The Math Behind Bitcoin
Bitcoin's famous limit of 21 million coins isn't stored as a number anywhere in its code. There's no line that says MAX_COINS = 21000000. The limit falls out of a geometric series, the same math that tells you 1 + ½ + ¼ + ⅛ + … adds up to 2.
Almost everything about Bitcoin works this way. Its rules are simple mathematical constraints, and its security rests on probability and number theory rather than trust in any institution.
The Coin Limit Comes From Halving, Not From a Cap
When Bitcoin launched on January 3, 2009, each new block rewarded its miner with 50 BTC. Every 210,000 blocks (roughly every four years) that reward halves: 25, then 12.5, then 6.25, then 3.125 after the April 2024 halving.
Total supply is the sum:
210,000 × (50 + 25 + 12.5 + 6.25 + …)
= 210,000 × 50 × (1 + ½ + ¼ + …)
= 210,000 × 50 × 2
= 21,000,000
The infinite series 1 + ½ + ¼ + … converges to exactly 2. In practice, rewards are counted in whole satoshis (0.00000001 BTC), so the reward reaches zero after 33 halvings, around the year 2140, and total supply ends just under 21 million. You can explore those units with the Bitcoin unit converter.
Step 1: Hash Functions
Bitcoin relies heavily on SHA-256, a cryptographic hash function that turns any input into a 256-bit output. A hash function has three key properties:
- Deterministic: the same input always gives the same output.
- Avalanche effect: changing one bit of input changes about half the output bits.
- One-way: you can't work backwards from the output to the input.
There are 2²⁵⁶ possible outputs, a 78-digit number. That's in the same ballpark as some estimates of the number of atoms in the observable universe (around 10⁸⁰). The output is usually written in hexadecimal: 64 hex characters, since each hex digit holds 4 bits. See how that works with the binary to hexadecimal converter.
Step 2: Proof of Work
To add a block, miners must find a number called a nonce so that:
SHA-256(SHA-256(block header)) < target
Since hash outputs are effectively random, the only way to find a valid hash is to guess, over and over. If the target means a hash must start with about k zero bits, the chance of success on one try is about 1 in 2ᵏ.
That's a geometric distribution: the number of tries until the first success. The expected number of attempts is 1/p. Mining is a lottery where each ticket is one hash computation.
Step 3: Difficulty Adjustment
Bitcoin aims for one block every 10 minutes. Every 2,016 blocks (about two weeks), the network recalculates the target:
new target = old target × (actual time for 2,016 blocks / 20,160 minutes)
If blocks came too fast, the target shrinks and mining gets harder. The adjustment is capped at a factor of 4 in either direction. This simple feedback loop has kept average block times close to 10 minutes as network computing power has grown by many orders of magnitude.
Step 4: Elliptic Curve Signatures
Who owns a coin? Whoever can produce a valid digital signature with the right private key. Bitcoin uses the elliptic curve secp256k1:
y² = x³ + 7 (mod p)
Where p is a prime just below 2²⁵⁶. Points on this curve can be "added" by a geometric rule, and adding a point to itself repeatedly gives scalar multiplication:
Public key = private key × G
G is a fixed starting point. Computing the public key from the private key is fast. Reversing it, the elliptic curve discrete logarithm problem, is believed to be infeasible for 256-bit keys.
Step 5: Merkle Trees
A block can contain thousands of transactions. Bitcoin summarizes them with a Merkle tree: hash transactions in pairs, then hash those hashes in pairs, until one Merkle root remains.
To prove a transaction is in a block with n transactions, you only need about log₂(n) hashes. For 4,096 transactions that's just 12. The base-2 logarithm table shows how slowly that grows.
An Insider Reference: The Six-Confirmation Rule
The pseudonymous Satoshi Nakamoto published the Bitcoin white paper on October 31, 2008. Its section 11 does something rare for a technology proposal: it calculates the probability of a successful attack.
Nakamoto modeled an attacker as a random walk trying to catch up with the honest chain. Using a Poisson distribution, the paper shows that an attacker controlling 10% of mining power has only about a 0.09% chance (0.0009137) of reversing a transaction buried 5 blocks deep. Exchanges' common "six confirmations" rule traces back to this kind of calculation.
Two Concepts Worth Knowing
Geometric Series
A geometric series a + ar + ar² + … with |r| < 1 sums to a / (1 − r). For Bitcoin's rewards, a = 50 and r = ½, giving 100 per 210,000-block era, and exactly 21 million overall.
Modular Arithmetic
All elliptic curve calculations happen modulo a prime, so numbers wrap around and stay within a fixed range. The number theory formulas cover the basics.
Quick Answer: What Math Does Bitcoin Use?
Bitcoin uses SHA-256 cryptographic hashing for proof of work and block linking, elliptic curve cryptography (secp256k1) for signatures, Merkle trees for summarizing transactions, and a halving block reward whose geometric series caps supply at 21 million coins.
Try Them Yourself
- Bitcoin Unit Converter: BTC, mBTC, bits and satoshis
- Binary to Hexadecimal: how hashes are written
- Base-2 Logarithm Table: Merkle proof sizes
- Prime Checker: primes behind elliptic curve fields
- Number Theory Formulas: modular arithmetic
- The Mathematics Behind Cryptography: the bigger picture
Add up 50 + 25 + 12.5 + … on a calculator and multiply by 210,000. Watching the total creep toward 21 million is the clearest way to see Bitcoin's monetary policy.