Expanding blockchain integration allows an attack to upend the entire system.

The double-spending analysis is consistent with the modest early use cases of Bitcoin, in which Bitcoin was primarily used by hobbyists and for small-scale black market activity (e.g., online gambling, Silk Road). In these early days, the amount that could be gained in a double-spending attack was not very high, because there were not high-value transaction opportunities. If a doublespending attack could gain at most $1,000, then the implicit cost per transaction in the base case necessary to secure the trust is just $0.04.

The double-spending analysis is also consistent with larger-scale black-market uses of cryptocurrencies, especially as black-market users may be most willing to pay the high implicit costs. For example, if a double-spending attack could gain at most $10 million, then the implicit cost per transaction in the base case needs to be about $380. This is modest relative to the costs of transporting large amounts of cash (Rogoff, 2017).

Where the analysis suggests greater skepticism is the use of cryptocurrencies and Nakamoto trust as a major component of the mainstream global financial system. If cryptocurrencies and Nakamoto trust were to become more integrated with the mainstream global financial system, then it would be possible to move amounts of value that are ordinary in the scheme of global finance, and hence it would be possible to double spend for amounts of value that are ordinary in the scheme of global finance. The analysis suggests that this scenario is unrealistic because of the way the trust model scales. To secure the system against attacks of $1 billion — which is less than 0.2% of daily trading volume in the U.S. Treasury market alone — requires a per-transaction security cost of $38,000, and an annual security cost of $4 trillion. To secure against attacks of $100 billion requires an annual security cost of four times global GDP. While market power and fees in traditional finance are clearly an important economic issue (Greenwood and Scharfstein, 2013; Philippon, 2015), and Huberman, Leshno and Moallemi (2021) are careful to remind us to compare the costs of the Nakamoto trust model against the costs of market power in traditional finance, it is clear from these calculations that Nakamoto trust is absurdly expensive relative to traditional trust. We will return to this comparison between Nakamoto trust and traditional trust in Section 6.

A conceptual insight that is reinforced by the double-spending analysis is that blockchain security should not be thought of as a 0-1 variable but as more like a very high percentage tax. Taxes and equilibrium reasoning (i.e., that security costs will have to go up in equilibrium if the blockchain becomes more economically useful) are natural to economists but are somewhat foreign to computer science. It is true that for any fixed dollar attack amount, there exists a long enough escrow period that keeps the system secure against such an attack, but this misses the point.

5 Analysis of Sabotage Attacks

A way out of the flow-stock argument considered theoretically in Section 3 and quantitatively in Section 4 is if the attack causes a significant decline in the value of the cryptocurrency, i.e., if ∆attack is large. In this case, while the attacker still has their falsely-obtained goods or assets, the cryptocurrency the attacker is left with to double spend is now worth significantly less than before. Moreover, the decline in the value of the cryptocurrency would cause a decline in the value of any specialized capital the attacker needs to conduct the attack — this could be specialized hardware in the case of a proof-of-work cryptocurrency or stake in the case of a proof-of-stake cryptocurrency. The Bitcoin Wiki classifies the majority attack into its “Probably Not a Problem” category for these reasons (Bitcoin Wiki, 2022).

In this section I will show that this argument is logically correct. However, it raises the possibility of an attacker motivated by harming the cryptocurrency per se. I derive a “pick your poison” result in Section 5.1, discuss sabotage attacks in Section 5.2, discuss the combination of sabotage and specialized capital in Section 5.3 and consider collapse scenarios in Section 5.4.

5.1 Pick Your Poison

Assume that the double-spending attack analyzed in Section 4 causes a proportional decline in the value of the cryptocurrency of ∆attack. For this section, maintain the assumption from Section 3.1 that the attacker’s cost of trust support is c per unit of trust support per unit time. In Section 5.3 I will explicitly model the stock cost of capital, C, and assume that the attack harms the value of the attacker’s capital stock too.

The ∆attack parameter modifies the attacker’s incentive compatibility condition in two ways. First, the attacker double spends for Vattack of value (e.g., traditional financial assets from a traditional financial institution), but to realize this benefit has to hold cryptocurrency worth this amount, which declines in value ∆attackVattack. Hence the net benefit of the attack is (1 − ∆attack)Vattack. Second, the attacker’s net cost of attack has to be adjusted for the decline in the value of the block rewards they earn. An A attacker who attacks for t time still earns At block rewards in expectation, but each block reward declines in value by ∆attack. The net incentive compatibility condition thus becomes: (κ + ∆attack)At · N ∗ c > (1 − ∆attack)Vattack.31

Substituting in equation (1) yields the following modification of equation (3): pblock > (1 − ∆attack) At(κ + ∆attack) Vattack (5)

The larger is ∆attack, the smaller is the per-block cost necessary to deter the double-spending attack. This is easiest to see by considering the extreme case of ∆attack = 1, i.e., if the attack causes a total collapse in the value of the cryptocurrency. In this case, the attacker loses exactly as much cryptocurrency value as they gain from double spending, so the numerator on the righthand-side of (5) is zero — in effect, there is no chance to “double spend” at all. More generally, we have the following simple result:

Proposition 6. (“Pick your Poison”) For any potential value of a double-spending attack Vattack >

0, and any level of block reward pblock > 0, the Nakamoto blockchain is secure against the doublespending attack if the post-attack decline in the cryptocurrency’s value, ∆attack, is sufficiently high. Proof. Follows directly from (5), noting that the numerator of the right-hand-side goes to zero as ∆attack goes to one.

Proposition 6 may at first sound reassuring about the Nakamoto blockchain’s security against double spending, but it raises the possibility of an attacker motivated by the harm to the cryptocurrency’s value per se. ∆attack is a “pick your poison” parameter: If ∆attack is small, then the system is vulnerable to the double-spending attack analyzed in Section 4, and the implicit tax on economic activity using the blockchain has to be high. If ∆attack is high, then the system is indeed secure against double-spending attacks — but this concedes that an attack would effectively cause a collapse in the trust, which in turn raises the possibility of an attacker movitated by this harm per se.23 Put differently, if ∆attack is large, then a short time period of access to a large amount of trust-support capital can sabotage the whole novel economic system.

5.2 Sabotage

A well-known early paper on double-spending attacks, Rosenfeld (2014), observes that such an attack might in effect be a sabotage that causes collapse of the system:

“In this section we will assume q < p [i.e., that the attacker does not have a majority]. Otherwise, all bets are off with the current Bitcoin protocol ... The honest miners, who no longer receive any rewards, would quit due to lack of incentive; this will make it even easier for the attacker to maintain his dominance. This will cause either the collapse of Bitcoin or a move to a modified protocol. As such, this attack is best seen as an attempt to destroy Bitcoin, motivated not by the desire to obtain Bitcoin value, but rather wishing to maintain entrenched economical systems or obtain speculative profits from holding a short position.” (Emphasis Added)

What is the value of a sabotage attack on a significant cryptocurrency such as Bitcoin or Ethereum? It is hard to say of course, but easy to imagine that the magnitudes are already large, and would be larger still if cryptocurrencies become more significantly integrated into the global financial system. Open interest in CME Bitcoin futures as of Sept 2023 is about 15,000 contracts, each tracking 5 Bitcoins, worth about $2 billion at current prices. According to data from The Block, open interest in Bitcoin futures aggregated across the major crypto exchanges has exceeded $20 billion (and is about $10 billion as of Sept 2023), and open interest in Ethereum futures has been as high as $10 billion (about $5 billion as of Sept 2023).24 These figures give a sense of magnitudes for what could be made from a short-selling attack.