Satoshi Vanished. Vitalik Stayed Behind to Finish the Other Half.

Lex Fridman opens with the origin story that still has no parallel in technology. On 31 October 2008, someone calling themselves Satoshi Nakamoto posted a nine-page white paper to a cryptography mailing list. They released the original Bitcoin source code, talked with the earliest community on forums, and then, in late 2010 or early 2011, vanished. Buterin, 26 at the time of this recording and co-author of the Ethereum white paper, calls the founder a quasi-godlike figure who popped in, did the thing, and has not been heard from since.

One long-running guess is Hal Finney, a computer scientist and early cypherpunk who was unusually active in Bitcoin's first two years. The first Bitcoin transaction ran between Satoshi and Finney. Fridman asks how two people can work that closely without either knowing the other's real identity. Buterin's answer is almost offhand: he knows a lot of people only by internet handles. One has a profile picture that is not quite a human face, washed in psychedelic colors, and that is what he visualizes when he thinks of them.

Anonymity, he says, helps create the image of a neutral thing that belongs to no one. If you appear, build the system, and then disappear — or, as happened to Finney, die of Lou Gehrig's disease and end up in a cryogenic freezer — what remains is the artifact. No one can rummage through a founder's other opinions and decide the project was always a vehicle for them. Buterin feels the opposite burden. He has been pushing the Ethereum ecosystem to decentralize: more work outside the Ethereum Foundation, more independent client implementations, anything that takes him off the single-point-of-failure list. Asked what kind of leader he is, he says he has drifted toward the high priest: no army, just Twitter followers. He does not go around ordering Foundation staff. If something matters, he says it in public or mentions it privately, and projects often just start doing it.

Fridman asks the large philosophical question: what is money? Buterin answers like a programmer. It is a game with points, and the one basic move is that you reduce your points by some number and increase someone else's by the same number. Other fair games exist. You could design one where if you and I both give someone a point, they receive four. That design is less convenient. Money is easy to set up, covers a lot of functions, and has survived in society as a meme for thousands of years: store of wealth, medium of exchange, unit of account for future payments.

His thumbnail of twentieth-century money is a story of intermediation. More forms of banking. Dollars backed by gold, then backed by gold only some people could redeem, then backed by nothing. A pile of free-floating currencies. Bank counters giving way to electronic accounts, then to accounts at payment processors that themselves sit on banks. The philosophical sting is that money can exist without being backed by anything physical — and that, he says, is not even unusual in the twenty-first century. Most of the valuable things around us are not backed by a pile of stuff.

Take Twitter. In theory the employees could quit together, rebuild Twitter 2.0, and leave the original company as an empty shell. The code and IP belong to the firm, but good programmers could rewrite that in about three months. The reason the thing has value is network effects and coordination problems: employees will not jump at once, users will not migrate at once. The result is a metastable equilibrium among millions of people, sticky even though a model of perfectly rational spherical cows would not produce that stickiness at all.

The textbook analogy he reaches for is revolution. If 80 percent of a country woke up tomorrow convinced that the current laws and government were just people, and that some other thing was the government, and started acting that way, the new reality would take. The hard interval is zero to 80. If you are the first to join, you have almost no incentive: you look like a crank and you eat the cost. If you are the 55th-percentile person, it is suddenly quite safe. The switch can be modeled. One reliable result is that when it happens, it can be chaotic.

Buterin calls himself a skeptic of economics. Psychology is his recreational field. People, he thinks, often pretend they have a grip on human behavior, and it is hard to tell how much of the modeling in either discipline is wishful thinking. Money is far from the only motivator, but it is the closest thing to a universal one: ask almost anyone to do something, and offering money makes them more inclined to do it. Other motives are real and common; they are also much more specific to the person and the situation.

Money and power interlock. Some people want money because it is power. A lot of spending that does not look like money is about social status. And money is a scoreboard. If you have four billion dollars, one of the big benefits of going to six is that you are no longer below the person who has five — you are above them. Equating self-worth with money is unhealthy, he says, because wealth is a poor measure of what you provide to society. As current practice, plenty of people do it anyway. His picture of an economic utopia is simpler: incentives aligned, so that satisfying your own goals and making the world better stop being in conflict. Existing economic philosophies, he adds, systematically deviate from that.

The most obvious deviation is public goods. The points-game model works for private goods: I give you money, you give me a sandwich, both of us gain. A huge amount of what is valuable on the internet does not work that way. Once this podcast is published, Fridman cannot finely control who may listen. Past a certain audience, copying is inevitable. Blog posts are harder still to fence. Scientific research has the same shape, and so does climate-change mitigation. The shared structure is concentrated costs and distributed benefits. Money as a point system is bad at encouraging that. That is the tragedy of the commons: lots of people benefit, no individual wants to pay, because they capture only a sliver of the gain and the full cost.

The mechanism Buterin has helped design is quadratic funding. One person giving coins to one other person behaves like ordinary money. If many people give to the same person, anonymously, not in exchange for a private service, the recipient gets more than the sum of the gifts. The formula: take the square root of each donation, add the square roots, square that total. If nine people each give a dollar, the recipient gets three squared, which is 81 — far more than the nine dollars put in. Each person's contribution is multiplied by n, the number of participants. There is, he says, a mathematical proof that this scaling optimally fills the commons gap. He points Fridman at an essay of his, *Quadratic Payments: A Primer*.

The mechanism has actually been run inside the Ethereum ecosystem. Buterin wrote up recent rounds: the projects that drew the most support were user interfaces that make Ethereum easier to use, documentation, podcasts, client software that implements the protocol, and privacy tools. All of them useful to many people, and none of them the sort of thing one person wants to fund alone.

To explain blockchains, Buterin goes back to Leslie Lamport's 1982 paper. Two generals camp on opposite sides of a city. They win only if they attack together. Messengers can be killed or can lie. With two generals, there is no finite-round protocol that guarantees they coordinate. Add more generals and signed messages, and solutions appear: you can sign a message, someone can forward it, and a third party can still check that it originally came from you. The popular misconception is that the Byzantine generals problem was unsolved. Lamport solved it. What those solutions all assume is a fixed list of generals who are, to some degree, semi-trusted. They cannot be anonymous. If they can, the enemy can be 99 percent of the generals.

That is why 1980s and 1990s distributed consensus lived in enterprises. You knew who the nodes were and where they sat, so you could assume, say, two-thirds were honest. Aircraft flight systems still use ideas of that family. The cypherpunks wanted something else: a fully decentralized global currency with no authorities and no privileged list of people. That pulls the floor out. If you cannot measure identity, how do you stop one person from pretending to be ten thousand?

Satoshi's move, which Buterin in a Def Con talk called the invention of crypto-economics, was to use economic resources to cap how many identities you can buy. Solve a hard mathematical puzzle that takes a calculable amount of computation, get one identity; solve five, get five. That is proof of work. The trick itself is older. In 1994 Cynthia Dwork and Moni Naor proposed it against email spam: attach a little computation to each message, cheap for friends, ruinous for a billion-message blast. Satoshi turned an anti-spam device into a way to allocate identity in an anonymous world. Real cost stands in for "I know who you are."

The engineering goal is to wire a large number of computers so they pretend, to the outside world, to be a single computer that keeps working even when a large fraction of its parts fail in arbitrary ways: they shut off, they attack, they send garbage. The cypherpunks wanted to run one program on that virtual machine — a currency. It processes transactions, checks that the sender has the coins and that the signature is valid, and if so subtracts from one account and adds to the other.

The data structure is why it is called a blockchain. Nodes periodically publish blocks: a list of transactions plus a hash pointer to the previous block. Chain those and you have a ledger. Fault tolerance, in Bitcoin's simple architecture, is the longest-chain rule. Sometimes two honest nodes produce blocks at once and do not hear each other in time; sometimes an attacker tries to build on an older block and erase what already happened. If the block they want to revert is already buried deep, everyone ignores the fork. If the two branches are one block each, the next block decides the new head and the other side is forgotten.

How much computing power does an attacker need? Depending on the model of the participants and the kind of attack, Buterin says anywhere between 23.2 and 50 percent of the network. Above 23.2 percent there is a lot a malicious actor can potentially do; above 50 percent they can break everything. Historically that quantity has been extremely hard to assemble. The economic cost of acquiring it from scratch, in specialized ASIC hardware, sits in the low billions of dollars. Bitcoin's puzzle is SHA-256: find a number whose hash falls below a threshold. Because hashes look random, you try numbers. An ASIC is a box stuffed with millions or billions of hash-evaluation circuits, running 24 hours a day.

Fridman asks whether quantum computing wrecks this. Buterin splits quantum algorithms into two families. Shor's algorithm destroys the hardness of particular math problems: factoring huge numbers, elliptic-curve cryptography, discrete log over finite groups — most of the cryptography we actually like. The good news, he says, is that for every major use Shor breaks, there is already a quantum-resistant alternative. The industry is not using those yet because they are typically five to ten times less efficient. It knows the hit is coming and is ready to switch.

The second family is Grover's algorithm, which people find more intuitive: search. If a classical computer needs N tries to find a number with a given property, a quantum computer needs about the square root of N. Grover could be used for mining. One world is that whoever first builds a Grover-capable machine mines far faster than everyone else, the industry goes through another ASIC-style shakeout, and a new equilibrium appears. The speedup is quadratic, not exponential. Dramatic, he says, but not game-changing, and it does not necessarily break proof of work.

The other world is overhead. Maintaining quantum states is hard, and it has become clearer that working quantum computers need error correction — on the order of a thousand physical qubits per logical qubit. If that overhead exceeds Grover's speedup, proof of work keeps running as it does now. Bitcoin, he adds, really only needed two big ideas in the white paper: proof of work, and public keys with signatures to authorize transactions.

Buterin joined the Bitcoin community in 2011, writing first for a site called Bitcoin Weekly and then for Bitcoin Magazine. He spent a year at university, dropped out at the end of it, and went full-time. He spent about six months on the road: New Hampshire, Spain, other European cities, Israel, then San Francisco, meeting people who were building Bitcoin projects. In Israel he found teams working on what people were starting to call Bitcoin 2.0. Colored Coins wanted to issue other assets on Bitcoin, not just use it as money. Mastercoin issued assets too, and piled on financial contracts, domain-name registration, and a pile of other features.

He quickly decided Mastercoin could be generalized. His analogy is a Swiss Army knife: 25 transaction types for 25 applications, several of which could collapse. Three kinds of financial contract could become one generic contract, if you just specify a mathematical formula for how much each side receives. A financial contract, as he defines it, is an agreement where one or two parties put up collateral and then receive different amounts depending on prices, on the parties' own actions, or on other conditions. Options, contracts for difference — the family is the core interactive unit of a financial system. The catch is that you have to trust the contract will actually execute.

He took the generalization to the Mastercoin team. The reply was, roughly: great idea, looks complicated, not on the roadmap for a while. His reaction was that they did not realize how revolutionary it was, so he would do it himself. He first named the language Ultimate Scripting. After a few more iterations, Ethereum's shape appeared: a blockchain whose core unit is a contract — an account that can hold assets, has its own internal memory, and is controlled by a piece of code. Send ether to a contract and the only thing that can decide where those coins go next is the code itself. Sending assets to computer programs, with the code as part of the agreement, is what "smart contracts" means. He thought he would tinker for a couple of months, publish, and go back to university. The white paper drew far more people offering to help than he expected. He realized the thing was much bigger than he had thought, and a much longer development slog began.

The bigger lesson, he says, was social, not technical. He describes himself as an unusual geek who was never treated with anything but kindness in school, so he arrived in crypto expecting everyone to be similarly altruistic. The algorithm he used to pick co-founders was what computer scientists call greedy: the first fifty people who offered to help became co-founders. As the project got large, the fights started. Some wanted a nonprofit, some a for-profit. Some people could not work with each other at all. Some tried to grab advantage for themselves. About six months in came the first governance crisis and a leadership reshuffle. Nine months later, another. Then a third. After about four rounds, he says, they arrived at something that seems fairly stable and happy.

One reason he likes decentralization is exactly this: power attracts people with egos, and a very small percentage of people can ruin a great deal. On the research team he has also found many people who are primarily interested in the technology, and those parts have gone quite well. The software-engineering lesson is blunter. First law of software development: when someone gives you a timetable, switch the unit of time to the next largest unit and add one. They fell for it. What was supposed to take three months took twenty, mostly because they underestimated the sheer technical complexity.

From day one Ethereum said it would switch from proof of work to proof of stake. Instead of wasting computation on meaningless puzzles, you prove you have coins inside the system, and that buys you a share of consensus. Lock a hundred coins and the protocol turns them into a virtual validator, randomly assigned the right to create blocks at particular times. Someone who locks two hundred coins gets a binder twice as large and creates blocks twice as often. The thing proof of work used to limit — how much you can participate — becomes how many coins you are willing to lock. The obvious critique is that rich people then have more say. Buterin's usual answer: proof of work is even more that kind of system, and worse, because you also have to buy machines, burn electricity, and cut down trees. To do anything bad in proof of stake you still need a very large portion of all the coins locked in the system.

Energy is an explicit motive. The latest figure he cites is that Bitcoin consumed as much energy as Austria; Ethereum was maybe half an order of magnitude smaller. Ethereum 2.0 is a bundle of long-planned upgrades. The two big ones are proof of stake and sharding. Sharding attacks scalability: today every participant downloads and verifies every transaction; with sharding each participant downloads and verifies only a small random slice. Because the assignment is random, corrupting any shard still requires a large fraction of the whole network. Sharding is the harder of the two, because it is not only a consensus change. Today's networking layer gossips everything — if someone publishes, every node hears it. Sharding needs many subnetworks, fast switching between them, and talk among the subnets. That architecture had not yet been done in cryptocurrency.

The work is coordinated, in a slightly invented job title, by Danny Ryan as de facto development coordinator. The Ethereum Foundation does research in-house; implementations are independent teams, separate companies, including in Australia. Ethereum 2.0 is split into phases. Phase 0 stands up a separate proof-of-stake chain, the beacon chain, and lets it grow on its own. Phase 1 adds sharding, but only of data storage, not of computation. Then a merger pastes existing Ethereum 1.0 accounts and smart contracts into the new system, the old chain is forgotten, and whatever was living there continues inside the new one. Phase 0, he says, is almost fully implemented and now in a long stretch of security auditing and testing. It feels to him like about four months before the original Ethereum launch. He stresses that this is a hunch. The merger, when it comes, happens all at once.

Casper FFG, the proof-of-stake consensus algorithm, stitches together two schools. One tolerates 50 percent faults but assumes network synchrony: if you send a message, the other nodes hear it within a few seconds. The other tolerates only 33 percent faults but stays safe under asynchrony: once something is finalized, even if the network goes horribly wonky a second later, it cannot be reverted. Casper takes the best of both. With honesty and synchrony, the chain grows. If synchrony fails, the last few blocks may be replaced, but anything the asynchronous process finalized cannot be undone. The paper is on arXiv; the authors are Buterin and Virgil Griffith.

Open papers are not a nice-to-have in this field. Crypto is about systems you can trust without trusting the operators, so closed-source internals kill the point. The category forces openness, and openness has also turned out to be a good way to collaborate. On ethresear.ch they publish write-ups halfway between a formal paper and a note: math is allowed, length is usually much shorter. Most new ideas, Buterin observes, are small nuggets you can explain in five to ten lines. They do not need ten pages of filler, or an introduction and a conclusion. Post the idea; people comment underneath.

Asked for the most beautiful ideas in Ethereum, he offers two. One is that money can emerge from a database if enough people believe in it. The other is composability: if he builds an application on Ethereum, you can build one that talks to his without his permission, without even speaking to him. The example that actually happened is CryptoKitties, a game about breeding digital cats, and Crypto Dragons, a game whose dragon eats those cats. The whole dragon game is an Ethereum contract that calls a token defined by someone else's contract. The teams did not need to talk. That pattern, he says, has been generating a lot of the interesting work in decentralized finance: stablecoins pegged to a dollar but backed by crypto, and decentralized exchanges. The construction he particularly likes is Uniswap, a contract that holds two token balances and keeps the invariant that the balance of A times the balance of B equals a constant — x times y equals k. You start at one point on the curve and end at another; delta x in, delta y out; the slope at the current point is the price. No order book, few participants required, simple enough to explain in a few sentences, and it provides a great deal of value.

Will cryptocurrency become the world's main money? Buterin is restrained. He expects fiat — dollars, euros, government-backed currencies — to keep existing, stay strong, and digitize on their own over the next couple of decades. Crypto's important role is to make sure people always have an alternative: a high-inflation place like Venezuela, a country cut off from other financial systems by banks, a major trade disruption, or something worse. Because of global neutrality, crypto is just there and you can keep using it. Pressed on whether it could still become the primary currency, he names a harder problem than "it's early." Demand for currency is itself volatile — recessions, booms, technology. If supply is fixed, demand swings have to express themselves entirely as changes in the currency's value, which then become price swings in everything denominated in it. If supply can expand when demand rises, supply absorbs some of the volatility. Bitcoin's supply is fixed. Ethereum is a bit more flexible. What you really want is supply that responds to how valuable the currency is. That, to him, is the main obstacle to crypto as a primary store of value. Dai, a stablecoin issued by a smart contract that holds ether, is an attempt to pair people who want leverage on ether with people who want a dollar-like asset convertible back at a one-dollar rate.

Governments are not entirely the enemy. If they had allowed Google, Facebook, and Twitter to issue centralized digital currencies freely, those would exist left and right, and decentralized money would appeal to fewer people than it does today. Regulation, in that sense, cleared space. Governments have also gone after fraudulent projects and the craziest marketing. They are potential users too, not only regulators: identity records, property registries, secure issuance of their own currency. They often lag a few years in adopting technology — autonomous vehicles are a similar story — and helping them catch up would be good. Buterin was born in Kolomna, about 150 kilometers south of Moscow, and grew up in Moscow. He met Vladimir Putin for about a minute; the impression was that Putin looks taller in photographs. Some ministers were interested in blockchain for anti-corruption use cases. From one conversation it is hard to tell what is genuine and what is a gold-watch courtesy. At the time, about three thousand cryptocurrencies were being actively traded. Diversity is good, he says, and three thousand is too many. The right number is greater than one, probably greater than two or even five — not three thousand, and not forty high-quality platforms trying to do the same thing. Experimentation is healthy. The spectrum runs from someone who thinks you can create a cryptocurrency in twelve hours, through people who try and make something tiny, through scammers, to people who make something that actually works.

Crypto and AI, he thinks, share a structural problem: getting a simple system to direct a more complex one. In the superintelligence case the simple system is people and the complex system is whatever they unleash on the universe. In blockchains the simple system is a static, fully open-source algorithm and the complex system is all the human actors and strategies that might join the network. On mortality, if offered the option to live forever, he would read the fine print. Floating through empty space for 10^75 years does not count. A fulfilling life with friends, meaningful challenges, and interesting work: then yes. For people trying to learn the field without drowning in hype, he recommends starting with the researchers, crawling out through academic cryptographers — Stanford's blockchain center, Dan Boneh, people working on zero-knowledge proofs, Zooko Wilcox — and dropping anyone who seems self-promotional. Historically, Nathaniel Popper's *Digital Gold* and Matthew Leising's Ethereum history; technically, *Mastering Ethereum*. And the question he often asks startups built on Ethereum: can you tell me why using a blockchain is better than using Excel? If they have a good answer, you know you have something interesting.