Bitcoin's supply is mathematically capped at approximately 21 million units and is released on a predetermined, transparent issuance schedule encoded in the protocol itself. New bitcoin enters circulation only as a block subsidy paid to miners who successfully add blocks to the chain. The subsidy started at 50 BTC per block in January 2009 and halves every 210,000 blocks — roughly every four years — until it reaches zero around the year 2140, after which no new bitcoin is ever created. The schedule is the engineering instantiation of every hard-money principle: it makes Bitcoin's monetary properties verifiable, predictable, and structurally beyond political manipulation.
Why this note matters
Every theoretical argument — about hard money, time preference, the Cantillon effect, monetary debasement, civilizational decay — rests on the claim that Bitcoin’s supply is actually fixed, actually verifiable, and actually beyond political reach. If those claims are not true at the engineering level, the entire intellectual framework collapses, and Bitcoin reduces to another currency with promises that can be broken. If they are true, Bitcoin is the practical realization of the hard-money ideal Austrians argued for over 150 years — and the most important monetary innovation since the invention of coinage.
This note documents the engineering: the math, the code, the schedule, the actual numbers. The point is to demonstrate the substance behind the abstract claims with specifics rather than slogans. See: Hard money vs fiat money, Bitcoin as emergent money, Proof of Work.
The 21 million cap
The number itself
The maximum supply of Bitcoin is 20,999,999.9769 BTC — universally referred to as “21 million” since the difference is trivial. The cap is the mathematical sum of all block subsidies that will ever be paid out across all 33 halving cycles.
The number 21 million is not specified directly as a constant anywhere in the Bitcoin code. Instead, it is the emergent consequence of a few specific code parameters:
- Initial block subsidy: 50 BTC per block
- Halving interval: every 210,000 blocks
- Block target: one new block every 10 minutes (on average)
- Indivisibility: bitcoin is divisible only down to satoshis (1/100,000,000 of a BTC)
These four parameters, together with the bitwise-shift operator used to perform the halving, define the entire issuance schedule. The 21 million cap is not a number anyone chose to write down — it is the mathematical consequence of the schedule itself.
This matters. Critics sometimes argue, “If 21 million isn’t literally in the code, how do you know it’s the limit?” The answer is that the limit is implied by the code with mathematical certainty — and any change to that limit would require a hard fork that the network would, by overwhelming consensus, reject.
Why specifically 21 million?
Satoshi Nakamoto admitted in a 2009 email to Martti Malmi that the choice of 21 million was an “educated guess.” The reasoning he gave: at full adoption, prices denominated in bitcoin should be in a reasonable range relative to existing fiat currencies. Too few coins and bitcoin-denominated prices would be impractically small fractions; too many and they would be unwieldy.
But Nakamoto was clear that the specific number was less important than the fact that there was a number at all. The essential property is mathematical finitude, not the specific magnitude.
This is correct. From a monetary standpoint, what matters is that the supply cannot be expanded, not the precise level of the cap. The cap could have been 10 million or 100 million and the monetary properties would be the same.
Satoshis: the actual unit
Bitcoin is divisible to 8 decimal places — into 100,000,000 units per bitcoin. Each smallest unit is called a satoshi (or “sat”), in honor of Nakamoto.
The math:
- 1 bitcoin = 100,000,000 satoshis
- Total bitcoin supply ≈ 21,000,000 BTC
- Total satoshi supply ≈ 2,100,000,000,000,000 (2.1 quadrillion satoshis)
This is enough divisibility to denominate any conceivable amount of global wealth. Even if all global household wealth (currently in the range of $400–500 trillion) were stored in bitcoin, there would be roughly 4,000+ satoshis per dollar of wealth. The system can scale up in value without running out of accounting units.
Satoshis are the actual unit of account at the protocol level. The “bitcoin” is a convenient human-readable label, but at the code level, all balances and transactions are denominated in satoshis. This is important because it means the supply cap is not really “21 million” but rather “2.1 quadrillion satoshis” — a number large enough to denominate arbitrary global wealth.
See: Satoshi (unit) (not yet built), Bitcoin divisibility (not yet built).
The issuance schedule
How new bitcoin enters circulation
There is exactly one way that new bitcoin enters circulation: the block subsidy, paid to whichever miner successfully adds the next block to the blockchain.
- A miner does the proof-of-work computation
- The miner finds a valid block hash
- The miner broadcasts the new block to the network
- The network verifies the block according to consensus rules
- The miner receives the block reward (subsidy + transaction fees)
- The new bitcoin enters circulation in the miner’s wallet
There is no other path. No central authority can issue new bitcoin. No emergency mechanism. No discretionary expansion. This is the entire mechanism.
For context: this is a fundamentally different model from fiat money, where new currency can be created by:
- Central bank asset purchases (open market operations, QE)
- Commercial bank lending against fractional reserves
- Government direct spending
- Emergency authorizations
Bitcoin has none of these channels. New supply enters only through proof-of-work mining, only at the predetermined rate, only on the predetermined schedule.
See: Bitcoin mining (not yet built), Proof of Work, Block subsidy vs transaction fees (not yet built).
The block subsidy decreases over time
The initial block subsidy was 50 BTC. This was paid from the genesis block (January 3, 2009) through block 209,999.
Every 210,000 blocks, the subsidy is cut in half. This is called the halving (sometimes “halvening”). The sequence of subsidies:
| Halving | Block range | Subsidy (BTC) | Approximate date |
|---|---|---|---|
| Genesis | 1 – 209,999 | 50 | Jan 2009 – Nov 2012 |
| 1st | 210,000 – 419,999 | 25 | Nov 2012 – Jul 2016 |
| 2nd | 420,000 – 629,999 | 12.5 | Jul 2016 – May 2020 |
| 3rd | 630,000 – 839,999 | 6.25 | May 2020 – Apr 2024 |
| 4th | 840,000 – 1,049,999 | 3.125 | Apr 2024 – ~2028 |
| 5th | 1,050,000 – 1,259,999 | 1.5625 | ~2028 – ~2032 |
| … | … | … | … |
| 32nd | ~6,930,000 onward | ~0.00000001 (1 sat) | ~2136 |
| 33rd | ~7,140,000 onward | 0 | ~2140 |
After the 33rd halving, the block subsidy permanently reaches zero. Miners will earn only transaction fees for adding new blocks. No new bitcoin will ever be created.
Why the cumulative supply approaches 21 million
The math:
Each halving “epoch” (the 210,000 blocks between halvings) issues:
Total epoch issuance = 210,000 blocks × subsidy per block
- Epoch 0 (50 BTC): 210,000 × 50 = 10,500,000 BTC (50% of total)
- Epoch 1 (25 BTC): 210,000 × 25 = 5,250,000 BTC (25% of total)
- Epoch 2 (12.5 BTC): 210,000 × 12.5 = 2,625,000 BTC (12.5% of total)
- Epoch 3 (6.25 BTC): 210,000 × 6.25 = 1,312,500 BTC
- And so on…
This is a geometric series. The sum of an infinite geometric series with first term 10,500,000 and ratio 0.5 converges to:
10,500,000 / (1 - 0.5) = 21,000,000
In practice, the series terminates earlier because the subsidy hits the divisibility floor (1 satoshi) and rounds to zero. The actual terminal supply is 20,999,999.9769 BTC — slightly less than 21 million due to the indivisibility of satoshis.
This is what people mean when they say “bitcoin is asymptotic to 21 million.” The mathematical convergence is built into the schedule.
The 4-year cycle
The 210,000-block interval, at 10 minutes per block, equals:
- 210,000 × 10 minutes = 2,100,000 minutes
- ÷ 60 = 35,000 hours
- ÷ 24 = ~1,458 days
- ÷ 365 = approximately 4.0 years
This is why halvings occur “every four years.” But notice: the schedule is denominated in blocks, not in time. If miners produce blocks faster than 10 minutes on average, halvings happen sooner. If slower, later. The difficulty adjustment (every 2,016 blocks, about every two weeks) keeps block times close to 10 minutes on average, so the 4-year cadence is approximate but stable.
This block-based denomination matters. It means the schedule is invariant to clock time. If mining were temporarily slowed or accelerated, the issuance per block stays the same; only the calendar date of each halving shifts. The monetary properties are preserved regardless.
See: The halving - Mechanism, Difficulty adjustment, Bitcoin mining mechanics (not yet built).
Current state of issuance
As of May 2026, approximately 95.2% of all bitcoin that will ever exist has been mined. The total circulating supply is around 20 million BTC.
The remaining ~1 million bitcoin will be issued over the next 114 years, with the final fractions mined around 2140. Because of the halving schedule, the rate of new issuance decelerates exponentially:
- 2009–2012: 50% of total supply issued (the first 10.5 million BTC)
- 2012–2016: 25% issued (5.25 million BTC) — cumulative 75%
- 2016–2020: 12.5% issued (2.625 million BTC) — cumulative 87.5%
- 2020–2024: 6.25% issued (1.3125 million BTC) — cumulative ~93.75%
- 2024–2028: 3.125% issued — cumulative ~96.875%
- And so on…
By 2032, roughly 98.5% of all bitcoin will have been issued. The “long tail” from 2032 to 2140 will issue only the final 1.5%.
This is fundamentally different from fiat money expansion. The US M2 money supply has roughly tripled since 2008. Bitcoin’s issuance over the same period (2008-present) has been entirely on the predetermined schedule — predictable to the satoshi, transparent to anyone running a node.
See: Bitcoin scarcity over time (not yet built), Stock-to-flow model.
The halving
The halving is the single most important event in Bitcoin’s monetary calendar. It deserves its own treatment, but the basic mechanics are worth establishing here:
What happens at a halving
At the moment block N × 210,000 is mined (for N = 1, 2, 3, …), the block subsidy paid to the miner of block N × 210,000 + 1 is half what it was for the previous block. This is not a vote, an announcement, or a policy decision. It is a deterministic operation in the protocol code.
The four halvings so far
- First halving (November 28, 2012): subsidy reduced from 50 to 25 BTC
- Second halving (July 9, 2016): 25 to 12.5 BTC
- Third halving (May 11, 2020): 12.5 to 6.25 BTC
- Fourth halving (April 19/20, 2024): 6.25 to 3.125 BTC
The next halving (fifth) is projected for approximately April 2028, reducing the subsidy from 3.125 to 1.5625 BTC.
Why halvings matter beyond mechanics
The halving has profound monetary and market implications:
- Hardness increases discontinuously. At each halving, Bitcoin’s stock-to-flow ratio roughly doubles. Bitcoin becomes harder money overnight.
- Mining economics shift. Miner revenue (in BTC terms) is cut in half. Inefficient miners are squeezed out. The mining industry consolidates and matures.
- Market cycles correlate. Historically, the post-halving 12-18 months have coincided with significant Bitcoin price appreciation. Whether this is causation or correlation, and whether it will continue, is a major topic in market analysis.
- Adoption narrative. Each halving generates global attention, drawing new participants to the network.
The halving deserves its own dedicated note. It is referenced everywhere — in monetary theory, in price models, in cultural events, in market psychology.
See: The halving - Mechanism, Stock-to-flow model, Four-year halving cycles.
The transition from subsidy to fee-based security
A foundational question for Bitcoin’s long-term economics: what happens when the block subsidy approaches zero?
The current Bitcoin security budget is funded almost entirely by the block subsidy. Miners earn ~3.125 BTC per block (currently around $200,000+ at current prices) for the subsidy, plus a smaller amount in transaction fees. As the subsidy shrinks, miners must increasingly be compensated through transaction fees.
The fee market thesis
The expected mechanism: as Bitcoin’s settlement value grows and block space becomes more valuable, transaction fees will rise to replace the subsidy. Users will pay competitive fees for block-space access, miners will earn enough to continue securing the network, and Bitcoin’s security model will smoothly transition.
This is plausible. Already, on high-demand days (during major rallies or NFT/ordinals booms), fee revenue has briefly approached or exceeded subsidy revenue.
The concern
Critics argue the transition is not guaranteed. If transaction fees do not rise enough to replace the subsidy, miner revenue collapses, hash rate falls, and Bitcoin’s security degrades. A future attacker could acquire the necessary hash power more cheaply.
This is sometimes called the “end of subsidy” problem or “fee market vulnerability” — and it is one of the most-discussed long-term concerns about Bitcoin’s design.
The responses
Several considerations argue against this being a fatal flaw:
- Time horizon is enormous. The subsidy doesn’t approach zero for over a century. By then, Bitcoin will either have achieved sufficient adoption to support a robust fee market or will have failed for other reasons.
- High-value settlement is fee-tolerant. Settling 100 fee. The base layer is increasingly used for high-value settlement (not coffee purchases), and high-value settlement can sustain high fees.
- Lightning and other layers reduce base-layer demand pressure on small transactions, leaving the base layer for high-value settlement. This is the layered-money thesis.
- The security budget required scales with the value of the network. As Bitcoin’s value grows, the cost of attacking it grows proportionally — the fee market doesn’t need to match fiat-era spending, only to be high enough relative to the cost of mounting a 51% attack.
This is a real open question in Bitcoin economics, not a slam-dunk for either side. But it is also a question for the 22nd century, not the 21st.
See: Bitcoin security budget (not yet built), Transaction fees (not yet built), The Lightning Network.
Can the 21 million cap be changed?
This is the question critics most often raise. The technical answer is: theoretically yes, practically no.
What it would technically require
To change the hard cap would require:
- A code change to the Bitcoin Core software (or a competing implementation)
- A hard fork — a backward-incompatible change to the consensus rules
- Adoption by the supermajority of the network: nodes, miners, exchanges, users, and businesses
- Acceptance by holders — anyone who keeps using the original protocol would be on a different chain
Why it won’t happen
The economic and game-theoretic obstacles are overwhelming:
- Holders would resist. The 21 million cap is the central monetary property that gives Bitcoin its value. Inflating the supply would destroy the very reason people hold it. Holders have the strongest stake in preventing this.
- Miners would lose money in fiat terms. Although miners would earn more BTC, the value of BTC would collapse, leaving miners worse off. Miners pay their bills in fiat. They cannot afford to destroy the asset they are paid in.
- Exchanges would resist. Listing an inflated-supply Bitcoin would risk customer flight to the original. Exchanges have strong reputational incentives to side with the supply cap.
- The community ethos is uncompromising. The 21 million cap is the single most non-negotiable feature in Bitcoin culture. Any developer proposing to change it would lose credibility immediately and permanently.
- A minority chain preserving 21 million would exist. Even if a majority somehow voted to inflate, anyone preferring the original would simply continue running the original code. This minority chain would retain Bitcoin’s monetary properties and probably retain the “Bitcoin” name in market understanding.
The closest historical parallel is the Block Size Wars of 2015–2017, when a contingent of large miners and businesses tried to force a hard fork to increase the block size. They failed. The community defended the protocol’s core properties, and the dissenters split off into a separate chain (Bitcoin Cash) that has been economically irrelevant ever since.
The lesson: Bitcoin’s core monetary properties are protected not by a single point of authority but by a distributed equilibrium of holders, miners, businesses, and developers who each have strong incentives to maintain the existing rules.
See: Block Size Wars - History, Bitcoin Cash fork, Bitcoin governance (not yet built).
Why this matters for the hard-money thesis
The fixed supply and predictable issuance are what make Bitcoin distinct from every previous money in human history, including gold.
Comparison with gold
Gold is hard, but not perfectly hard:
- Gold’s stock-to-flow ratio is around 60 (60 years of existing supply at current production rates)
- Gold’s annual production has averaged 1.5–2% historically, even during high-demand periods
- But gold production can be expanded by opening new mines, improving extraction technology, or even (eventually) asteroid mining
- Gold’s hardness is bounded by physics, not by an absolute cap
Bitcoin is harder:
- Bitcoin’s current stock-to-flow ratio is approximately 120 (and rising)
- Bitcoin’s annual issuance is currently ~0.83% and decreasing on schedule
- Bitcoin’s production cannot be expanded by any means
- Bitcoin’s hardness is bounded by mathematics, with an absolute cap
By approximately 2028, after the next halving, Bitcoin’s stock-to-flow will be approximately 240. By 2032, approximately 480. The hardening continues indefinitely until issuance reaches zero around 2140.
This is the engineering meaning of “the hardest money in history.” It is not rhetoric. It is a quantifiable, verifiable, monotonically increasing property.
Comparison with fiat
Comparison with fiat money is even starker:
- The US dollar supply (M2) has grown from approximately 22 trillion today — roughly 4.8x in 18 years
- Bitcoin’s supply has grown from 0 to approximately 20 million in the same period, but on a predetermined, decelerating schedule
- The US dollar’s expansion is at the discretion of the Federal Reserve
- Bitcoin’s expansion is at the mercy of mathematics
There is no comparison that makes fiat look like hard money. Bitcoin’s issuance is, by orders of magnitude, more constrained and more predictable than any state-issued currency.
See: Hard money vs fiat money, Stock-to-flow model.
The Austrian-Bitcoin synthesis on issuance
This note’s content maps onto the Austrian framework as follows:
| Austrian principle | Bitcoin instantiation |
|---|---|
| Money should emerge on the market | Bitcoin emerged from cypherpunk experimentation, not state decree |
| Sound money has constrained supply | 21 million cap with declining issuance |
| Money’s supply growth should be predictable | Issuance schedule is deterministic and transparent |
| Money should be politically neutral | No issuing authority can be pressured |
| Money should be verifiable | Anyone can run a node and verify total supply |
| Money should be costly to produce | Proof-of-work imposes real energy cost |
| Inflation is wealth transfer (Cantillon) | Bitcoin’s issuance schedule eliminates this dynamic over time |
| Hard money lowers time preference | Holding Bitcoin reinforces patient long-term saving |
The 21 million cap and the halving schedule are not arbitrary technical choices. They are the engineering implementation of every monetary principle the Austrian tradition argued for — translated from physical commodity money (gold) into pure mathematical scarcity.
This is what Bitcoiners mean when they call Bitcoin “engineered ethical money.” The ethical framework comes from Austrian economics. The engineering implementation comes from cryptography and proof-of-work. The two combine to produce something that has never existed before: a money whose hardness is provable, predictable, and beyond political manipulation.
Lost coins and effective supply
A subtle point worth understanding: the effective supply of bitcoin is less than the nominal supply.
Why coins are lost
- Lost private keys. Early adopters who failed to secure their keys.
- Forgotten wallets. People who acquired small amounts of bitcoin years ago and forgot about them.
- Death without inheritance planning. Owners who died without sharing their keys.
- Hardware failures. Drives that crashed without backups.
- Discarded hard drives. The famous case of James Howells, who threw away a hard drive containing ~8,000 BTC in 2013.
- Untouched early coins. Many coins from the 2009–2010 era have never moved and are presumed lost or held by Satoshi himself.
Estimates of lost coins
Various estimates put the number of permanently lost bitcoin at 2.3–3.7 million BTC — roughly 11–18% of the 21-million supply (Chainalysis), with some analyses running as high as ~4 million. This is unverifiable in detail (lost coins are indistinguishable from coins simply held in cold storage), but the order of magnitude is widely accepted.
Implications
- Effective circulating supply is closer to 17–19 million than 21 million
- Bitcoin’s actual hardness is therefore even greater than the schedule alone implies
- Newly mined bitcoin must distribute against a smaller real supply
- Lost coins are effectively a one-way deflation — they reduce the supply without anyone benefiting
This is one of Bitcoin’s quietly remarkable properties. Gold, when lost, can sometimes be recovered (shipwrecks, lost mines). Bitcoin, when truly lost, is gone forever. Every lost coin increases the scarcity for everyone else, with no countervailing mechanism.
See: Lost bitcoin (not yet built), Self-custody and inheritance (not yet built), Bitcoin death and recovery (not yet built).
Counter-arguments and tensions
The fixed-supply design faces specific objections. The Bitcoin-specific cap-mechanism critiques are addressed here; broader monetary-economic critiques are treated in the Criticisms of Bitcoin section.
“The 21 million cap is arbitrary; why is it sacrosanct?” The specific number is arbitrary; the fixity is not. Any cap, once established and accepted, becomes the focal point that secures the network’s monetary properties. Changing the cap — to any number — would destroy credibility of fixity, which is the actual property that matters.
“What if everyone agrees to inflate?” They won’t. The incentives against agreement are overwhelming (holders lose; miners lose long-term; node operators preserving fixity is a credible commitment). Theoretically possible; practically vanishingly unlikely.
“What if the schedule has a bug?” The 2010 “value overflow” incident demonstrated emergency-response capability; the open-source-and-verified-by-every-node architecture makes bugs detectable and correctable. Risk is not zero but extraordinarily low.
The macroeconomic deflationary-spiral objection to a fixed-supply standard is the strongest mainstream critique and is treated substantively in Fixed-supply and deflation critique. The wealth-concentration objection (early holders accumulate disproportionately under fixed supply) is treated in Wealth concentration in Bitcoin and Cantillon-distribution and wealth-transfer critique. The long-term security budget objection (declining subsidy may not be replaced by sufficient fees) is treated in Long-term security budget. The quantum computing threat to signature schemes is treated in Quantum computing threat to Bitcoin; the migration path is operationally feasible within realistic timelines but execution risk is real.
Open questions for further development
- The post-2140 fee-only era is more than a century away. What can we plausibly model about it now, and what is genuinely unknowable?
- If Bitcoin completes its monetization (i.e., becomes a global reserve asset), does the rate of new issuance even matter anymore? Are we already effectively in a “fixed supply” world for monetary purposes?
- How should Bitcoin-collateralized credit markets handle the fact that Bitcoin’s supply is fixed — does it eventually create deflationary pressure within those markets, or does it stabilize?
- The 21 million cap is denominated in nominal bitcoin. As lost coins accumulate, the effective cap shrinks. Is there an equilibrium for the effective supply, or does it monotonically decline forever?
- Bitcoin’s issuance is denominated in blocks, not time. If a future event significantly altered block production (catastrophe, regulation, technological change), the issuance schedule would stretch in calendar time. What does this mean for monetary properties?
Canonical sources for this note
Primary technical
- The Bitcoin Core source code, specifically
GetBlockSubsidy()insrc/validation.cpp(or its current location) - Bitcoin: A Peer-to-Peer Electronic Cash System, Satoshi Nakamoto (2008) — the whitepaper
- Bitcoin Wiki, “Controlled supply” article — detailed mechanical explanation
- BIP-0042 — addresses the original Bitcoin issuance schedule
Accessible technical explanations
- Unchained Capital, “How does the bitcoin source code define its 21 million cap?” — code-level walkthrough
- Strike.me, “What is the bitcoin supply schedule?” — clean explanation with tables
- River.com Bitcoin glossary — multiple relevant entries
- Bitcoin Magazine articles on the halving and issuance
Hard-money economic analysis
- The Bitcoin Standard, Saifedean Ammous (2018) — especially the chapters on Bitcoin’s monetary properties
- Broken Money, Lyn Alden (2023) — places Bitcoin’s issuance in historical monetary context
- Layered Money, Nik Bhatia (2021)
- Various stock-to-flow analyses (PlanB and others, with appropriate skepticism)
Long-term security and fee market
- Multiple papers on Bitcoin’s transition to fee-based security
- Discussions in the bitcoin-dev mailing list
- Mastering Bitcoin, Andreas Antonopoulos — technical reference for issuance mechanics
For implementation details
- Bitcoin Core developer documentation
- Bitcoin Optech newsletters — ongoing technical coverage
- Various BIPs related to supply and consensus
Related notes
- Hard money vs fiat money — broader case
- The halving - Mechanism — the cyclical mechanism implementing the schedule
- Bitcoin as emergent money — emergence of the 21M cap as Schelling point
- Store of value vs medium of exchange vs unit of account — function framework
- Monetization S-curve — adoption-curve trajectory
- Bitcoin vs gold — fixed-supply vs. gold’s stock-to-flow
- Bitcoin vs real estate as SoV — fixed-supply contrast with elastic asset classes
- Bitcoin vs equities as SoV — fixed-supply contrast with productive-asset classes
- Criticisms of Bitcoin — engages “supply cap could change” critiques
- Mises and the theory of money — regression-theorem context
- Hayek on denationalization of money — Hayekian rule-based money
- Rothbard and sound money — 100%-reserve framework instantiated
- Austrian Business Cycle Theory — fixed-supply rules out credit-driven cycles
- Origins of money — Mengerian framework applied
- Carl Menger — salability foundations
- Satoshi Nakamoto — the original design choice
- Saifedean Ammous — hardness framework
- Vijay Boyapati — monetization framework
- Pieter Wuille — protocol-development context
- Greg Maxwell — protocol-development context
- Stock-to-flow model — quantitative hardness framework
- The Power Law model — alternative price-trajectory framework