The 21 million supply cap is Bitcoin’s best-known feature. Opinions about a fixed money stock abound, but a related question gets much less attention. Why 21 million bitcoin? Why not 42 trillion (containing the answer to everything), 7 billion (the number of people on Earth), or one sextillion (a big number that turns heads whenever you say it)? Here I attempt to address the 21 million bitcoin question. The answer is less trivial than it might appear.

Bitcoin’s Native Currency

Ironically, the Bitcoin protocol itself doesn’t deal with bitcoin the currency unit, but rather a much smaller unit known as a satoshi. The value of every output on the block chain is denominated in these indivisible units - not bitcoin.

Answering the 21 million bitcoin question therefore boils down to answering two questions about satoshis:

1. How was the upper limit on circulating satoshis chosen?
2. How was the ratio of satoshis:bitcoin set?

Total Money Stock

Imagine inventing a new form of money with a fixed number of indivisible currency units. One of your most important jobs would be to set the number of units. Too few and there wouldn’t be enough to serve the world’s people. Too many and you’d unnecessarily expose users to a variety of technical problems.

Computer science offers one way to answer the question.

All modern computers represent floating point numbers using the IEEE-754 standard (or just IEEE). This system is accurate, precise and quite efficient in most - but not all cases. Its biggest limitation is that sufficiently long numbers are rounded rather than being stored in full. Regardless of whether you’re using floating point numbers or pure integers, this behavior is baked into IEEE.

Rounding errors are the accountant’s sworn enemy. They masquerade as missing money or extra money whose sources can never be found. Rounding errors percolate throughout balance sheets and transaction logs. They sow confusion and suspicion wherever they appear.

To avoid turning Bitcoin into an accounting minefield, the number of total currency units must be kept below the IEEE rounding threshold - now and a hundred years in the future.

Fortunately, we can do that by ensuring that the total number of satoshis never exceeds 2⁵³ (9,007,199,254,740,992 or ~9.0 quintillion). This limit follows from the way that IEEE numbers are represented digitally. If you’ve ever worked with scientific notation, IEEE should make sense sense. For example, the number 42 can be represented as 4.2x10¹. The value 4.2 plays the role of the mantissa and 1 the exponent. IEEE uses a similar system to represent floating point numbers. Two varieties, 32-bit and the much more precise 64-bit (double), are common. The 64 bit version reserves 52 bits for the mantissa. One leading bit is implicit in the mantissa representation, yielding 53 of precision.

To avoid accidental rounding in practice, a safety margin would be desirable. For example, a one-bit margin would put the maximum value at 2⁵² (4.5 quintillion); a two-bit margin would put it at 2⁵¹ (2.3 quintillion)

The problem can also be approached from a monetary angle by determining the total number of indivisible currency units in existence. Because Bitcoin is an electronic cash system, the most relevant parameter would be aggregate M1. M1 accounts for the value of all physical currency, bank deposits and other highly-liquid forms of money. The CIA reports annual M1 values for each country. Summing these values yields a global value for M1. At the beginning of January 2009, the CIA reported global M1 in US dollars as $20,340,000,000,000.

However, a US dollar is divisible into 100 smaller units called cents. Given that the dollar is the most widely-traded currency, and that the cent is the smallest unit of money that can be transferred within the dollar system, it seems reasonable to consider M1, not in terms of US dollars, but US cents. To find the number of indivisible currency units (cents) in the world, multiply M1 by 100. Doing so leads to a rough count of the worlds indivisible currency units of 2,034,000,000,000,000 (2.0 quintillion).

Global M1 and the limits on IEEE numbers define a surprisingly tight range for the money stock of any would-be universal currency: between two and nine quintillion units.

Distribution Schedule

Bitcoin requires more than just a range for the final money stock - it requires a specific number. That number in turn depends on Bitcoin’s distribution method.

Bitcoin brilliantly aligns network security with money distribution through the block subsidy. This payment, made to the generator of a block that becomes part of the active chain, compensates auditors for the proof-of-work they provide while also acting as a conduit for the flow of newly-created money.

To incentivize early adoption, Satoshi envisioned a payout schedule modeled after a mining operation. Over time, yield decreases until no further value can be extracted. The main problem with this approach is deciding how exactly to cut the block subsidy. There are two main options:

1. cut at every block;
2. cut at every epoch, where an epoch represents a fixed number of blocks.

Satoshi chose to use epochs. Although the reasons have been discussed, Satoshi himself never commented on this choice. An epoch-based approach has the advantage of being simple to implement and describe. Either approach would have incentivized early adopters to begin hashing as soon as possible, so simplicity may have been the deciding factor.

At the end of each epoch, the value of the block subsidy is halved, yielding the geometric series 1, 1/2, 1/4, 1/16 and so on. In practice, the block subsidy must eventually be rounded down and then set to zero when it falls below one satoshi.

One consequence of this geometric progression is that the first epoch will produce 1/2 of all satoshis in circulation, a fact that will become relevant later when setting the initial block subsidy.

Length of an Epoch

An epoch must be short enough to be noticeable yet long enough to avoid subsidy depletion before fees become self-sustaining. Some simple (no doubt oversimplified) calculations help frame the issue.

There are three important values to determine:

1. the number of users representing “critical mass” at which point fees become self-sustaining;
2. the time needed to reach a critical user mass;
3. the time needed to deplete the block subsidy fund by two orders of magnitude (99%).

If Bitcoin doesn’t become self-sustaining in fees with 100% adoption, then its fixed-issuance scheme will fail. So the first point is easy to address. The critical user mass is no more than 6.8 billion (the world population in 2009).

The second point can be addressed partly through assumption and partly through data. The Bitcoin user base doubles every year. If we know the number of Bitcoin users at the end of 2009, we can calculate the time required for 100% adoption.

Assume for now that there were 1,000 Bitcoin users at the end of 2009. Given this assumption, it will take 29 years before every person uses Bitcoin. Frictional factors would no doubt slow the idealized growth rate in some years. However, getting every person on Earth to use any one monetary system is a very high bar considering it’s never been done before.

At this point, the goal becomes clear: find an epoch length that keeps subsidy payments flowing for at least 29 years. We can start by finding the number of halvings needed to reduce the subsidy fund by 99%. This turns out to be 7. Dividing 29 (the number of years subsidies must be paid) by 7 (the number of halvings) gives a lower bound on epoch duration: 4.1 years/halving.

To recap, the maximum epoch duration that keeps block subsidy payment flowing long enough for complete user adoption is 4.1 years. Four years also turns out to be the length of the US presidential election and leap year cycles. In other words, four years is short enough to be experienced by most people, but long enough to not be very disruptive.

The nature of the Bitcoin protocol makes measuring time more difficult than counting blocks. Therefore, it’s better to express the halving interval as a block count rather than a time interval. Blocks are generated at an average rate of one every ten minutes. The number of minutes in a one-year period is approximately 525,960, yielding a rate of 52,596 blocks per year or 210,384 every four years.

Rounding this value down for simplicity yields an epoch length of 210,000 blocks.

Initial Block Subsidy

Knowing the halving epoch length allows the value of the initial block subsidy to be set.

As noted before, the maximum number of satoshis generated during the first epoch will equal exactly half of the final money stock. Using the value of global M1 expressed in cents yields a cumulative first epoch payout of 1,017,000,000,000,000 satoshis.

In other words, no more than one quintillion satoshis may be released during the first epoch. Dividing this number by the epoch length (210,000 blocks) yields 4,842,857,143 satoshis/block. This is the ballpark lower limit for the initial block subsidy.

Rounding up to simplify yields an initial subsidy of 5 billion satoshis/block.

Recalculating Money Stock

Knowing the initial block subsidy enables a calculation of the total money stock. Given that the block subsidy applies over the entire duration of an epoch, the total value of subsidy payouts can be expressed as:

where α is the total issuance during the first epoch, 1.05 quintillion satoshis (210,000×5,000,000,000).

The infinite summation in this equation equals one. If a satoshi were infinitely divisible, then Bitcoin’s eventual total money stock would be 2×α, or 2.1 quintillion satoshis.

However, the Bitcoin protocol doesn’t currently support fractional satoshis. Therefore, the block subsidy will be rounded down along the way and eventually discontinued after 32 halvings.

The Bitcoin Wiki contains a helpful table summarizing each epoch. According to this table, the final money stock resulting from a 5 billion satoshi initial subsidy and 210,000-block epochs will be 2,099,999,997,690,000 satoshis.

But this isn’t the end of the story. For technical reasons imposed by Satoshi himself, the Genesis Block subsidy is unspendable. So 5 billion satoshis need to be deducted from the total.

Several mishaps in subsequent blocks have reduced the eventual total money stock even further. This is possible because Bitcoin allows block generators to claim a subsidy less than the maximum allowed in a given epoch. Examples include:

• The coinbase transaction of block 124724 failed to claim one satoshi of block subsidy and none of the fees, resulting in the permanent destruction of 1,000,001 satoshis.
• The coinbase transaction of block 501726 failed to claim any block subsidy, resulting in the permanent destruction of 1,250,000,000 satoshis.

The Genesis block payout, the above errors in coinbase transactions, and the use of OP_RETURN provably unspendable outputs have all reduced Bitcoin’s eventual total money stock by billions of satoshis. This doesn’t include depletion due to users who lost private keys or deliberately burned satoshis.

Although using a nice round number of 2.1. quintillion satoshis simplifies discussions, the real count will be slightly lower.

A More Manageable Monetary Unit

Of all the irrational psychological factors in investing, dollar parity may be the most pervasive. An asset reaches dollar parity when its preferred unit can be purchased for one dollar. Look no further than equities investors, who use the derogatory term “penny stock” to describe a highly speculative investment. On the other side, a stock whose price rises above about $100 becomes a candidate for a split, despite the fact that a stock split changes nothing about the underlying value of a company.

In a world that has adopted Bitcoin as its only system of money, one satoshi would hold about one US cent of value. But in the first several years of its existence, one satoshi would remain worthless for all practical purposes.

What’s needed is a complementary unit (“bitcoin”) that can achieve dollar parity quickly, but not so quickly that valuations in the thousands of dollars spook investors.

Imagine a world in which one millionth of the M1 money stock as of 2009 (2,034,000,000,000,000 cents) existed as satoshis. This would put Bitcoin near the bottom of a list of the world’s countries sorted by decreasing M1.

Smallest National M1 in 2009. World countries sorted by ascending M1. If it were a country with one millionth of the worlds M1, Bitcoin (italics) would be ranked third from the bottom. Source: CIA World Factbook.

Country	M1 (billions of dollars)	M1 (% of world)
Anguilla	17.2	0.000085
Monserrat	17.3	0.000085
Bitcoin	20.3	0.00010
Sao Tome and Principe	23.6	0.00012
Micronesia, Federated States of	26.3	0.00013
Cook Islands	30.6	0.00015
Tonga	40.5	0.00020

The satoshi to bitcoin ratio needed for dollar parity under these conditions is 100,000,000:1. It may be no coincidence that bitcoin/dollar parity occurred in February, 2011 - just over three years after Bitcoin’s first release. Conversely, bitcoin valuations in the thousands of dollars starting in 2017 have led, in part, to non-stop cries of “overvaluation” and “bubble.” A bubble argument would lose much of its punch for an asset that hadn’t even reached dollar parity.

As an aside, a world in which the role of M1 were transferred exclusively to the Bitcoin protocol, and Bitcoin served no other purpose, would value one bitcoin at $1,000,000 (NSFW). In other words, the upper limit of the USD/BTC exchange rate based on Bitcoin supplanting M1 and only serving that purpose is one million dollars. Parity between the US cent and the satoshi would no doubt be considered a landmark event.

Historical Evidence

Support for the idea that global M1 played a role in answering the 21 million bitcoin questions comes by way of Ray Dillinger (aka Cryddit on Bitcointalk) who related this story:

I remember this discussion, actually.

Finney, Satoshi, and I discussed how divisible a Bitcoin ought to be. Satoshi had already more or less decided on a 50-coin per block payout with halving every so often to add up to a 21M coin supply. Finney made the point that people should never need any currency division smaller than a US penny, and then somebody (I forget who) consulted some oracle somewhere like maybe Wikipedia and figured out what the entire world’s M1 money supply at that time was.

We debated for a while about which measure of money Bitcoin most closely approximated; but M2, M3, and so on are all for debt-based currencies, so I agreed with Finney that M1 was probably the best measure.

21Million, times 10^8 subdivisions, meant that even if the whole word’s money supply were replaced by the 21 million bitcoins the smallest unit (we weren’t calling them Satoshis yet) would still be worth a bit less than a penny, so no matter what happened – even if the entire economy of planet earth were measured in Bitcoin – it would never inconvenience people by being too large a unit for convenience.

Ray was the first person to publicly comment on Satoshi’s white paper. He did so almost two months before the first release of Bitcoin.

Conclusions

The rough calculations in this article point to a clear answer to the 21 million bitcoin question: Bitcoin was designed from the start to be capable of replacing the world’s national currencies. This audacious plan placed several key constraints on Bitcoin’s monetary parameters. The 21 million bitcoin supply cap reflects these constraints, specifically:

• the eventual money stock, expressed in satoshis, fits cleanly within the IEEE floating point representation system;
• the eventual money stock, expressed in satoshis, roughly equals global M1 money stock in 2009, expressed in cents;
• the satoshi to bitcoin ratio of 100,000,000:1 ensured that dollar parity would be achieved around the time that Bitcoin’s network valuation matched M1 of the world’s smallest countries;
• the halving schedule ensures that the block subsidy will continue to be paid until Bitcoin has reached a critical mass of adoption.