exchange access and a court record rejecting its central founding claim, Bitcoin SV is not on any trajectory toward monetary relevance. Kurt himself does not accumulate it: “I don’t hoard a big stash of BSV because I think it’s going to the moon. For me it’s about business.” His theory of the chain is that it is a substrate for data and contracts, and that the price is a distraction. On the evidence, that is the only defensible theory left. Treat flip talk as advocacy. Treat the fact that the chain is still producing blocks, upgrades and court filings eight years after being written off as the accomplishment, and treat the question of whether that is a good use of a few hundred million dollars as one for Calvin Ayre.

Scorecard inputs

Facts only; the scores come in the ratings section.

Sources

WhatsOnChain API for blocks 556,766, 556,767 and 620,538 (header times, miners, sizes); BSV protocol upgrade history at protocol.bsvblockchain.org, pinned to SV Node v1.2.2 chainparams; CoinDesk and Bitcoin.com News coverage of 15 and 16 November 2018; BitMEX Research fork monitor, November 2018; CoinDesk on the Binance delisting, 15 April 2019; Kraken support notice on the BSV delisting, April 2019; CoinGeek and bComm Association announcement of the BSV logo, 3 January 2019; CoinGeek on block 725,511; CoinDesk and the UK Judiciary written judgment in COPA v Wright, March and May 2024; BSV Association press releases on the June 2025 rebrand and the October 2025 Teranode release; CoinGecko API for BSV and BTC market data, 17 September 2026; mempool.space for BTC difficulty, 17 September 2026; Bitcoin Takeover Podcast S17 E39 with Kurt Wuckert Jr (23 August 2026) and S15 E28 with Amaury Séchet.

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

From the same series, check out the article about all of Bitcoin’s hard forks and soft forks, as well as the piece on BSV.

Every fork in this magazine is built on pain, frustration, anger, and ambitious of achieving something bigger than BTC. Bitcoin Cash has the most famous story arc… and possibly the most fascinating one thanks to the deep lore and years of infighting.

For roughly two years, from 2015 to the summer of 2017, the Bitcoin world argued about a single constant in the code: the one megabyte block size limit that Satoshi slipped into version 0.3.12 in September 2010 without announcing it. One camp wanted the number raised so that Bitcoin could stay cheap to use on chain. The other wanted it left alone and the extra capacity found elsewhere, first through Segregated Witness and then through second layers like Lightning. Neither side could remove the other from the network, so on the 1st of August 2017 one of them left.

I was confused at the time. I landed on BTC like most people, because if you held bitcoin you got both coins and the BTC ticker felt like the safer bet. What I disliked about Bitcoin Cash was the campaign to call itself the real Bitcoin, the way Bitcoin.com quietly became a BCH website and r/btc a BCH forum. It felt like a nasty divorce where both parties grab whatever they can carry and claim they are in the right. Nine years later I sat down with the phenomenal big blockers who stayed after the famous names left, for eight hours and fourteen minutes, and this article is the factsheet I wish I had read before that conversation… but with some elements that I could only learn after having interviewed the ”bcashers”.

Vital statistics

Market figures are a snapshot from 17 September 2026 and will be stale by the time this is printed. Treat them as a scale reference, not a quote.

Why it split: the politics

The short version is that Bitcoin’s social layer failed to reach consensus, so the code did it instead.

The long version starts with the whitepaper’s subtitle, “A Peer-to-Peer Electronic Cash System.” The large block camp read those words literally: if fees rise to the point where a coffee costs more to send than to drink, Bitcoin has stopped being cash. Their proposals came in waves. Bitcoin XT (BIP101, Gavin Andresen and Mike Hearn) wanted 8 MB blocks doubling every two years until 2036. Bitcoin Classic settled for 2 MB. Bitcoin Unlimited abandoned fixed numbers altogether in favor of “emergent consensus,” where miners pick their own limits and the market sorts it out. None of them reached activation on the main chain.

Calin Culianu, who was there on fork day and now maintains the node software most of the network runs, told me that the forking conversations had been going on since 2015, “the same way frustrated BTC developers talk about forks today.” Asked why BCH did not simply adopt Gavin’s BIP101 schedule, he gave the most honest answer I have heard on the subject: “Any group of rebels is going to be reacting to the thing they rebelled against. You try to meet them halfway.” The big blockers spent two years proposing compromises to plug holes that Core kept finding in their arguments, and the coin they eventually launched carried the scars of that negotiation rather than the purity of the original idea.

The small block camp saw something different in those proposals: a precedent for miners and businesses changing the money’s rules by agreement among themselves, which they regarded as the worst possible governance model for a system meant to resist exactly that. SegWit, a soft fork that raised capacity by moving signatures out of the base block, was their answer. Large block advocates called it an accounting trick that handed the roadmap to Core developers and made second layer networks the only path forward.

Three events in 2017 turned a debate into a deadline:

• The New York Agreement (May 2017). Digital Currency Group convened miners and businesses representing, by their count, over 80% of hashrate. The deal, branded SegWit2x, promised SegWit first and a 2 MB base block hard fork three months later. Many large block advocates distrusted it from the start; small block developers refused to sign at all. The 2x half was suspended on 8 November 2017 and never happened. It is often conflated with Bitcoin Cash, wrongly: BCH launched in August as a hedge against exactly this outcome, and only after SegWit2x collapsed did the NYA’s big block constituency migrate to it.
• BIP148, the user-activated soft fork. Node operators pledged to reject any block that did not signal SegWit from 1 August 2017. Whether or not it had the economic weight to succeed, it made 1 August the day everyone was planning around.
• The UAHF. Bitcoin ABC, led by Amaury Séchet, published a user-activated hard fork specification in June 2017 as a counter to BIP148: if the UASF chain would reject non-signaling blocks, the UAHF chain would reject SegWit and raise the block size instead. What began as a contingency plan turned into a launch. Culianu recalls that the project briefly had no name at all (“Bitcoin user activated hard fork” was the placeholder) before Bitcoin Cash crystallized in July, in direct reaction to the UASF branding. ViaBTC listed futures before the split, and the ticker moved from BCC to BCH once it became obvious that BCC already belonged to a Ponzi scheme.

Roger Ver, one of Bitcoin’s earliest investors and the owner of the Bitcoin.com domain, became the fork’s most visible advocate. The people who built the chain are tired of hearing that he created it. “It never really was Roger’s coin,” Culianu said. “He threw some money at it, so did Jihan, so did Bitprim in Argentina.” Jihan Wu’s Bitmain, then the dominant ASIC maker, was broadly aligned with large block politics, though how much hashrate the company actually pointed at BCH in those first weeks is disputed to this day and I would not print a number. Exchanges credited existing bitcoin holders with an equal balance of BCH, which is why the split is often described as an airdrop even though nobody sent anything to anyone.

What changed at the fork: the technical delta

Four rules separated block 478,559 from anything Bitcoin would accept, and they were designed so the two chains could never be reunited by accident.

1. Bigger blocks by consensus. The fork block had to be larger than 1 MB, which is why the first BCH block was deliberately padded to about 1.9 MB. Nodes had to start with an “excessive block” limit of at least 8 MB.
2. Replay protection. Every BCH signature must use SIGHASH_FORKID, with a signature hash adapted from BIP143. A transaction signed for one chain is invalid on the other, so a coin spent on BCH stays put on BTC and vice versa. Ethereum Classic had skipped this a year earlier and paid for it. Bitcoin Cash did not.
3. The Emergency Difficulty Adjustment. If fewer than six blocks appeared in twelve hours, difficulty dropped by 20%. This kept the minority chain alive when miners left for BTC, but it also created a lucrative oscillation: miners piled in when difficulty was low, mined a burst of fast blocks, then left when it rose. The side effect is still visible: BCH is 1,490 blocks ahead of Bitcoin as I write, which is why its halvings arrive weeks before Bitcoin’s.
4. No SegWit. Not a missing feature but a statement of intent: capacity would come from the base block, not from a witness discount.

The roadmap since

Bitcoin Cash upgrades by scheduled hard fork, historically twice a year and since 2021 every 15 May. Every one of these would be impossible on Bitcoin without a chain split. That is precisely the point. Since the CHIP process (Cash Improvement Proposals) was introduced in 2020, fifteen CHIPs have been implemented.

A necessary clarification about Schnorr: Bitcoin Cash shipped Schnorr signatures two and a half years before Bitcoin did, and its advocates like to point this out. Fair enough. But BCH Schnorr is a drop-in replacement inside the existing CHECKSIG opcode. Bitcoin’s Taproot is a new output type in which a single key and an entire tree of alternative scripts are indistinguishable on chain until spent. They share a signature algorithm and almost nothing else. Likewise CashTokens and Ordinals are not two answers to the same question: one is enforced by every node, the other is a convention that nodes ignore.

Now here is a necessary clarification about OP_CAT. People in BTC still say with a straight face that Satoshi was right to disable it and that it would destroy the chain. Culianu’s account of why it was disabled is worth recording: “Satoshi was balancing twenty plates at once. Some things he just got rid of because he couldn’t deal with the consequences of a cat bomb.” A script that doubled a string repeatedly could exhaust a node’s memory, and in 2010 the quickest fix was to remove the opcode. BCH’s answer since 2025 is to price every VM operation and cap the total per input, so no single opcode can blow up a node regardless of what it does. Robin Linus, the creator of BitVM, messaged me during the live stream: “Tell the BCH guys that I, the officially crowned king of Bitcoin script wizards, am jealous of all their neat opcodes and wish we had them too.” He used a stronger adverb.

How Bitcoin Cash differs from Bitcoin today

On consensus. The two chains share every block up to 478,558 and nothing after. BCH has forkid signatures, canonical ordering, adaptive blocks, native tokens, introspection opcodes, unbounded integers and loops. It has no SegWit, no Taproot, no bech32 addresses (it uses its own CashAddr format, introduced in January 2018, precisely to stop people sending coins to the wrong chain). It also has no Replace-by-Fee. BCH removed RBF at the first opportunity and added double-spend proofs instead, because zero-confirmation acceptance at the point of sale is treated as a feature to protect rather than a risk to eliminate.

On scaling philosophy. Bitcoin Cash bets that on-chain capacity should always exceed demand so that fees stay near zero and the fee market never really forms. Bitcoin bets that scarce block space and a fee market are what pay for security once the subsidy runs out, and pushes small payments to Lightning and other layers. Coin Dance’s number on the day I checked was that a Bitcoin transaction cost about 359 times more in dollar terms than a BCH one. The number is real. So is the counter-argument that a chain nobody needs to pay to use is a chain nobody is paying to secure. Culianu’s reply to that, for the record: with enough volume, “the price could drop 99% and the miners would still be totally secure.” With current volume, that sentence is a hypothesis.

Why 32 megabytes and not BSV’s gigabytes? “It’s like a sweet spot number,” Culianu said. “Decent block propagation, validation time, acceptable orphan rate. An engineering question.” ABLA exists so that the number never has to be a political question again: the limit is now a consensus rule that follows demand, which is, as one of the developers put it, the block size wars made impossible to repeat.

On security. Because the proof of work is identical, BCH’s security budget is a function of its price. At roughly 0.3% of Bitcoin’s difficulty, the cost of renting enough SHA-256 hashrate to attack it is a rounding error for a large pool. On 15 May 2026, the day of the network upgrade and with most of the developer community gathered in Ljubljana, somebody tested that. Bitcoin Core had disclosed a long-standing crash bug on 5 May; an attacker mined two deliberately malformed blocks against BCH within thirty minutes, spending an estimated 3,000 to 10,000 USD in hashrate on the assumption that the fork had inherited the bug. It had not. BCHN had removed the offending line years earlier as a code smell. The blocks were rejected as invalid, the network noticed nothing, and BCH crashed about 25% over the following days on a wall of short positions that may or may not have been related. It is the first documented hostile attack on the chain itself, as opposed to a split from within.

On decentralization. Bitcoin Cash’s supporters point to multiple independent node implementations (Bitcoin Cash Node, BCHD, Knuth, Verde, Bitcoin Unlimited historically) and argue that no single team controls the protocol. Critics reply that 32 MB blocks, let alone ABLA’s headroom, would price hobbyist nodes out if the chain ever filled them. The BCH answer to “can you people even run nodes?” (a question I once watched a maximalist ask two BCH visitors at a conference in Frankfurt) is that the premise is wrong: SPV was in the whitepaper, UTXO commitments are on the roadmap, and Bitcoin Core itself skips signature checks on historical blocks through assumevalid. Two years ago I synced a Bitcoin Core node in 7 hours 40 minutes and a BCH node in 2 hours 20 minutes on the same MacBook Pro. The BCH chain is currently the smaller one, because it has had less traffic. Both facts cut like a twofold blade that nourishes irrational tribalism.

On adoption. BCH has stayed listed on every major exchange since 2017 and survived two hostile splits with its ticker intact. Real spending pockets exist: Townsville in Australia, Argentina, and the Philippines, where Paytaca is onboarding merchants and users together after St. Kitts showed what happens when you onboard only the merchants. Europe’s crypto payment rails, GoCrypto included, were killed by MiCA’s licensing regime rather than by technology. What has not materialized is demand at scale: measured throughput has spent most of nine years far below what the block limit allows, so the capacity argument has largely been tested in theory.

Who is who

The builders

• Amaury Séchet (“deadalnix”), lead developer of Bitcoin ABC and the engineer behind the UAHF. He launched Bitcoin Cash, but currently he no longer steers it. His Infrastructure Funding Plan, an 8% coinbase tax routed to his own team, split the community in 2020, and his chain is now eCash XEC. The people who worked with him describe the episode with something less than fondness. “The Greg Maxwell of big blockers,” Culianu called him.
• freetrader, pseudonymous lead maintainer of Bitcoin Cash Node (BCHN), the client that carried the majority through the IFP split and remains the reference implementation for BCH today.
• Calin Culianu, BCHN developer since fork day, author of the Fulcrum Electrum server (used by Cake Wallet among others, and now serving BTC and Litecoin as well) and a maintainer of the Electron Cash wallet. His stated mission: “complete Satoshi’s work,” get the chain technically ready to be global money if the moment ever comes, and keep the culture non-toxic. He sold all his BTC for BCH after the fork and says he has no regrets, which at current prices is a statement of principle.
• Jonathan Toomim, independent developer whose ASERT difficulty algorithm replaced the 2017 DAA in November 2020.
• Jason Dreyzehner, the designer behind much of the recent VM work (limits, BigInt, introspection) and the quantum-resistant vault constructions. Rarely gives interviews.
• Rosco Kalis, creator of CashScript, the high-level contract language that started as a 2019 university project and now underpins most BCH DeFi. Spends most of his time in the Ethereum world and is candid that “the UTXO model is harder to build on.”
• Jason Cox, Bitcoin ABC release manager in the 2017 to 2020 era, now associated with the eCash line.
• General Protocols (AnyHedge, the first BCH DeFi contract in 2020, and the EXO template stack), Riften Labs (Cauldron DEX), Kyle (FundMe.cash, Bitcoin Cash University), Kallisti (Selene wallet), and, without any claim to completeness, Axel Gembe, Dagur Valberg Johannsson, Andrea Suisani and Fernando Pelliccioni of Knuth.

The money and the mouthpieces

• Roger Ver, “Bitcoin Jesus” to his fans, who spent years evangelizing Bitcoin before becoming BCH’s most tireless promoter through Bitcoin.com. Arrested in Mallorca in May 2024 on 10 year old US tax charges, three weeks after publishing the book Hijacking Bitcoin; now under a gag order. Still friendly to the project, by the developers’ account, but no longer funding it.
• ViaBTC (Haipo Yang), which mined the first BCH block, ran the first BCH futures market and gave the chain its first weeks of hashrate.
• Jihan Wu and Bitmain, the industrial weight behind the large block camp in 2017, influence more often asserted than measured.
• Craig Wright, Calvin Ayre and nChain, allies in 2017 who became the opposing army in the November 2018 hash war and left with Bitcoin SV. I asked Culianu how it felt to have a man claiming to be Satoshi on his side. “It felt bad. It felt weird.” He described the post-fork community as “a ragtag band of rebels” who tolerated Wright because he said the right things about Core, and considers the association, along with the infamous wine glass photograph, the single most damaging thing that happened to the big block cause in its early years.
• Steve Thurmond, a BTC maximalist from 2011 to 2023 who switched sides, and the creator of Cash Stamps, paper wallets loaded with a couple of dollars of BCH that he hands to strangers and leaves on top of urinals. Not a developer and cheerful about it. His conversion story, from a man who used to spend bitcoin at Overstock and Newegg until the fees made it pointless, is possibly the most common one you will hear in the big block community.
• The exchanges, whose decisions decided both later splits: in November 2018 and again in November 2020, the chain that kept the BCH ticker was the one Coinbase, Binance, Kraken and the rest said it was.
• r/btc, the subreddit that became the large block camp’s home after r/bitcoin’s moderators began removing XT fork advocacy in 2015. Political color, not technical authority, but the two forums shaped the tone of everything that followed. Several current BCH figures told me the Reddit era was so bitter that they initially left the community and only came back later, “in a hazmat suit.”

The two forks that came after

Bitcoin Cash’s own history repeats the pattern that created it.

On 15 November 2018 the ABC roadmap (CTOR and OP_CHECKDATASIG) collided with nChain’s Satoshi’s Vision client, which wanted 128 MB blocks and the original opcodes restored with no other changes. Both sides mined their own chain from block 556,767 and, for a few days, threatened to attack each other’s. The ABC chain kept the ticker. The SV chain became Bitcoin SV. Culianu now says CTOR “didn’t need to happen” and did not need to be pushed through against nChain’s objections; the change was ostensibly about faster block propagation via Graphene, but in his reading it was as much about forcing the nChain people out. Steve Thurmond calls CTOR BCH’s own humiliation ritual, while noting that ABLA is not in the whitepaper either.

On 15 November 2020 the fight was over money rather than opcodes. Bitcoin ABC wrote its Infrastructure Funding Plan into consensus at what Culianu describes as “the eleventh hour,” redirecting 8% of every block reward to a development address without any community process. Bitcoin Cash Node and the other clients refused. “We quickly scrambled to form another dev team, told all the miners which software to install, and he got the boot.” Hashrate and exchanges followed BCHN; ABC’s chain traded as BCHA and rebranded as eCash (XEC) on 1 July 2021, with 1 BCHA redenominated as 1,000,000 XEC. Several people told me this was the split that made them give up on BCH for a while. The price hit an all-time low of about 75 USD a month after the BSV split and was ranked 35th by market capitalization. Both fork chains have their own articles covering this issue.

What Bitcoin Cash proved

Regardless of what you think of the coin, the experiment produced results that the rest of this magazine keeps returning to:

• A contentious chain split with proper replay protection can produce a durable, liquid asset. Every later Bitcoin fork copied BCH’s SIGHASH_FORKID approach or something like it.
• The market decides tickers, not developers. Twice, the BCH name went to the chain exchanges chose, and the losing side had to rebrand.
• Scheduled hard forks are a viable governance model, at least for a chain small enough that its stakeholders can coordinate. Six consecutive May upgrades have gone off without a split since 2021, and the community’s own claim, that no figurehead remains to decapitate, has been tested twice and held.
• Bitcoin borrowed from it. Jeremy Rubin told me his CTV and CSFS proposals were inspired by an existing BCH opcode called CHECKDATASIG. The WabiSabi paper behind Wasabi Wallet 2.0 cites CashFusion, which shipped on BCH first. Bitcoin Core is working toward UTXO commitments, which BCH has argued for since the node debate began. And in September 2018, at the absolute height of the fork wars, a BCH developer known as Awemany found a live inflation bug in Bitcoin Core (CVE-2018-17144, introduced by a block validation optimization) and disclosed it responsibly. Bitcoin’s 21 million owes a debt to a big blocker. Core has never had a reciprocal disclosure agreement with BCHN, and Culianu is no longer sure he would be so polite a second time.
• Big blocks alone do not create demand. This is the finding that BCH’s own advocates find hardest to argue with, and the one that Bitcoin’s small block camp cites most often.

Will BCH flip Bitcoin?

This magazine’s scorecard asks this question for every fork, so let’s answer it plainly. At about 0.3% of Bitcoin’s market value and about 0.3% of its difficulty, Bitcoin Cash is not on a trajectory to overtake Bitcoin… and nothing in its present market structure suggests otherwise. Even its most committed developers do not claim it is. Culianu’s own theory of victory is that the people he calls “the money printer people” will be too busy fighting other fires to bother with a chain this small, and that being under the radar is a feature for now: “It would actually be really dangerous if BCH got to number two right now.” A flip would require a reversal in hashrate allocation, fiat rails and social consensus of a kind that no protocol upgrade can deliver on its own. Where BCH’s claims do hold up is narrower and real: it is cheaper to use, it has features Bitcoin has declined to adopt, and it is still here, which is more than most 2017 forks can say. The ultimate test of an open source project is whether people keep joining after the big money and the famous names leave. By that measure it passed. Treat flip talk as advocacy, then treat survival as the accomplishment.

Scorecard inputs

Facts only; the scores come in the ratings section.

Sources

UAHF Technical Specification and the 2017 to 2026 upgrade specifications (upgradespecs.bitcoincashnode.org); mempool.space API for block 478,558 (header time 1501593374); CoinDesk and Bitcoin.com News coverage of 1 August 2017; reference.cash for the May 2023 upgrade; CoinGecko API and coin page for market data, 17 September 2026; Coin Dance BCH statistics, 17 September 2026; Decrypt on the November 2020 split; bitcoinabc.org on the BCHA to XEC rebrand; bitcoincashnode.org team page; Internet Archive capture of bitcoincash.org from December 2017; Bitcoin Takeover Podcast S17 E26 (27 May 2026), interviews with Calin Culianu, Steve Thurmond, Rosco Kalis, Kallisti, FiendishCrypto, Kyle and others.

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

While most of the forks featured in this magazine were born the moment a group of people decided they could no longer share a blockchain with everyone else, this particular article is about the opposite behavior. It’s about the times Bitcoin changed the rules and everybody stayed. Eight times since 2012, the network has tightened what counts as a valid block. Eight times the chain, the coins, and the history carried on as one. Here is a comprehensive list that describes how each change was switched on, and the handful of cases where the story is messier than the block height suggests.

If you enjoy reading this piece, make sure you also check out the articles about Bitcoin Cash and Bitcoin SV!

Soft forks tighten the rules, hard forks change them

What’s in scope for this particular article is soft forks and genuine, general will hard forks that changed the consensus rules of Bitcoin mainnet while keeping one continuous chain and one continuous set of unspent coins.

For now, we won’t cover the coins that split off with their own copy of the ledger (Bitcoin Cash, Bitcoin SV, Paul’s eCash BIP300 fork and friends). We will also not take into account peer-to-peer changes that never touched block validity (BIP37 bloom filters, for example), address formats that only encode rules already in force, and relay policy that a node applies to its own mempool but not to blocks.

For the sake of correctness, it’s worth noting that research stopped on September 17th 2026. Heights follow the mainnet parameters shipped in Bitcoin Core’s src/kernel/chainparams.cpp, or the BIP text where Core still runs the deployment through version bits (Taproot). Activation times are the header time field of the activating block, read from mempool.space and shown in UTC, unless a BIP fixed a flag-day timestamp instead.

Two caveats worth knowing: a block’s header time is set by the miner and can drift a couple of hours from wall-clock time, and Core has quietly rewritten several old activations into simpler height checks (BIP90). So the code you read today is not always the code that ran at the time. Maybe there’s a reason why Satoshi decided to not name it the “timechain” (as the pre-release version of Bitcoin called it in November 2008) and opted for blockchain instead. Probably the best reason would be that Bitcoin is bad at telling the time, even if some people use block height for time stamping events.

Has Bitcoin ever hard forked?

No intended hard-fork upgrade has ever activated on the Bitcoin chain. The project’s tradition is to tighten rules rather than loosen them, so that a node running old software still follows the majority chain even if it cannot fully validate the new features. The one serious attempt at a coordinated hard fork of the main chain, the SegWit2x block size increase proposed in the 2017 New York Agreement, was called off before its planned block 494,784 activation. BIP101, 102, 103, and every other proposal to increase the block size has only been debated, without benefiting from a clear activation path.

But the honest answer is that Bitcoin’s chain has split by accident twice in its existence, and one of the incidents is arguably a hard fork.

First there’s the 2010 value overflow. On August 15th 2010, at block height 74,638, a transaction created roughly 184 billion bitcoin through an integer overflow. Satoshi Nakamoto quickly patched the software to launch version 0.3.10. The new client added the missing range check, miners reorganized the chain about 53 blocks later, and the bad block vanished from history. The inflation bug fix was a tightening, so it counts as a soft fork with an unusually violent activation.

Then there’s the March 2013 database split. Bitcoin 0.8 replaced Berkeley DB with LevelDB and, without anyone realizing, removed an implicit limit of about 10,000 database locks that older versions hit when processing large blocks. On March 11th 2013, block 225,430 triggered a split of at least 24 blocks. To end this accidental fork, the pools downgraded their software to version 0.7. During the confusion that ensued, one experimental double spend succeeded. Version 0.8.1 shipped a temporary rule (no more than 4,500 transaction IDs referenced by inputs in a block) that expired on May 15th 2013.

On August 16th 2013, block 252,451 finally exceeded the old limit and forked unpatched nodes off for good. BIP50, the post-mortem, later removed the words “hard fork” because the limit was never a written rule and varied from node to node. BitMEX Research and Jameson Lopp both argue that, on balance, it was one anyway. To please every side of the debate, let’s say that this was the closest Bitcoin has come to hard forking.

A third, quieter case was CVE-2018-17144. Disclosed in September 2018 by a Bitcoin Cash developer, this bug would have let a miner spend the same input twice within a block. Core versions 0.14.0 to 0.16.2 carried it. No block ever exploited it, so no split occurred… but strictly speaking, those versions had loosened a rule without anyone noticing and the patch tightened it back.

If the entire network updates to the latest version of the client in order to make a change, is that not a hard fork? Well, you could argue that the older broken version is still in consensus and therefore anyone can run it. But in practice, it’s unsafe to do so and every network participant chooses to make the switch.

How a soft fork gets switched on

Bitcoin has never had one fixed procedure for soft fork activation. Each generation of developers attempted to fix the failures of the previous one. As you can see in the table below, there are seven different ways… and every time a new proposal emerges (such as BIP300, CTV, or OP_CAT), the community must figure out how to reach the fabled consensus.

Before there were BIPs

The list below starts in 2012 because that is when Bitcoin began announcing rule changes in advance. Satoshi tightened the rules several times in 2010 with nothing more than a software release, so these have version numbers rather than clean activation heights. BitMEX’s fork history warns that no precise date can be given where the change went through without a split.

• July to August 2010 (0.3.5 to 0.3.8): a batch of script opcodes was disabled outright, among them OP_CAT, OP_SUBSTR, OP_LEFT, OP_RIGHT, OP_INVERT, OP_AND, OP_OR, OP_XOR, OP_2MUL, OP_2DIV, OP_MUL, OP_DIV, OP_MOD, OP_LSHIFT and OP_RSHIFT, after a bug let anyone spend any output. OP_VER, OP_VERIF and OP_VERNOTIF were made invalid at the same time, along with a 10,000-byte script size cap and a 201-opcode limit.
• August 2010 (0.3.10): output value range checks, the response to the overflow described above.
• September 2010 (0.3.12): the 1,000,000-byte block size limit and the 20,000 signature-operations limit, written into the code so that enforcement began at block 79,400.

None of these was announced as a fork. All of them still bind every block mined today.

The eight activated soft forks

These Bitcoin upgrades are ordered by the block height at which they were activated. “Core” is the first release that shipped the rule.

What each one actually did, in a sentence: P2SH let a sender pay to the hash of a script so the recipient carries the complexity (the origin of addresses starting with 3). BIP30 closed a loophole in which two transactions could share an ID. BIP34 forced miners to write the block height into the coinbase, which made BIP30’s problem impossible in practice. BIP66 stopped relying on OpenSSL’s forgiving signature parser, after it turned out that different parsers could disagree on validity. CLTV gave Bitcoin its first absolute timelock opcode.

The CSV suite added relative timelocks (BIP68 in the sequence field, BIP112 as an opcode) and made a block’s locktime comparisons use median-time-past (BIP113), the plumbing that Lightning channels depend on. SegWit moved signatures out of the transaction ID, fixing third-party malleability and raising capacity through the weight limit, while NULLDUMMY removed a small malleability vector in multisig. Taproot introduced Schnorr signatures, a new output type where a single key and a tree of scripts look identical on chain, and a cleaner script version for the future.

Where the block heights are contested

1. P2SH: date or height? BIP16 says the rule applies to blocks with a header timestamp of 1333238400 (April 1st 2012, 00:00 UTC) or later. Bitcoin Core 0.16.0 briefly expressed this as BIP16Height = 173805. Since 0.17.0 Core takes a different approach: it applies P2SH and witness rules to every block back to genesis, with one exception… block 170,060 (hash beginning 00000000000002dc…), which spent a P2SH-looking output under the old rules a few weeks before the flag day. That list of exceptions later grew to include one block from 2021 that would fail Taproot rules if judged retroactively. For historic purposes, quote the flag day; for what Core enforces today, use the exception list.
2. BIP34: 227,835 or 227,931? The BIP’s results section records the last version-1 block as 227,835. Core’s BIP34Height is 227,931 (hash ending 0808b8), the point at which its simplified BIP90 check begins. Use 227,931 as the enforced activation height and cite the BIP text for the last-v1 story.
3. SegWit: lock-in versus activation. The BIP9 state machine reached LOCKED_IN at height 479,808 (August 9th 2017) and ACTIVE one retarget period later at 481,824 (August 24th 2017). Both dates circulate as “the SegWit date”; only the second is when the rules took effect.
4. BIP30’s two exceptions. Blocks 91,842 and 91,880 contain coinbase transactions that duplicate those of blocks 91,812 and 91,722 respectively. They are grandfathered forever. Core also stops checking BIP30 once BIP34 is active, except that it must resume at height 1,983,702, where a version-1 block’s coinbase could in principle collide with a BIP34-style serialized height.

BIP91: a mechanism, not a feature

BIP91 (“Reduced threshold Segwit MASF”) added no script rule of its own. From late July 2017 miners running it rejected blocks that did not signal SegWit’s bit 1, which pushed the original BIP9 deployment past 95% and averted the 1 August UASF deadline. It belongs in the SegWit factsheet under activation politics; a standalone sheet is optional.

Deferred: proposals that shaped the story without becoming rules

These are tagged “deferred, scope expansion” and must not be counted as activated upgrades.

Explicitly out of scope

• BIP37 bloom filters: a peer-to-peer privacy and denial-of-service topic, not consensus.
• BIP70 payment protocol: application layer.
• Address encodings BIP13, BIP173 (bech32) and BIP350 (bech32m): they describe how to write down outputs whose rules P2SH, SegWit and Taproot already define.
• Relay and standardness policy changes that never applied to block validity.

This essay is part of BTCTKVR: Forks!, my free 2026 magazine about Bitcoin forks. Start with What the Fork?! for the overview, or hear the guests argue it in their own words in Bitcoin Forks, Described by Dorks.

But in the era of blockchain analysis, when most on-ramps and off-ramps are subjected to KYC/AML procedures, breaking the deniability is easier than ever. And privacy, while it appears to be decent at the moment when the transaction occurs, can only degrade over time as the sender and the receiver may accidentally or willingly divulge more information later on. Satoshi himself wrote this in the whitepaper: ”some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking would reveal other transactions that belonged to the same owner” [1].

While some self-described ”toxic maximalists” will argue that Bitcoin is inherently fungible at the protocol level and discrimination is only an issue at the social layer, it’s nearly impossible to not distinguish between monetary units while the origins are clear. In June 2024, PayPal co-founder Peter Thiel has made one of the most candid observations on the topic: ”when people in the FBI tell me that they’d much rather have criminals use Bitcoin than $100 bills, it suggests that maybe it’s not quite working the way it was supposed to” [2].

Regardless of this depressing status-quo, there are three types of arguments to be made in favor of Bitcoin’s aspirations to become a private digital currency: the first one concerns the history and origins of the project, the second one is about sound money and the requirement to obtain fungibility, and the third is about some efforts that developers have made over the years.   

1. Bitcoin’s History and Cypherpunk Origins

In an e-mail that he sent to b-money inventor Wei Dai in August 2008, Satoshi Nakamoto attached a document called ”ecash.pdf” [3] — an early draft of the Bitcoin whitepaper whose working title implies the creation of a decentralized approach to David Chaum’s privacy-friendly electronic cash system. At chapter 10, just like in the final draft of the Bitcoin whitepaper which was revealed to the world on October 31st, readers can find a rather naive but useful description of how bitcoiners can transact with a degree of privacy: every time a user receives bitcoins, he should generate a new ”public key” whose purpose and identity are known only by the sender.

This method was also demonstrated by Satoshi Nakamoto while he mined blocks: currently, the ”1 million BTC” theory is a mere assumption that Sergio Demian Lerner has made during his Patoshi research in 2013 [4]. We cannot know for certain which blocks were discovered by Satoshi, as every coinbase reward of 50 BTC was sent to a different address.

According to professional software engineers who analyzed version 0.1 of the Bitcoin software, Satoshi Nakamoto was not a seasoned C++ developer. He created a system that was pieced together from open source libraries, included a broken game of poker and a peer to peer marketplace, and made it available only on Windows. It took the efforts of other developers such as Hal Finney, Gavin Andresen, Jeff Garzik, Mike Hearn, Wladimir van Der Laan, Gregory Maxwell, and Laszlo Hanyecz to refine the code, break it down into manageable chunks, and port it to Linux, MacOS, and mobile platforms. Satoshi Nakamoto’s amateurish and “hacky” coding style was attested by early contributor Jeff Garzik [5] and Libbitcoin maintainer Eric Voskuil [6]. 

Based on these observations, as well as some e-mail exchanges in which Satoshi appeared to be insecure about his project and seemed to look up to Hal Finney, we know that the Bitcoin creator wasn’t some time-traveling alien AI who invented digital alchemy (as Saylorists seem to believe) and he wasn’t a CIA/NSA professional either. Satoshi didn’t invent or write from scratch the building blocks of Bitcoin: elliptic curve digital signatures, Merkle trees, SHA256, Proof of Work, public key cryptography, peer to peer networks, electronic cash and blockchains were all available as separate iterations that served distinct purposes. But he did want Bitcoin to be a decentralized version of Chaumian ecash — a true holy grail among the cypherpunk community.

The above paragraph, though it may seem unnecessary in the context of a discussion on privacy, is useful in providing context for what kind of software developer Satoshi was and what his intentions were. We do know that he wanted his system to have privacy, but at the same time he wasn’t the best coder or cryptographer around. He merely used the open source libraries that were available to him at the time. And most of the privacy technology that emerged later (ring signatures, zero knowledge proofs, MimbleWimble, confidential transactions, ZK rollups) marks an attempt to improve on a rough software stack and bring it closer to fulfilling its mission.

We know with certainty that Satoshi Nakamoto cared about improving Bitcoin’s privacy because, during his short tenure as lead developer and educator in chief he provided feedback to some early improvement proposals. This intellectual contribution is frequently pointed out by Monero fans, who claim that their network of choice closely follows the writings of Satoshi. 

On August 11th 2010, as part of Bitcoin Talk’s 770th thread (titled ”Not a suggestion”), Satoshi Nakamoto replied to users Red and Insti who proposed using Zero Knowledge Proofs to minimize the amount of transaction data being stored by full nodes. Initially, the Bitcoin creator made a pretty interesting suggestion: ”if a solution was found, a much better, easier, more convenient implementation of Bitcoin would be possible.” [7]

Two days later, under the same forum topic, Satoshi described three elements that lay at the foundation of today’s Monero and ZCash:  

”Can public nodes see the values of transactions?” — a condition which later inspired the creation of Confidential Transactions.

”When paying to a bitcoin address, you would generate a new blinded key for each use” — a vague description of stealth/shielded addresses and Silent Payments, as well as one-time public keys.

”I think that’s where group signatures comes in. With group signatures, it is possible for something to be signed but not know who signed it.” — a description of what would later become ring signatures in Monero and mixing pools in ZCash (as well as CoinJoins in Bitcoin).

Satoshi Nakamoto didn’t only answer to the comments posted by the users, he also proved that he’s been researching the topics and presented the limitations of his discovery: ”Crypto may offer a way to do ‘key binding’. I did some research and it was obscure, but there may be something there. ‘Group signatures’ may be related.”

As always, the Bitcoin creator presented a practical example to spark the imagination of the contributors: “say some unpopular military attack has to be ordered, but nobody wants to go down in history as the one who ordered it. If 10 leaders have private keys, one of them could sign the order and you wouldn’t know who did it.”

Satoshi also encouraged others to find a solution to a problem he couldn’t solve during his short tenure as lead developer: “The challenge is, how do you prove that no other spends exist?  It seems a node must know about all transactions to be able to verify that. If it only knows the hash of the in/outpoints, it can’t check the signatures to see if an outpoint has been spent before.  Do you have any ideas on this?”

Hal Finney, legendary PGP coder and the first notable cypherpunk to give Bitcoin a chance, is responsible for putting out the famous “Running bitcoin” tweet — published on January 11th 2009. But only 10 days later, he wrote about a lesser known but equally significant effort: “Looking at ways to add more anonymity to bitcoin” [8]

This post was sent out to the world two years before Silk Road was launched, and it would take five years for the intelligence company Chainalysis to get founded. Without fueling any “Hal Finney was Satoshi” theories, it’s worth noting that his early concerns were valid and haven’t been dismissed yet. Bitcoin never received more anonymity — just a little bit more deniability via transaction obfuscation. 

2. Sound Money Requires Fungibility

Now let’s talk about the properties of sound money — a status which Bitcoin unquestionably aspires to attain. Even in the event that it scales down its purpose to remain a store of value, a certain degree of fungibility is still required. Currently, discrimination of transactions is possible at the validator and block producer level: nodes can choose to filter out transactions of arbitrary types or coming from a certain source, while miners can ignore transactions that they don’t like (most famously, Ocean Pool filters ordinal inscriptions and MARA Pool rejects addresses on the OFAC list).

The reason why Bitcoin still works as designed is the incentive system: it’s relatively easy for the sender to spin up a node which saves his transaction in the mempool and keeps on broadcasting it — any contemporary computer can run Bitcoin Core or Libbitcoin. Likewise, for every censorship-friendly mining cartel, there can always be another independent block producer who will not mind collecting the transaction fee.

However, in a world in which KYC/AML practices become prevalent and blockchain analysis is an industry standard, there is a lot more information about Bitcoin users, addresses, and miners. So resourceful governments can pressure participants into following a strict blacklisting procedure, with very draconian punishments for miners who break the rule. Naturally, geopolitical game theory fixes part of the problem because we live in a multi-polar world with a plurality of superpowers that don’t always collaborate.

But a project like Bitcoin should not rely on goodwill or flaws in the structure of human politics — instead, it should become censorship resistant by design. The only way to achieve this feat is to make it impossible for miners to act in ways which differ from the system’s incentives: therefore, collect the highest fees to confirm transactions without caring about the origins. If Bitcoin adds a degree of confidentiality, which enables senders to remain private and also hide the amounts that they’re sending, then the system would finally support sound money.

As any monetary theorist will tell you, fungibility is a very important quality for good money. An ounce of gold is equal in value with another one of the same purity, regardless of its origins. A $100 bill will buy you the same amount of goods and services, even if it was previously held by Brad Pitt, the President of the USA, a construction worker, a convicted criminal, or all of them at different times.

In the case of Bitcoin, you still encounter “freshly mined coins”, “Silk Road coins”, “dark market coins”, “Mt. Gox coins”, “Coinbase coins”, “Kraken coins”, “CoinJoined coins”, “ordinals”, and all sorts of ways to differentiate according to origin. On the free market, freshly mined coins are usually deemed more valuable — for the simple reason that they have no past.

Interestingly, Bitcoin does have a built-in fungibility mechanism: once a transaction fee gets paid, the corresponding coins get mined again as part of the block reward. So even the most “tainted” coins can become squeaky clean once a miner collects them as fees and reissues them. However, this is not enough: and to expect all “tainted” bitcoins to get sent as transaction fees is extremely unrealistic. What Bitcoin needs is a system that makes it impossible to discriminate according to previous ownership — and if users (and outside observers) cannot know, then they will have no means to censor.

3. The Proposals to Make Bitcoin Private

Almost sixteen years into Bitcoin’s existence, we have a remarkable series of discoveries and inventions that can improve its privacy. Some of them are already part of the Core software stack (such as BIP32, whose hierarchical deterministic wallets help create more deniability) or exist as additional features in various wallets (such as CoinJoin in Wasabi, JoinMarket & Samourai, or Silent Payments in Cake Wallet). But these solutions alone aren’t good enough. They generate a degree of deniability, but can’t hide the amounts being transacted and are generally worse for the sender.

This is why we must look into the plethora of more or less experimental proposals which offer privacy with various tradeoffs. Most commonly, there are three types of criticism regarding anything which concerns Bitcoin privacy:

1. That the extra obfuscation occupies more blockchain space and therefore won’t scale, as is the case of Confidential Transactions and Ring Signatures (both available on Monero);
2. That hiding transaction amounts may lead to unwanted monetary inflation in the event of bug exploits, as the money supply is no longer easy to audit;
3. That privacy of any kind might get Bitcoin delisted from exchanges, banned from certain jurisdictions, or even scare away institutional investors who put billions of dollars into building their BTC portfolios while assuming that the software is complete, stagnant, and easy to audit by regulators;

The first two issues can be avoided via elegant cryptography, cautious development, and rigorous testing. Privacy enthusiasts can launch the new features on other networks, incentivize scrutiny and adversarial interactions, and then propose their refined discoveries to the Bitcoin community. However, even the ideal solution becomes useless if there is no social support for its implementation in particular or for anything that aims to fix Bitcoin privacy in general. If the culture gets eroded by complacency and “number go up” hopium, then the desire for fiat money gains will stall any cypherpunk aspiration — it won’t be until fungibility really becomes an issue which blatantly erodes the financial well-being of a majority of users that the conversation about adding privacy becomes serious.

Politics aside, it’s useful to pay attention to breakthroughs in the world of privacy, understand how they work, and think of ways to apply similar protocols or principles to Bitcoin (preferably, without requiring major changes to the consensus code). It’s how ideas get refined and distilled into their most efficient form. It’s also how clever workarounds get discovered, as means to circumvent the conservative nature of the Bitcoin protocol.

The 4 types of Bitcoin Privacy

Before proceeding with the analysis, it’s important to distinguish between the four types of Bitcoin privacy: sender, receiver, amounts, and network-level. For a more thorough breakdown on the topic, I recommend you to listen to Paul Puey on S15 E48 of the Bitcoin Takeover podcast [7].

When used as Satoshi suggested in the whitepaper (new address for every incoming transaction), Bitcoin protects the identity of the receivers — that is, until further multi-input transactions are made to break the deniability. If the user makes use of the Tor network or a powerful mixnet such as Nym, then other peers cannot figure out where the node or light wallet is located based on IP address. So Bitcoin can also have pretty good network-level privacy.

However, there is little to no privacy for the sender: as the receiver can see the amount being sent and how much change was returned after the transaction. And speaking of amounts, there is no way to have any confidentiality for the number of coins being transferred — at least not on the base layer.

A good way to get deniability when sending Bitcoin is to transfer the entire amount from the UTXO to avoid change. This can be interpreted as a self-transfer to a new wallet, but can also be a payment. Nobody really knows initially, unless the veil gets lifted later when a KYC/AML off-ramp gets involved or someone makes a mistake.

There are several significant proposals to address these shortcomings, and they will be presented according to the issue they address. 

Dandelion++ for Network-Level privacy

For example, Dandelion was created to significantly boost network-level privacy by inserting a random delay that breaks the link between IP addresses and individual transactions. It was proposed for Bitcoin in 2017, received a significant improvement (Dandelion++) the next year, but it never made into the Bitcoin project.

Though there was some interest from developers, the users never really pushed for the adoption of this particular privacy enhancement — and if you ask the average bitcoiner today, they won’t know what Dandelion is and probably assume you’re speaking about a “shitcoin”. The protocol was however added to Monero, Firo, and a bunch of other privacy projects. It would have been great to have it in Bitcoin, since it doesn’t require any kind of fork or consensus and none of the concerns listed above would apply.

MWEB for Sender Privacy & Hiding Amounts

The MimbleWimble Extension Block protocol was also proposed for Bitcoin, but ended up getting developed for Litecoin. Back in 2016, Blockstream head of research Andrew Poelstra presented the idea to put MimbleWimble (a novel and groundbreaking privacy and scalability protocol) on an extension block [8]. This integration would require a soft fork and enables bitcoiners to peg their coins into a larger anonymization pool where the amounts being sent are hidden and you can’t lurk into someone else’s address. 

All you can observe in MWEB is how many coins join the pool, where the peg-ins come from, and where the peg-outs go. Though the latter two points might sound like an issue, they can be mitigated with CoinJoins to create enough deniability to make analysis difficult. 

MimbleWimble comes packaged with confidential transactions — a technology that was built for Bitcoin, was picked up by Monero, but scales much better in the updated design of Tom Elvis Jedusor. It has been available on Litecoin since May 2022 and still works flawlessly, with mobile integrations and light wallets being developed in recent months to increase portability. 

Historically, Litecoin is the network that tests upgrades which are considered to be too risky or avant-garde for Bitcoin — it happened in the case of SegWit, then it continued with main net Lightning Network experiments that were later moved to BTC. However, this time around there seems to be no interest in adding MWEB: there is no BIP to promote it, there are almost no debates about it, and critics usually point out to MimbleWimble and say it’s not ”good enough” for privacy (as if other proposals are seriously being considered or else there is something that Bitcoin already has). 

Can MWEB scale? Absolutely! Thanks to the embedded data compression, it prunes older transactions and remains compact in size. Block size increases can be applied to it without really requiring more storage from nodes.

It’s also designed in a way which makes the supply easier to audit — anyone can see how much liquidity exists in the anonymity pool, and then nodes can reject amounts that exceed the peg-ins. But will it lead to exchange delistings?

As Litecoin demonstrated, not really. Only a couple of Korean exchanges did that due to regulatory uncertainty. The big players never dropped support. MWEB is an opt-in layer for transactions — and businesses can still operate on the main chain if they want to have full transparency. 

It’s definitely a useful and interesting proposal which does contribute towards fixing Bitcoin’s privacy and scalability issues. However, as revealed in S15 E17 of the Bitcoin Takeover podcast, not even Andrew Poelstra (the man who first thought of putting MimbleWimble on a Bitcoin Extension Block) is passionate about the idea anymore… not even after it’s been implemented on a Bitcoin-compatible network [9]. But if you want to hear a technical and somewhat optimistic discussion on the topic of MWEB, listen to S15 E59 with David Burkett — the man who made it all happen [10]. 

Statechains, CoinJoins & PayJoins for Pragmatic Sender Privacy

Statechains, CoinJoins, and PayJoins (payments coming directly from CoinJoins) at scale can also mitigate some of Bitcoin’s privacy issues. The sender’s privacy definitely gets a boost, but amounts being moved on the main chain remain visible. With Statechains, currently developed by CommerceBlock for the MercuryLayer, users can seamlessly swap UTXOs of equal sizes without leaving any permanent record on the base layer. It’s a pretty cool concept, as the transfer of ownership happens without the blockchain. To learn more about it, listen to my interview with developers Nicholas Gregory and Tom Trevethan [10]. 

However, the incentive to perform this swap only exists when you don’t want your further transactions to carry your identity. And if UTXO swapping is exclusive to those who need it, then the coins being exchanged aren’t necessarily ”the cleanest” that everyone wants. This is why CoinJoins should be used in conjunction with Statechain CoinSwaps — so that all the bitcoins involved are equally clean and equally dirty at the same time. Paying out of CoinJoins is also necessary in order to preserve the privacy benefits.

However, the user experience for following this process is still cumbersome and the cost might be a little too high for most people (especially in a high fee environment, which Bitcoin expects to have). But even if Bitcoin does scale and the interfaces do get optimized to serve non-technical users, there still needs to be enough demand for this type of privacy. The reason why privacy is still niche is that very few bitcoiners actually use it.

Drivechains for Pretty Much Everything 

One of the most interesting, yet controversial proposals to improve Bitcoin is Drivechains: Layer Two Labs CEO Paul Sztorc has come up with the idea of miner-enforced sidechains that copy the features of every altcoin. This way, the scaling solution also acquires the benefits of  adding functionality and utility. Basically, Drivechains fulfill the dream of Bitcoin maximalism — that of having every use case and every transaction on Bitcoin, within the economy provided by the 21 million supply cap. The concept is explained by BIP 300 and BIP301.

In terms of privacy, Drivechains come packaged with a Zcash sidechain that provides the most advanced privacy that’s available today (as it’s a direct fork of the latest version of Zcash). It’s called Zside and can be downloaded from the LayerTwo Labs website for testing purposes on the Bitcoin signet.

To use it, bitcoiners must transfer their coins into the sidechain and lock them for approximately 13000 blocks (the time frame between the deposit and the withdrawal was architected like this to ensure system stability). On the base layer, the coins get frozen in a time lock contract. On the Zside chain, the same amount of BTC gets minted and becomes usable for as long as the user keeps the funds pegged.

This means that the supply is always clear, the amount of coins locked in the Zcash sidechain can be verified, so there is no risk of hidden inflation. By virtue of being a sidechain that can choose to prune transaction history after a certain point, it’s also very scalable. And in terms of regulators banning it or exchanges delisting BTC, they’d have to enable support for this particular layer first. Bitcoin remains unaffected.

Of course, some Bitcoin Core developers such as Matt Corallo and Peter Todd have expressed concerns about mining centralization and MEV (Maximal Extracted Value) [11]. But Paul Sztorc is currently working on the CUSF (Core Untouched Soft Fork) activation method, which involves bypassing the opinions of Bitcoin Core by directly dealing with the miners [12]. Since the block reward is diminishing and the amount of transaction fees collected by the miners is disappointingly low, there’s an incentive for block producers to enable merged mining. Drivechains also come bundled with blind merged mining, which is really useful in this multi-chain context.

If implemented, Drivechains open up the technical possibility for Bitcoin to onboard the entire planet and provide all the smart contracts or privacy features that one might desire. But at this point in time, it seems like the community would rather discuss covenant soft forks and OP code restoration than think bigger in terms of what the Bitcoin network can be. It seems unlikely that Core developers will agree on activating BIP 300, but the miners might just coordinate to maximize their revenue — because to them, the next few years are going to be all about the fees.

Covenants for ZK Rollups & Trust Minimized Sidechains

While they don’t provide any privacy benefits by themselves, covenant soft forks such as OP_CTV, OP_CAT, and OP_ANYPREVOUT are tools which allow developers to build trust-minimized sidechains and ZK rollups. With covenants, layers such as Liquid and Rootstock (which today rely on trusted setups or federations) can significantly improve their decentralization. 

Also, as suggested by Bitcoin developer Super Testnet, Drivechains could get built using OP_CAT and BitVM — but there are some tradeoffs in terms of user benefits and protections that make the Drivechains soft fork activation preferable. 

ZK rollups are also an interesting import from Ethereum, which allows users to transact with pretty good privacy on scalable layer twos. Projects like Citrea and Alpen Labs already exist and work towards building proper rollups for Bitcoin, but their ability is still limited by the lack of specific features unlocked by covenant soft forks.

Covenants can also support the creation of CoinJoin implementations that don’t have a coordinator in the middle. Something like Wasabi Wallet can get built in an automated manner, without central servers. The research of 1440000000 bytes (also known as ”Floppy”) is definitely interesting and can lead to a future in which CoinJoins are uncensorable and much easier to use.

It’s also worth noting that StarkWare, a protocol which brings Zcash-level privacy using Zero Knowledge STARKs (Scalable Transparent Arguments of Knowledge), can come to Bitcoin. Eli Ben-Sasson, the mastermind behind the system, has previously worked with ZK SNARKs (used in Zcash) and has been speaking about bringing privacy and instant blockchain synchronization to Bitcoin since at least 2014. He also co-authored the Zerocash research paper and has been on a journey to refine Zero Knowledge proofs for BTC for almost a decade.

ZK STARKs are already available on Ethereum. But if Bitcoin activates OP_CAT (or else the StarkWare researchers figure out how to build it without the extended function), then we can see this avantgarde cryptographic magic coming via ZK rollups. Not quite the ideal way, which would involve making standard base layer transactions private, but in tune with the philosophy to scale in layers with various benefits and tradeoffs.

The future is promising for these concepts, though some community members express concerns about the ability to build anything using concatenations (OP_CAT). Regardless, the privacy provided does not directly impact normal 1 input-2 outputs transactions on the base layer and it’s not as good as adding opt-in Zcash transactions. But this appears to be the path that gets most ”consensus” among bitcoiners, as many of them seem to agree that a covenant soft fork is useful.

It’s also worth noting the existence of projects such as Bitcoin OS which claim they can emulate the features of a covenant without any soft fork, and therefore allow Bitcoin to ossify and become ”permaware”. It’s an interesting approach, but it comes with limitations and tradeoffs that get fixed by an actual network upgrade. In 2024, I’ve recorded interviews with pretty much all the big players in the covenant and ZK rollups space — from Robin Linus and Orkun Kilic to Liam Eagen, Alexei Zamyatin, Eden Yago and Super Testnet. You’ll find many of these conversations if you scroll through season 15 of the show!

Privacy Hard Forks

Now we’re stepping into the field of high fantasy, as the goal is to dream about Monero or Zcash-like features on Bitcoin. However, a more radical change to the protocol, which implies a hard fork, does not necessarily lead towards better privacy. In the end, privacy is achieved when there are lots of participants who use the same protocol for the purpose of becoming indistinguishable from each other.

So it doesn’t make much sense to fantasize about Confidential Transactions (available today on Liquid) or Ring Signatures. Also, Zcash’s ZK SNARKs or Halo2 cryptography probably won’t come to Bitcoin any time soon. The reasons don’t only concern political/regulatory concerns, but also the scalability argument — anything that generates larger transaction sizes within the small block framework is less desirable.

But we can also look at projects like Decred, which managed to make every on-chain transaction a Wabisabi-like CoinJoin (CoinShuffle++, in which the amounts are visible, but there’s a lot of deniability for the sender) and also make the Lightning network more stable. I’ve interviewed Decred’s Jake Yokom-Piatt and Phoenix Green in S15 E55 of the Bitcoin Takeover Podcast and I think it’s a really interesting conversation from which we can learn [14].

Ultimately, I believe that Bitcoin will integrate a more mature version of Zcash’s protocol. It will come in a time of crisis, when institutional adoption proves to be a fad and the users find themselves desiring for ways to hide from oppressive governments. Since day one, the Zcash protocol has been thought as a way to improve Bitcoin — and Zcash’s similarities in design (21 million coins, initial Proof of Work mining) are no coincidence.

Hard forking to add privacy is the final boss — a moment that culminates a long series of social-political experiences and technical experiments. Bitcoin will undoubtedly choose to become sound money by employing the most mature, well-tested, and efficient protocol available. This is why the users, instead of being complacent, should be engaged in testing features on altcoins in order to identify the implementations that show potential and get ready for the moment when Bitcoin must get something similar. 

As mentioned in the first part of this article, it’s important to demolish any suspicion of hidden inflation. It’s also important for the privacy protocol to be scalable to the point that private transactions don’t come in larger data sizes (which is why it appears that ZK proofs might take us there). 

Last but not least, privacy should be the default and universal setting — users must never have to deal with a perishing fungibility that gets ruined by one bad actor who holds the coins, and they shouldn’t know a world where privacy is stigmatized either. Nobody questions you today when you hand a dollar bill to somebody else in a public place. Nobody will question you in the future for sending a peer to peer digital money transaction to a stranger, using a public, inclusive, and socially-mundane payments network. It’s just how evolution works.

Bitcoin will one day be 100% fungible — and we need to prepare for that day, both technologically and socially.

Bitcoin Is Still a Panopticon

Given the volume of information presented, we can safely affirm that allowing Bitcoin to have very poor privacy today was a choice. It might be the result of negligence or cowardice on behalf of the users and developers. It may be a consequence of the ”number go up no matter the cost” mentality, combined with the fear of getting delisted from exchanges.

It’s possible that the efforts to please regulators, portray Bitcoin as the nice chain that criminals avoid, and eventually embed in into the traditional financial system via ETFs might have be part of the reason. But regardless of the cause, the situation is not great: not for the users, not for the network, and definitely not for the fungibility of the currency.

Sure, CoinJoins are fine — but they still reveal the amounts being transacted and some of the participants might later KYC to diminish the others’ deniability. CoinSwaps via Statechains (as designed by Mercury Wallet) are also useful, but you never know when you get a much more ”tainted” UTXO than the one you sent out. The CoinJoin outputs may be considered ”tainted” and therefore unacceptable by some economic actors. Until the moment Bitcoin gets privacy for the amounts being sent, these issues will continue to affect users.

Since Hal Finney’s ”Looking for ways to add more anonymity to bitcoin”, which he published 18 days after the Bitcoin network launched, internet money nerds have aspired to reach this goal without any technical roadblocks or social/political issues. Almost 16 years later, we have much better research and development in the field of privacy. A decade from now, we will have perfected these tools. What matters the most is to not capitulate to dinosaur institutions offering us Sim City cheat code money, and also to try to not feel jaded about the apparent lack of progress. Technology will get us there — but are we ready for it?

Sources:

1. The Bitcoin Whitepaper, Satoshi Nakamoto, 2008, Available at: https://bitcoin.org/bitcoin.pdf 
2. Peter Thiel on Aspen Ideas Festival 2024, Available at: https://youtu.be/B3ZXrTzskw0
3. Nakamoto Studies Institute, Electronic Cash Without A Trusted Third Party, Available at: https://www.nakamotostudies.org/literature/ecash.html 
4. Sergio Demian Lerner, ”The Well-Deserved Fortune of Satoshi Nakamoto, Bitcoin Creator, Visionary and Genius”, April 2013, Available at: https://bitslog.com/2020/06/22/a-new-mystery-in-patoshi-timestamps/ 
5. Jeff Garzik, ”Hemi Presents Satoshi Stories — The Secret Behind Satoshi’s Real Identity”, Available at: https://youtu.be/Zi92Y0WpEg4?si=yYwU5TiQKZfmVwal
6. Erik Voskuil on the Bitcoin Takeover Podcast, S5 E8, Around 00:20:51, May 2020, Available at: https://bitcoin-takeover.com/audio/index.php?name=2020-05-13_s5_e8_eric_voskuil_on_misean_economics__cryptoeconomics.mp3
7. Satoshi Nakamoto on the Bitcoin Talk Forum, Replying to Topic #770, In response to Red, August 11th 2010, Available at: https://bitcointalk.org/index.php?topic=770.msg8637#msg8637 
8. Andrew Poelstra at SF Bitcoin Developers, November 21st 2016, Available at: youtube.com/watch?v=aHTRlbCaUyM 
9. Andrew Poelstra on the Bitcoin Takeover Podcast, S15 E17, February 8th 2024, Available at: https://bitcoin-takeover.com/andrew-poelstra-bitcoin-covenants-op_cat-vs-op_ctv/ 
10. David Burkett on the Bitcoin Takeover Podcast, S15 E59, October 14th 2024, Available at: https://bitcoin-takeover.com/audio/index.php?name=2024-10-14_s15_e59__david_burkett_on_mweb_privacy.mp3 
11. Nicholas Gregory and Tom Trevethan on the Bitcoin Takeover Podcast, S15 E25, March 24h 2024, Available at: https://bitcoin-takeover.com/audio/?name=2024-03-24_nicholas_gregory_tom_trevethan_on_mercury_layer.mp3
12. Peter Todd, ”Drivechains: A Detailed Analysis”, October 13th 2023, Available at: https://petertodd.org/2023/drivechains 
13. Paul Sztorc, ”CUSF — Core Untouched Soft Fork”, v0.4.1 published on June 23rd 2024, Available at: https://bip300cusf.com/cusf.pdf 
14. Jake Yokom-Piatt and Phoenix Green on the Bitcoin Takeover Podcast, S15 E55, September 21st 2024, Available at: https://bitcoin-takeover.com/audio/index.php?name=2024-09-21_s15_e55_jake_yocom-piatt_phoenix_green_on_bitcoin_decred_privacy.mp3
15. Hal Finney, Personal Twitter Profile, Available at: https://x.com/halfin/status/1136749815