Timechain Wiki

b-money

11 min read

b-money is Wei Dai's November 1998 proposal, posted to the cypherpunks mailing list, for "an anonymous, distributed electronic cash system" — under 2,000 words containing two protocols: an ideal one in which every participant maintains the full ledger, and a practical one in which bonded servers do. It contributed the framing Bitcoin inherits — money as a shared ledger maintained by distributed consensus, with new units created through demonstrable computational work — while explicitly leaving the consensus mechanism itself unsolved. It is the first reference cited in the Bitcoin whitepaper, and the documented Satoshi–Dai correspondence in the weeks before publication is among the few direct contacts between Satoshi and a named predecessor. Distinctively, b-money's money-creation rule targets stable purchasing power against a commodity basket — a deliberate monetary-policy choice that separates Dai from the fixed-supply tradition Bitcoin founded. For Dai's biography and later views, see Wei Dai; for the surrounding lineage, see Pre-Bitcoin attempts at internet money.

Why this note matters

b-money holds the citational pole position in Bitcoin’s genealogy — reference [1] of the whitepaper — while being, on the substance, less architecturally close to Bitcoin than Bit Gold. That tension (cited but distant, versus uncited but near) is itself one of the most instructive facts about how Bitcoin’s prior art actually functioned, and evaluating it requires knowing what the proposal really says rather than what the citation implies. The lineage narrative places b-money among its peers in Pre-Bitcoin attempts at internet money; this note is the dedicated treatment of the proposal itself — its two protocols, its unusual monetary policy, and the correspondence that put it into the whitepaper.

The crypto-anarchist frame

The proposal opens with a declaration of intellectual lineage: “I am fascinated by Tim May’s crypto-anarchy.” Where most digital-cash work of the era framed itself as payments engineering, Dai frames b-money as infrastructure for a polity — a community “where the threat of violence is impotent because violence is impossible, and violence is impossible because its participants cannot be linked to their true names or physical locations.” In such a community, government is not fought but rendered “permanently forbidden and permanently unnecessary” — and that community needs a medium of exchange and a way to enforce contracts that requires neither.

The frame matters for reading the design. b-money is not primarily an anti-inflation project (as the Austrian tradition would motivate it — see Austrian economics foundations) nor an anti-bank project (as David Chaum’s ecash was); it is a statelessness project, and its two protocols, its money-creation rule, and its contract-enforcement machinery all follow from the requirement that no component depend on identity or jurisdiction. The through-line from Tim May’s crypto-anarchy through b-money to Bitcoin’s censorship-resistance case is direct (see Cypherpunk movement and Bitcoin as freedom money).

Protocol one — the impractical ideal

In the first protocol, every participant maintains a complete database of how much money belongs to each pseudonym. Money transfers are signed messages broadcast to all participants, who each update their local copy of the ledger. Contracts are formed by broadcast agreement, with penalty deposits held in escrow by the collective bookkeeping.

Dai is candid that this protocol is impractical: it “makes heavy use of a synchronous and unjammable anonymous broadcast channel” — every participant must see every message, reliably and in order. Stated in later vocabulary, protocol one assumes away both the network-layer problem (reliable broadcast) and the consensus problem (what happens when local ledgers disagree). Its value is as a specification of the goal: a fully replicated public ledger with no privileged party — the exact shape Bitcoin’s ledger takes, minus the mechanism that makes replicas converge.

Protocol two — servers and bonds

The second protocol introduces a division of labor: a subset of participants — servers — maintain the ledger, publish their databases, and process transactions, while ordinary users verify by spot-checking that servers’ copies agree and that their own transactions land. To keep servers honest, each must deposit a monetary bond into a special account, forfeitable on proven misbehavior.

This is recognizably a federated model — and Dai’s honesty about its weaknesses is part of the proposal’s enduring credibility: collusion among servers is not prevented, only disincentivized; the bond mechanism needs the very money system it secures; and nothing specifies who may become a server, which is the Sybil problem stated plainly. The economic-incentive instinct — make honesty profitable and cheating costly, rather than assuming honest parties — is the piece of protocol two that survives into Bitcoin’s design, transplanted from bonded servers onto proof-of-work miners whose “bond” is sunk energy expenditure (see Proof of Work).

Money creation and the commodity-basket rule

b-money’s most distinctive — and least Bitcoin-like — component is its monetary policy. New money is created by broadcasting solutions to computational problems, with two conditions: the problem’s difficulty must be publicly verifiable, and the money created must be priced by the real cost of the computation, benchmarked against “a standard basket of commodities.” Dai’s design goal is explicit: money whose purchasing power is roughly stable, its supply expanding with the real resources spent to produce it.

In a later appendix, Dai refined this into an auction-based scheme: participants bid for the right to mine each period’s money creation, with the quantity set by the bidding — an attempt to make supply respond to demand for money rather than to hardware progress.

Set against the tradition this knowledge area otherwise traces, the contrast is sharp. Where Bit Gold struggled with hardware-driven cost variability as a fungibility problem and Bitcoin dissolved it with a fixed schedule, Dai treated production cost as a feature — the anchor of a stabilization rule. b-money is, in effect, a proposal for decentralized stable-value money; Bitcoin is a proposal for decentralized hard money (see Bitcoin fixed supply and issuance schedule and Hard money vs fiat money for the substantive cases). Dai’s later-stated reservations about Bitcoin’s monetary policy are consistent with his 1998 design instincts — treated on Wei Dai.

Contracts and dispute resolution

Often overlooked: roughly half the proposal concerns not money but contracts — how pseudonymous parties form agreements, post penalty deposits, and resolve disputes through arbitrators whose judgments execute against the deposits, all inside the ledger’s bookkeeping. The machinery is a recognizable ancestor of the conditional-money ideas that later develop into Bitcoin Script and the broader smart-contract tradition (see Bitcoin Script and opcodes and, for the parallel Szabo lineage, Nick Szabo). b-money’s polity needed courts as much as coins, and Dai designed both.

The citation and the correspondence

In August 2008, Satoshi Nakamoto emailed Adam Back about citing Hashcash; Back pointed him to Dai’s b-money as related prior work. Satoshi then wrote to Dai directly, describing a forthcoming paper that “expands on your b-money idea into a complete working system” and asking for the proposal’s publication year. Dai supplied the citation details; the whitepaper appeared that October with b-money as reference [1]. Dai’s later accounts describe the exchange as brief and note — with characteristic precision — that Satoshi appears to have learned of b-money late, after Bitcoin’s design was substantially formed.

That detail calibrates the citation’s meaning. b-money’s priority is real: the shared-ledger framing, work-based issuance, and incentive-secured maintenance are all on the record in 1998, and Satoshi acknowledged the kinship. But the documented sequence suggests convergence and acknowledgment more than derivation — Bitcoin re-derived the b-money shape and then discovered its ancestor. The fuller treatment of the correspondence and Dai’s subsequent commentary lives on Wei Dai; the whitepaper’s publication story lives in The Bitcoin whitepaper - History.

A minor durable legacy of the acknowledgment: the smallest denomination of ether was later named the wei in Dai’s honor — a naming tribute from the broader cryptocurrency ecosystem noted here purely as a historical fact.

What b-money contributed and what it left unsolved

Contributed: the target specification. A replicated public ledger of pseudonymous balances; money created through verifiable computational work; system integrity maintained by economic incentives rather than identity or law; contracts enforced inside the system. Every element of that sentence describes Bitcoin, and the sentence was writable from b-money’s text a decade earlier.

Left unsolved — knowingly: the convergence mechanism. Protocol one assumes perfect broadcast; protocol two assumes a non-Sybil server set; neither explains how independent copies of the ledger come to agree under adversarial conditions. Dai stated the gaps rather than papering over them, which is why the proposal reads today as an unusually honest problem statement. The solution — proof-of-work as the Sybil-resistance and ordering mechanism, with the longest accumulated-work chain as the convergence rule — is the specific thing the Bitcoin whitepaper added (see The Bitcoin whitepaper - Explainer).

Counter-arguments and tensions

”The citation overstates b-money’s influence”

The argument: Satoshi learned of b-money weeks before publication, from Back, after the design was formed; reference [1] therefore reflects scholarly courtesy, not intellectual debt, and lineage tellings that lead with b-money mistake bibliography for genealogy.

Response: Substantially correct as to causal influence, and this note’s framing accepts it — the documented sequence supports convergence-then-acknowledgment. What the deflationary reading misses is that independent convergence is itself evidence of contribution: Dai specified the target a decade early and stated exactly which problems stood between the specification and a working system. Priority of problem-statement is a real form of priority. The relative-weighting question among Dai, Szabo, and Back is engaged in Pre-Bitcoin attempts at internet money and remains genuinely unresolved.

”b-money’s monetary policy was the better design”

The argument: Dai’s stable-purchasing-power rule anticipates the standard economic critique of Bitcoin — that a fixed-supply money is too volatile, then too deflationary, to serve as a unit of account. A b-money-descended stabilization design would have made better money, whatever its other failures.

Response: This is a live substantive debate, not a settled one, and it deserves honest statement: Dai’s rule is a genuine alternative tradition, and its descendants (stabilization-targeting cryptocurrencies) exist. The sound-money counter-case — that any supply rule responsive to measured prices reintroduces discretionary surface area and that credibly fixed supply is the property doing the monetary work — is made substantively in Bitcoin fixed supply and issuance schedule and engaged from the critics’ side in Fixed-supply and deflation critique, which is the dedicated home for this argument.

Open questions for further development

  • Dai has engaged sparingly but substantively on Bitcoin since 2009 (including his reservations about fixed supply and his reflections on not pursuing b-money). A consolidated account of his post-Bitcoin commentary would sharpen both this note and Wei Dai.
  • The auction-based money-creation appendix is rarely analyzed seriously. Does it prefigure any workable demand-responsive issuance design, or does it fail to the same discretionary-surface objection as other stabilization rules?
  • b-money’s contract-and-arbitration machinery as smart-contract prior art is under-studied relative to Szabo’s corpus. How much of the conditional-payment tradition has a b-money ancestry that standard histories skip?

Canonical sources for this note

Primary documents

  • Wei Dai, “b-money” (cypherpunks mailing list, November 1998; canonical text at weidai.com) — the proposal itself, including the appendix with the auction-based creation scheme.
  • Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (October 2008) — reference [1] is b-money. See The Bitcoin whitepaper - Explainer.
  • The Satoshi–Dai correspondence (August 2008; published by Dai) — the primary record of the pre-publication contact.

Context and lineage

  • Tim May, The Crypto Anarchist Manifesto (1988) — the political frame b-money instantiates.
  • Nick Szabo, “Bit Gold” (2005) — the contemporaneous-in-conception sibling proposal. See Bit Gold - Nick Szabo.

Graph View

Backlinks