How crypto works, built bottom-up — until you could design it yourself.

On the Pacific island of Yap, people used money made of stone — carved discs called rai, some heavier than a car. Nobody carried them around. When you bought something big, the stone stayed exactly where it was; everyone in the village simply agreed that it now belonged to someone else. One famous stone sank to the bottom of the ocean during transport. It kept being spent for generations. The stone didn't matter. The shared memory of who owned it did.

That's the secret hiding inside all money: money is a ledger — a list of who owns what. Your bank account isn't a vault with your name on it; it's a row in a database. When you tap your card, no object moves anywhere. A number goes down on one row and up on another.

Which raises the only question that matters: who keeps the list? On Yap, the whole village did. Today, banks and payment companies do. That works — until the keeper of the list makes a mistake, gets hacked, freezes your row, or quietly rewrites it.

Our notebook's weakness is that pages can be rewritten and no one can tell. What we need is a tamper-evident seal: something that makes any change, however small, instantly visible.

Enter the hash function. A hash function eats any data — a word, a book, a hard drive — and spits out a fixed-length fingerprint. The one Bitcoin uses, SHA-256, produces 256 bits, written as 64 hex characters. It has three almost magical properties:

• Deterministic: the same input always gives the same fingerprint, on any machine, forever.
• Avalanche: change one comma and the fingerprint changes beyond recognition — about half of all characters flip.
• One-way: given a fingerprint, there is no known way to work backwards to the input, or to craft a second input with the same fingerprint. Your only option is guessing.

So instead of trusting a page hasn't changed, you write down its fingerprint. Later, re-hash the page: same fingerprint, same page. Guaranteed.

Fingerprinting each page is good, but Mallory can rewrite a page and its fingerprint together. The fix is beautifully simple: every new page starts by quoting the fingerprint of the page before it.

Now each page's fingerprint covers its own entries plus the previous fingerprint — which covered the one before that, and so on to page one. Tamper with page 2 and its fingerprint changes; page 3 now quotes a fingerprint that doesn't exist, so page 3 breaks; then 4, 5, 6… The entire history after your edit shatters visibly.

Rename "page" to block and this is, in full, a blockchain: blocks of entries, each sealed by a hash that includes the previous block's hash. Nothing more exotic than that.

One hash to seal them all: the Merkle tree

One detail before we move on, because all of Bitcoin depends on it. A real block holds a few thousand transactions. Does the block's seal hash them as one giant blob? It could — but then proving that your payment is inside would require shipping someone the entire block.

Instead, blocks use a Merkle tree, and the idea is pure Entry 02 applied recursively: hash the transactions in pairs. Then hash those hashes in pairs. Keep going until a single fingerprint remains — the Merkle root. That one hash now commits to every transaction below it: change any transaction and the change cascades up its branch, and the root — the only thing the block's seal actually contains — no longer matches.

The genius is what it does for proofs. To convince someone your transaction is in the tree, you don't send all 8 (or 8,000) transactions — you send only the sibling hashes along your branch: log₂(n) of them. For 4,096 transactions, that's 12 hashes instead of 4,096. Your phone's wallet works precisely because of this.

There's a hole in Entry 03. Hashes are cheap — your laptop computes millions per second. Mallory can rewrite block 2 and simply re-seal every block after it in a blink. The chain breaks loudly, then she repairs it quietly.

The fix, and it's the strangest idea in the whole design: make seals artificially expensive to create. We add a rule — a block's hash only counts if it starts with a certain number of zeros. Since hashes are unpredictable, there's no cleverness that helps; you add a junk number to the block (a nonce), hash, check, and repeat millions of times until you stumble on a winner. Pure lottery.

• Finding a valid seal: expensive. Billions of guesses, real electricity, real money.
• Checking a seal: free. Anyone hashes once and looks for the zeros.

This is proof-of-work. A valid chain is now a chain someone provably burned energy to build. To rewrite history, Mallory must redo all that work — and outrun everyone honest adding new blocks at the same time. Cheating stops being a hack and becomes a hardware-and-electricity bill.

Work also answers a question we'd been ignoring: with no bookkeeper, who writes the next page? Answer: whoever wins the lottery. And they're paid for it — the winner writes themselves a reward of brand-new coins. That's mining: the security budget and the money-printing press are the same mechanism.

Our chain guards the past, but nothing stops me from writing a new entry: "Asha pays me everything." With no bank checking IDs, how does the notebook know an entry is authorized?

Handwritten signatures fail digitally — they're copy-pasteable. The answer is a digital signature, built from a mathematically linked pair of keys:

• A private key — a giant random number only you know. This is your identity. Effectively: your money.
• A public key — derived from the private key, shareable with everyone. (Your "address" is essentially a hash of it.)

Think of the pair as a padlock and its only key, but reversed from how you'd expect: you hand out open padlocks (public key) to the entire world, and only your key (private key) works them. Anyone can check the lock; nobody can copy the key from looking at the lock.

To authorize a payment you sign the message with your private key. Concretely, your wallet does two things you already understand: it hashes the transaction (Entry 02 — so the signature covers every character of it), then runs that hash through a math operation that only your private key can perform, but that your public key can check. The output — the signature — has two properties ink can't offer:

• Anyone can verify it using only your public key. No secret needs to be shared, ever.
• It's welded to the exact message. Change one character of "Pay Bo 10" and verification fails, because the message's hash changed. Copying a signature onto a different transaction achieves nothing.

The whole scheme rests on the same shape of magic as hashing: a one-way street. Private → public is instant math; public → private means searching a space of 2²⁵⁶ numbers. And because that's the only requirement, a blockchain account needs no signup, no email, no permission from anyone. Generate a random number and you have an account. Your "address" is essentially a hash of your public key — short, checkable, shareable.

One-way math sounds mystical, so let's shrink it until you can touch it. Take a small public formula: 5^k mod 100,003 — "multiply 5 by itself k times, keep only the remainder." Going forward from your secret k is instant. Going backward from the result to k has no shortcut: you just try every k. With a 5-digit secret your browser cracks it in a blink. Real keys are 78-digit secrets — same street, but now it's 10⁷² times longer than anything brute force can walk.

Everything so far still assumed one notebook. Final move: give a full copy to anyone who wants one. Thousands of computers (nodes) each hold the whole chain, hear about new transactions, and check every rule themselves — signatures, balances, seals. A bad transaction isn't rejected by an authority; it's ignored by everyone independently.

But copies drift. Two miners can win the lottery seconds apart, and the network briefly splits into two versions — a fork. Who's right? Bitcoin's rule is disarmingly simple:

Miners extend whichever branch they see; one branch soon pulls ahead; everyone abandons the loser (its transactions return to the queue, unharmed). Disagreement resolves itself in a block or two — no meetings, no vote, no chairman.

Now watch the security click into place. To undo a payment buried 6 blocks deep, an attacker must secretly build a longer chain from before that block — racing the entire honest network with a head start against them. With a minority of the world's hash power, the race is essentially unwinnable. This is why recipients wait for confirmations: every block stacked on top of your transaction is another block the attacker must outrun.

In October 2008 — weeks after Lehman Brothers collapsed — someone using the name Satoshi Nakamoto posted a nine-page paper to a cryptography mailing list. Almost nothing in it was new. Hash chains, proof-of-work, digital signatures — all existed. The genius was the assembly: each piece patching another's weakness until no trusted keeper remained. Look at what you've already built:

• Entry 01 — money is a ledger; the question is who keeps it.
• Entry 02 — hashes make any page tamper-evident.
• Entry 03 — chaining hashes makes all of history tamper-evident.
• Entry 04 — proof-of-work makes rewriting history economically absurd, and picks who writes next.
• Entry 05 — signatures replace the bank's ID check.
• Entry 06 — the longest-chain rule keeps ten thousand strangers' copies identical.

That's Bitcoin. Everything else is parameters. On 3 January 2009, Satoshi mined block #0 and embedded a message in it — that day's newspaper headline: "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." Both a timestamp and a thesis statement.

The life of one bitcoin payment

Money with a printed schedule

Central banks decide how much money exists. Bitcoin replaces that committee with four lines of code: miners earn a block reward that halves every 210,000 blocks (~4 years), summing to a hard ceiling of 21 million coins, ever. Monetary policy as physics — nobody can print more, and everybody can verify it.

Inside a real block

Enough abstraction — let's open one up. On 20 April 2024, a mining pool called ViaBTC won the lottery for block #840,000 — the block where the fourth halving triggered. It became famous for a second reason: a token-minting frenzy (the "Runes" launch) was underway, and users bid so hard for space in this specific block that its fees came to over 37 BTC — more than ten times the new 3.125 BTC subsidy. A preview of Bitcoin's far future, where fees, not fresh coins, pay for security.

Here is what a block actually is. Everything a miner grinds on — the famous 80-byte header — is just six fields, and you already understand five of them:

That's it. The thousands of transactions live in the block body; the header commits to them all through the Merkle root; and the network's hundreds of quintillions of guesses per second are aimed at hashing these 80 bytes. Every diagram you've ever seen of Bitcoin is a decoration of this table.

There are no balances — build a transaction and see

Now the body. Here's Bitcoin's strangest design choice: the ledger stores no account balances at all. It stores coins — officially, UTXOs (unspent transaction outputs), each one created as the output of some earlier transaction, each locked to a key (Entry 05), each of arbitrary denomination — like bills your printer prints in any amount.

A transaction melts down old coins and mints new ones. Inputs: whole UTXOs you unlock with signatures. Outputs: brand-new UTXOs locked to the recipients. There's no "subtract 0.6 from Asha" anywhere. Three consequences that confuse every newcomer:

• Change. You can't spend part of a coin. Pay 0.6 from a 1.0 coin and you mint two outputs — 0.6 to the merchant, ~0.4 back to yourself.
• Fees are the gap. Whatever inputs exceed outputs is silently claimed by the miner. Forget your change output and the miner keeps it — this has really happened.
• Your "balance" is a fiction your wallet computes by scanning the chain for UTXOs your keys can unlock.

In 2013, Vitalik Buterin — then a teenage Bitcoin Magazine writer — proposed generalizing the whole machine. Bitcoin's ledger stores balances guarded by (deliberately) limited scripts. What if the ledger could store programs, and every node ran them identically?

A smart contract is such a program: code plus its own money, living at an address on the chain. The classic mental model is a vending machine — it takes coins and releases soda by mechanism, not by trust. Nobody can talk it into a freebie; its rules are physics. A smart contract is a vending machine for any agreement: escrow, auctions, lending, insurance. Once deployed, not even its author can bend the rules — the same properties that made history immutable now make the code's execution immutable.

Two consequences follow immediately, and both run on ideas you already own:

• Gas. If anyone can upload code that thousands of nodes must run, someone will upload while(true). So every instruction has a price, paid in ETH. Your transaction carries a fuel tank; when it's empty, execution halts and reverts. Spam becomes unaffordable by construction.
• Accounts, not UTXOs. Contracts need persistent memory, so Ethereum drops Bitcoin's melted-coins model (Entry 07) and keeps real accounts: every address has a balance, a transaction counter, and — for contracts — code and storage.

So here is Ethereum, mechanically: one giant shared state — every account, every balance, every contract's variables — plus a rule for updating it. A block is no longer just "a page of payments"; it's a batch of state changes. Every node holds the full state, executes every transaction in the block through the EVM (the Ethereum Virtual Machine — a small, deliberately deterministic processor every node implements identically), and must arrive at the byte-identical new state. The blockchain machinery you learned in Entries 02–06 isn't replaced — it's now securing the history of a computer's memory instead of a cash ledger. A transaction's life looks familiar:

1. Sign — same as Bitcoin: your private key signs the call (Entry 05). Now it might say "call function contribute() on contract 0xAB… with 4 ETH" rather than "pay Bo."
2. Broadcast & queue — nodes gossip it; it waits in the mempool with a gas-price bid attached.
3. Execute — the block's proposer includes it; every node runs the contract's code, metering gas per instruction. If gas runs out or a require() fails, all its changes are rolled back — but the fee is still paid.
4. Commit — the block header commits to the entire resulting world state via (you guessed it) Merkle-style trees, so any single balance or storage slot can be proven with a short branch of hashes.

// the rules, forever, for everyone (simplified Solidity)
contract Crowdfund {
  goal = 10 ETH;  deadline = block 110;  creator = Dana;

  function contribute()  { require(block < deadline); }
  function withdraw()    { require(block ≥ deadline && raised ≥ goal && sender == creator); }
  function refund()      { require(block ≥ deadline && raised < goal); }
}

The Merge: replacing the furnace

Ethereum launched with Bitcoin-style mining, but in September 2022 it executed the Merge — swapping the security engine of a live $200-billion network, mid-flight, for proof-of-stake. Recall why proof-of-work exists (Entry 04): it's an anti-cheating mechanism — it makes writing history cost something real, so rewriting it costs more than it pays. Burned electricity was the collateral. Proof-of-stake keeps the collateral and drops the furnace: validators post the collateral up front, in money.

The mechanics, step by step:

• Stake to play. Anyone can lock up 32 ETH as a deposit to run a validator. No warehouse of machines — a laptop suffices. There are now around a million validators.
• Time is sliced into slots. Every 12 seconds, the protocol pseudo-randomly picks one validator to propose the next block. No lottery of hashes — the "who writes the next page?" question from Entry 04 is answered by drawing lots among depositors.
• The rest vote. A committee of other validators checks the proposed block and signs an attestation — "I've seen this block and it's valid." Honest proposing and attesting earn small rewards; being offline leaks small penalties.
• Votes accumulate into finality. Slots group into epochs (32 slots). When two-thirds of all staked ETH has attested across two consecutive epochs, the older one becomes finalized — and here's the upgrade over Bitcoin: not "exponentially unlikely to reverse" (Entry 06) but economically impossible. Reverting a finalized block provably requires at least one-third of all staked ETH — tens of billions of dollars — to sign contradictions… and be destroyed for it.
• Cheating is self-incriminating. The only way to attack is to sign conflicting statements — and your signatures (Entry 05!) are unforgeable proof of your own crime. Anyone can submit them to the chain, and the protocol slashes the traitor's deposit and ejects them. The whistleblower gets a bounty.

The result: identical guarantees of Entries 03–06, ~99.95% less energy, and stronger finality — at the cost of a subtler system with more moving parts, and a new debate about whether wealth-weighted influence centralizes differently than hardware-weighted influence did.

Where do all the other coins come from?

Here's the answer to a question that confuses almost everyone: there are 20,000+ "cryptocurrencies," but only a handful of actual blockchains that matter. That's because most coins aren't blockchains at all — they're smart contracts.

Think about what a currency needs: a table of who owns how much, and a rule for moving amounts between rows. You built exactly that in Entry 01 — and a smart contract can hold that table in its storage. A "token" is a contract with a balance table and a transfer() function. That's the whole thing. Ethereum standardized the interface in 2015 as ERC-20, so every wallet and exchange can talk to every token without custom code — and suddenly launching a currency took an afternoon, for better (stablecoins, in Entry 08's callout below) and for much worse (the 2017 ICO bubble, most memecoins).

The security inheritance is the beautiful part: PizzaCoin below has no miners, no validators, no network of its own. Its balance table lives in Ethereum's world state, so forging a PizzaCoin transfer requires defeating Ethereum's entire validator set. Tokens rent the fortress. (NFTs are the same trick with one twist: instead of balances[address] → amount, the table is tokenId → owner — a registry of unique items rather than a currency. That's the ERC-721 standard, the entire technical substance of the 2021 NFT boom.)

// an entire cryptocurrency (ERC-20, abridged)
contract PizzaCoin {
  mapping(address => uint) balances;   // ← the coin lives here. That's it.
  constructor() { balances[Dana] = 1000; }
  function transfer(to, amount) {
    require(balances[sender] >= amount);
    balances[sender] -= amount;  balances[to] += amount;
  }
}

Bitcoin vs Ethereum, side by side

Same foundations — Entries 01 through 06 apply to both, line by line — but tuned for opposite goals. Bitcoin optimizes for being unchangeable money; Ethereum optimizes for being a programmable platform, and accepts extra complexity everywhere to get it.

After Ethereum proved the world computer could exist, a wave of would-be "Ethereum killers" appeared. Most are footnotes. Solana is worth a chapter, because it made one specific, contrarian bet — and to understand it, you have to see the bottleneck it attacks.

Why are blockchains slow? Not because hashing is slow — your browser did four hundred thousand hashes a second in Entry 04. They're slow because thousands of strangers must agree on the order of events. Bitcoin buys agreement with 10-minute lottery rounds (Entry 04); Ethereum with 12-second voting slots (Entry 08). Most of the Byzantine generals' messages, it turns out, are spent arguing about when things happened — because in a network with no trusted party, you can't trust anyone's wristwatch.

In 2017, Anatoly Yakovenko — a Qualcomm engineer who'd spent a career on precisely-clocked radio networks — had the insight: you can't trust a wristwatch, but you can trust math. His proof of history is a clock built from Entry 02:

• Take a hash. Hash it. Hash the result. Hash that result. Forever. Each output is the next input, so the chain cannot be computed in parallel — hash #1,000,000 is unreachable without doing the 999,999 before it, one by one.
• Therefore a long chain of hashes is proof that real time passed. Not "trust me, it's 3 PM" — provable, physical elapsed time, made of the same SHA-256 you already know.
• Now fold events into the stream: mix a transaction into the running hash, and every hash after it becomes cryptographic proof the transaction came before them. Events get verifiable timestamps before consensus even starts.

Proof of history is not a consensus mechanism — Solana still uses proof-of-stake (Entry 08's validators, stake, and slashing). PoH is the shared clock that makes the consensus fast: with time itself already agreed, validators stop debating order and just verify. Leaders are scheduled in advance — everyone knows who proposes the next block, so transactions stream directly to them (no mempool waiting room), and blocks tick every ~400 milliseconds for fees of a fraction of a cent.

The second trick: run everything at once

A fast clock isn't enough — you also have to execute faster. Recall Entry 08: the EVM runs transactions one at a time, because any contract might touch any storage, so the only safe order is single-file. Solana's runtime (Sealevel) demands one thing in exchange for speed: every transaction must declare up front which accounts it will read and write. With the touch-lists known, the scheduler can prove that two transactions can't collide — and run them simultaneously on different CPU cores, like a bank with a thousand tellers instead of one.

One more inversion worth knowing: on Ethereum, a contract owns its storage — code and data live together at one address. On Solana, programs are stateless: code lives in one account, data lives in other accounts the program owns. It's why account touch-lists are even possible — and why Solana tokens (SPL tokens) are cheaper than Ethereum's: there's one shared, audited token program for the whole chain, and "launching a coin" just means creating a small data account that points at it. PizzaCoin from Entry 08, without even deploying code. (This is the machinery behind 2024–25's memecoin flood — the cost of launching a token fell to pocket change, with exactly the consequences you'd predict.)

What the speed costs

By now you know the iron rule of this course: every design buys its advantage somewhere. Bitcoin pays for validate-at-home decentralization with throughput. Solana pays for throughput in two currencies:

• Hardware. Keeping up with 400ms blocks and parallel execution takes a serious server — hundreds of gigabytes of RAM, datacenter bandwidth. A laptop in anyone's home cannot be a Solana validator; there are ~1,500 of them, versus tens of thousands of Bitcoin and Ethereum nodes. The Yap villagers' notebook is now kept by fewer, stronger hands.
• Fragility under load. The young network paid its tuition in public: roughly seven full or partial outages between 2021 and early 2024 — spam floods, a bot crush during an NFT mint, consensus bugs — each requiring validators to coordinate a restart. Bitcoin and Ethereum have never halted. Engineering since (fee markets that localize congestion, the independent Firedancer client) has kept it outage-free since, but the record is part of the ledger.

The three machines, side by side

The whole course in one paragraph

Money is a ledger, and the hard problem is who keeps it. Hashes make records tamper-evident; chaining them makes all of history tamper-evident; proof-of-work (or staked capital) makes rewriting history cost more than it pays; signatures replace the ID check; and the longest-chain rule lets ten thousand strangers hold identical copies with nobody in charge. Bitcoin is that machine tuned to be money with a fixed supply. Ethereum is the same machine generalized to run arbitrary programs. Solana is the same machine again, betting that a hash-chain clock and parallel execution can make it fast enough for everyday payments — at the price of heavier hardware in fewer hands. Everything else in crypto — good, bad, and fraudulent — is built on top of those moves.

A sober footnote

This course explained how the machine works — not what any token is worth. The technology being genuinely clever doesn't make prices go up, and most of the 20,000+ tokens in existence are built on none of the careful trade-offs you just studied. If you take one protective habit from Entry 05: anyone who asks for your seed phrase is stealing from you, without exception.

Glossary — the vocabulary you've earned

Ledger

The list of who owns what. The actual substance of money. (Entry 01)

Double-spend

Spending the same digital coin twice — the problem that stalled digital cash for 30 years. (Entry 01)

Hash / SHA-256

A one-way fingerprint function: any input → unforgeable 64-hex-char output. (Entry 02)

Block / blockchain

A page of transactions sealed by a hash that includes the previous page's hash. (Entry 03)

Merkle root

One hash that commits to thousands of transactions via a tree of hashes. (Entry 03)

Nonce

The junk number miners vary to fish for a winning hash. (Entry 04)

Proof-of-work / mining

The guessing lottery that makes blocks expensive to create, cheap to verify — and mints new coins. (Entry 04)

Private / public key

Your secret identity number, and its shareable verification twin. (Entry 05)

Digital signature

Proof a specific message was approved by a specific private key. (Entry 05)

Node

A computer holding the full ledger and checking every rule independently. (Entry 06)

Fork / confirmations

A temporary split in the chain; the blocks buried above your transaction that make it irreversible. (Entry 06)

51% attack

Controlling most mining power to rewrite recent history. Possible, ruinously expensive. (Entry 06)

UTXO

Bitcoin's coin model: transactions consume whole "coins" and mint new ones, with change. (Entry 07)

Halving

The block reward cutting in half every ~4 years, enforcing the 21M cap. (Entry 07)

Smart contract

Code with its own money, living on-chain, whose execution nobody can override. (Entry 08)

Gas

Per-instruction fees that make infinite loops and spam unaffordable. (Entry 08)

Merkle proof

The log₂(n) sibling hashes that prove one transaction belongs to a block's root. (Entry 03)

Proof-of-stake / slashing

Security via locked collateral that the protocol destroys on provable cheating. (Entry 08)

Validator / epoch / finality

A 32-ETH depositor; a bundle of 32 block slots; the point where reversal provably costs ⅓ of all stake. (Entry 08)

ERC-20 token

A currency implemented as one contract's balance table — no blockchain of its own; it rents Ethereum's. (Entry 08)

Rollup / Layer 2

Doing transactions off-chain in bulk, settling proofs on-chain. (Entry 08)

Proof of history

Solana's clock: a sequential hash chain that proves time passed and timestamps events before consensus. (Entry 09)

Sealevel / SPL token

Solana's parallel runtime (transactions declare their accounts up front); its token standard — one shared program, no code to deploy. (Entry 09)