| Authors | Dai, Wei |
|---|---|
| Year | 1998 |
| Project | b-money |
| License | Public Domain |
| Official Source | http://www.weidai.com/bmoney.txt |
This page is an educational summary and analysis of an official whitepaper or technical paper, written for reference purposes. It is not a verbatim reproduction. CryptoGloss does not claim authorship of the original work. All intellectual property rights remain with the original author(s). The official document is linked above.
b-money is a brief 1998 proposal by Wei Dai describing two schemes for an anonymous, distributed electronic currency system. It was distributed on the cypherpunks mailing list and has not been formally peer-reviewed or implemented. Despite being only a few pages, b-money anticipates several core Bitcoin ideas: a distributed ledger maintained by all participants, money creation through proof-of-work puzzles, and peer-enforced contracts without a central authority.
Satoshi Nakamoto cited b-money in the first line of the Bitcoin whitepaper references section and emailed Wei Dai before publishing. Dai received a pre-publication copy of the Bitcoin paper.
> Original document: weidai.com/bmoney.txt
Publication and Context
Wei Dai posted b-money to the cypherpunks mailing list in November 1998. The cypherpunks list was the primary intellectual forum for privacy-focused cryptography throughout the 1990s — the same forum where Adam Back announced Hashcash (1997), Nick Szabo discussed Bit Gold (1998–2005), and earlier digital cash proposals circulated.
By 1998, the idea of digital cash was not new. David Chaum’s DigiCash (ecash, 1989) had created the first cryptographic anonymous payment system, but it was centralized around Chaum’s company (which went bankrupt in 1998). The cypherpunk community sought trust-minimized systems that did not require a central issuer.
Dai’s specific frustration, stated in b-money’s introduction, was with “the unpredictability and inevitability of state violence in enforcing agreements” — he wanted a system where contracts could be enforced without government courts or financial intermediaries.
Scheme 1: Broadcast Ledger
In Scheme 1, every participant maintains a database of how much money each pseudonymous public key holds:
- Money creation: A participant solves a proof-of-work problem. The cost of solving the problem (in CPU time and electricity) is publicly known. If the community agrees the solution is valid, the solver broadcasts the solution and claims a quantity of b-money proportional to the cost.
- Money transfer: To send b-money to public key B, send a signed message: “I send X b-money to B.” Every participant updates their copy of the ledger.
- Contract enforcement: Contracts are enforced collectively. A contract designates an arbitrator; if one party breaches, the other party and arbitrator sign a message penalizing the breaching party’s account. Each participant updates their ledger accordingly.
This scheme is straightforward but has an obvious problem: who resolves conflicting ledger updates? If Alice sends the same b-money to Bob and Carol simultaneously (double-spend), different participants may accept different transactions. Dai acknowledges this and notes Scheme 1 is “impractical” without a synchronization mechanism.
Scheme 2: Server Subset
Scheme 2 introduces a special subset of participants called servers who are more trusted (or bonded) and who maintain the canonical ledger:
- Server bonding: Servers deposit b-money into an escrow account as a security deposit
- Finality: When a transaction is sent, participants broadcast it to a quorum of servers; the servers timestamp and sign acknowledgment
- Dispute resolution: If a server is found cheating (double-spending or refusing valid transactions), it loses its security deposit (slashed before the term existed)
Scheme 2 resembles a federated system — closer to Liquid Network or early Ripple than to Bitcoin’s trustless model.
Key Technical Properties
| Property | Scheme 1 | Scheme 2 |
|---|---|---|
| Ledger holders | All participants | Server subset |
| Sybil resistance | Proof-of-work puzzle | Server bonds |
| Finality | Undefined (no conflict resolution) | Quorum acknowledgment |
| Double-spend prevention | Collective rejection (unclear how) | Server consensus |
| Privacy | Pseudonymous public keys | Pseudonymous public keys |
What b-money Got Right
Reviewing b-money against Bitcoin’s design:
- Proof-of-work money creation: ✅ Identical concept (mining); Dai proposed linking coin issuance to computational cost
- Distributed ledger: ✅ All participants maintain account balances (UTXO set or account model)
- Pseudonymous public keys: ✅ Bitcoin uses public/private key ownership
- No central issuer: ✅ Money created by participants; no authority
- Peer-enforced contracts: ✅ Anticipates smart contracts; Bitcoin Script emerged from similar thinking
What b-money Left Unsolved
- Double-spend protection in Scheme 1: Dai never specified how conflicting transactions are resolved — the critical problem Nakamoto solved with the longest-chain rule
- Sybil resistance for participants: Anyone can claim to have updated their ledger; without a canonical ordering mechanism, the system cannot converge
- Proof-of-work difficulty calibration: Dai proposes that the value of b-money equals the cost of the puzzle, but gives no mechanism for adjusting difficulty as hardware improves
These unsolved problems are exactly what Bitcoin’s Nakamoto consensus addresses.
Reality Check
b-money was never implemented. It remained a brief two-page proposal on a mailing list. Dai himself wrote: “I am interested in Tim May’s crypto-anarchy. Unlike the communities usually associated with the word ‘anarchy,’ in a crypto-anarchy the government is not temporarily destroyed but permanently forbidden and permanently unnecessary.”
The proposal was ideologically clear but technically incomplete. Satoshi cited it primarily as intellectual precedent, not as a technical blueprint. Bitcoin’s actual consensus mechanism (longest chain wins, with network-wide block propagation) has no equivalent in b-money.
Wei Dai went on to create the Boost C++ library and made significant contributions to computer science outside of cryptocurrency. He participated in early discussions of Bayesian reasoning and decision theory in online communities.
Legacy
b-money is primarily significant as an early articulation of the goal: “a community where the threat of violence is impotent because violence is impossible, and violence is impossible because its participants cannot be linked to their true names.” This cypherpunk goal shaped the Bitcoin whitepaper’s framing and the cryptocurrency movement’s political identity.
Related Terms
Research
- Dai, W. (1998). b-money. weidai.com/bmoney.txt.
— The primary source; two schemes for distributed anonymous e-cash using proof-of-work and distributed ledgers. Cited in the Bitcoin whitepaper.
- Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System. bitcoin.org/bitcoin.pdf.
— Bitcoin whitepaper reference [6] cites b-money; Nakamoto emailed Dai prior to publishing.
- Szabo, N. (1998). Secure Property Titles with Owner Authority. Nick Szabo’s essays.
— Szabo’s “Bit Gold” proposal from the same era; another non-implemented precursor to Bitcoin that independently proposed proof-of-work as a basis for digital scarcity.