There are a number of things about money that I did not discuss in my previous post and perhaps should have, some of which came up in comments on my post and my responses.
This makes sense. I had just seen someone else on substack use 'le weekend' as a joke and couldn't tell if there it was the internet's favorite bit for a week and so referenced additional material.
I wonder a bit about the inherent stability of crypto coins, in that they might be more stable than we give them credit for, but since they interact with tangible goods primarily through fiat currencies they inherit the instability. I am imagining a very sturdy house build upon a thick layer of sand above bedrock. You get some rain, the sand moves around and the house drops at a strange angle and people think the house is unstable, but really it is the sand that moves; the house sitting on the bedrock would be fine. So if a Bitcoin could be the primary unit of exchange for goods, maybe the price would be much more stable, but since people trade Bitcoin for fiat currency then buy goods, the swings in the value of the currency are what cause the swings in value of the Bitcoin.
I honestly don't know, though. I don't have any skin in the game there so I don't keep track, just seems like a possibility.
I think that is true, but it seems like it is in part due to the fact that a Bitcoin user needs to use dollars or Euros as an intermediary to get goods. As a result, the price of Bitcoin swings around with speculation on the relationship between Bitcoin and other currencies. Gold seems to move around in a similar fashion, although admittedly not as much.
A few clarifications from someone in the industry for a long time:
A bigger problem with Chaumian cash is that it makes the issuer unaccountable, leaving the system wide open to insider fraud. There is no way of veryfing that they have not issued unbacked tokens. This problem has been recently solved with the revolution in cryptography around a little-known (outside of crypto circles) concept called "zero-knowledge proof", this is as big a deal as the invention of public key cryptography in the 1970's, and just as "magical", achieving something that intuitively seems impossible: a third party executing an algorithm can prove that they have executed it correctly, without disclosing some of the inputs. Now there exist some privacy coins, where the blockchain contains publicly verifyable proofs of correctly updating the state with each transaction without disclosing the details such as the participants or the amounts involved. The two most popular privacy coins are Monero and (as a distant second) Z-cash. Needless to say that using them is illegal in most jurisdictions and centralized exchanges have been forced to delist them, so even getting reliable exchange rates is a challenge. Cryptocurrency exchange transactions involving privacy coins automatically "taint" participating non-privacy coins, so AML laws are, unfortunately, I must add, somewhat enforcable despite the existence of privacy coins.
A related development is so-called Layer-2 (or L2, for short) solutions, where the public blockhcain acts as a final arbiter, but most transactions are conducted off-chain. For Bitcoin, the most popular L2 is the Lightning Network (or LN for short). What typically happens is that small transactions are conducted on L2s and sometimes settled on-chain when the amounts involved become big enough. In this world, large transactions are public, but small ones are not. This is not necessarily a bad outcome, I finally don't have to disclose my entire transaction history and account balance each time I buy a cup of coffee, but big-ticket transactions are still traceable. On the Ethereum blockchain, allowing far more sophisticated smart contracts than Bitcoin, there are L2 solutions utilizing ZK proofs under development called ZK rollups. They are expected to solve the problems of both privacy and scalability without compromises. None of them are quite there yet, but it now seems within reach in a very short time.
The non-scam algorithmic stablecoins are "byproducts" of leveraged trading. They have been pioneered by Maker DAO (decentralized autonomous organization -- an organization coordinated by smart contracts), but currently the cleanest implementation is run by a DAO called Liquity. In order to function, they need two things: an independently valuable, but possibly volatile asset, such as Ether (or Bitcoin, if it had better smart contract facilities -- it might get them in the future) and a so-called oracle, a source of the exchange rate between this asset and the peg, typically USD, but could be a basket of commodities in theory (and the future). All stablecoins are issued by a smart contract as over-collateralized credit, with the volatile asset acting as collateral. I.e. in order to borrow 1 XUSD (a hypothetical stablecoin pegged to USD), one must deposing at least, say, 1.5 USD worth of Ether (as per the oracle) as collateral. When the XUSD loan is repaid (with interest) the borrower gets back the collateral. If the value of the collateral falls below the over-collateralization requirement, the collateralized debt position is liquidated, i.e. the collateral is auctioned off for XUSD, the loan is repaid with the proceeds and the borrower only gets back what remains (minus penalty). Experience shows that such stablecoins can steadfastly maintain their peg even in the face of wild fluctuations in the value of the asset used as collateral. What they enable is to allocate volatility risk efficiently: those who need stability, buy these stablecoins, whereas those who want greater exposure to volatility borrow them from the smart contract, sell them to the former kind of user (in exchange for the volatile asset) and borrow some more against the proceeds, selling those as well, thus maintaining a leveraged position in the underlying cryptocurrency. The only connection of this thing with the world outside the blockchain is the exchange rate oracle. The mechanism maintaining the peg is that if the value of the stablecoin goes below it, it makes repaying the loans profitable, thereby reducing supply, whereas if it goes above it, it becomes profitable to borrow and short-sell on the (self-fulfilling) expectation that it will eventually return to the peg.
Have you taken a look at my stablecoin proposal? It obviously requires an oracle, and it is unstable if the demand for the money is declining in the long run. Is there anything else wrong with it? I would be interested in the opinion of someone who knows much more about this stuff than I do. It's an economist's solution to the problem not a cryptographer's.
One solution to the problem with Chaumian cash would be an issuer sufficiently wealthy so there is no significant risk of inability to redeem — the Scottish approach. You still need a legal framework where his obligation to redeem is enforceable, but there should be some way using digital signatures to do that, to prove to a court that he has issued a dollar and refused to redeem it.
I have just re-read your stablecoin proposal carefully. On a very high level, it is very similar to how good algorithmic stablecoins actually work, but your proposal has a weakness in the details: you only throttle issuers when they become insolvent, which is too late. In practice, as such a system grows from obscurity to increased popularity, there is a long time during which the demand is growing so fast that the price pressure is always upwards, allowing all issuers to issue without regard to their financial health. By the time the going gets tough for the first time, it is quite likely that all of them will run out of reserves long before all coins are taken out of circulation. The algorithmic stablecoins that have a reasonably long track record of maintaining their peg -- including times of "crypto winters" -- all monitor their issuers' reserves (the collateral) and require it to be well above the amount they have issued at all times. The collateral gets liquidated not when the issuer becomes insolvent, but when the over-collateralization requirement is not met, which happens a lot earlier.
Your proposed solution to insider fraud with Chaumian cash requiring an issuer to be sufficiently wealthy is a bit unclear about what "sufficient" means here. With Chaumian cash, the problem is that the total amount of tokens in circulation is unknowable. Given the marginally zero cost of minting tokens, a fraudulent insider with access to the private key can mint an arbitrary amount of tokens and get away with it. One solution to limit such damage is to introduce regular epochs (e.g. years) when the issuing private key is changed. Only tokens from the current and the previous epoch are redeemed for collateral or, upon request, exchanged for new tokens of the current epoch. In this case, any excess issue is caught at the end of the next epoch. The drawback is that such tokens can lo longer be stashed away in a passive storage for indefinite time.
I don't think my system requires issuers to have adequate reserves but it does require the long term trend to be believed positive. As long as that is the case, the right to be an issuer, which is transferable along with the private key — there should be a mechanism by which the new owner can change it — has positive value, so if an issuer runs out of money in a decline believed temporary he can sell the right to someone who can afford to redeem.
I think the relevant experience here would be whether, during a free banking regime, it was typical that banks experiencing a bank run to be bought out by sufficiently solvent buyers in the hope of restoring solvency and reaping continued profits from issuing money after the run is over? I do not know, but I would be surprised if that were the case.
In crypto, the experience with different kinds of stablecoins is limited, but here is what happened so far:
1. Single-collateral DAI (later renamed SAI) and LUSD (the kind of algorithmic stablecoins outlined in my comments above) have weathered all calamities thrown at them so far very well. Interestingly, during times of high volatility, they tend to trade slightly above their peg.
2. USDC, a regulated stablecoin issued in exchange for regularly audited bank deposits of USD (and redeemable for them by designated parties), lost its peg when Silicon Valley Bank in which a little over 7% of its reserves were kept failed on Friday, March 10, 2023 and recovered on Monday, when depositors were bailed out.
3. Multi-collateral DAI that "stabilized" its peg by allowing instant issuance in exchange for USDC locked in its smart contract at a 1:1 rate lost the peg together with USDC and its reserves were pumped full of USDC during that time. It took them quite some time to purge that toxic asset, requiring some governance actions on the smart contract.
4. USDT, by far the most popular stablecoin (and the first really popular one), is also (claimed to be) issued in exchange for USD bank deposits, some of which they use to buy short-term US government obligations (and have become the #1 buyers of such by now) and is redeemable for USD only in large quantities. However, unlike USDC, they do not disclose where they keep their reserves, ostensibly to prevent legal attacks on them. They are widely believed to be cheating, buying Bitcoin at the beginning of rallies (which they themselves help setting in motion; they are big enough to be able to do it) for unbacked USDT, making up for the shortfall of USD reserves later in the market cycle selling part of their BTC holdings. We do not know for sure. Unlike USDC, they have a long and spotless track record of maintaining their peg.
5. UST (a.k.a. TerraUSD), an elaborate Ponzi scam running between 2018 and its collapse in 2022. Because of the good timing of its launch at the bottom of the market cycle for cryptocurrencies and effective marketing, the demand kept it alive for four years straight. Before its collapse, it was the third largest stablecoin (after USDT and DAI) in circulation.
The last one is an important cautionary tale about financially unsound designs being able to grow large and live long enough for a large number of people to have confidence in them. Good algorithmic stablecoins start throttling issuance long before actual insolvency.
Some more clarifications. Monero isn't a zero-knowledge chain; that's the direction they want to move to. Zcash has been zero-knowledge since launch in 2016.
"Using them is illegal in most jurisdictions and centralized exchanges have been forced to delist them" is not true of Zcash. U.S. exchanges I know off the top of my head: Coinbase, Gemini, Kraken.
Since I know him I'm sure it was polite and on-topic, from someone with firsthand experience in private money since Chaum, so I guess you'd want to hear that Substack ate it.
> A second problem with Bitcoin as money is that its value is unstable. This is a minor inconvenience for using it as a currency, a much greater inconvenience for using it as a unit of value. To have a cryptocurrency that works as both one needs a cryptocurrency that has a constant value, a stablecoin.
Is it possible that the sort of automation that is loosening the network effect of medium-of-exchange could also dissolve this one, meaning that you do _not_ need a cryptocurrency that has a constant value, and stablecoins are unneeded?
I can think of at least two, complementary, ways that automation might change this:
1. Long-term contracts could become indexed by some other measures of value instead of being indexed by the value of a currency. Alice could agree to lend Bob USD $10,000 today in return for, not 5% annual interest denominated in USD, but 5% annual interest denominated in USD and adjusted for inflation. Or, in return for 5% annual interest denominated in a specific basket of goods that Alice and Bob (or their computer agents operating on their behalf) agree on.
2. Alice needs to hedge against the possibility that her future income from her loan to Bob is worth less than her future expenses, because the currency that Bob is paying her back has fallen in value compared to the expenses she'll incur at that time. But she doesn't *have* to get this protection out of her contract with Bob! (As she does in 1 above.) She can separately buy an instrument which will pay her more, when Bob's loan comes due, in proportion to how much the value of the currency has fallen. Again, her automated agent could do this on her behalf. (And of course, on the other side, Bob needs protection against the eventuality that the value of the currency that he owes Alice has gone _up_ since he took out the loan, and he can get protection against that eventuality in the same way -- by paying a third party to for it.)
When I think about it from this perspective, I think that "stablecoins" are an attempt to provide this feature to users, but in a "one size fits all" fashion -- no user can get greater or lesser protection from future changes in the value of the currency than any other user, just by using a stablecoin as medium-of-exchange (short term) and unit-of-account (long term). Maybe if improved financial tech can provide these in a more customized and efficient solution for each individual, then the need for stablecoins will evaporate. Similar to how the automated currency exchange that comes with your debit card has eliminated the need for you and your vendor to use a common currency.
Next topic:
> There have been a number of projects to create fully anonymous cryptocurrencies and I have not followed them closely enough to judge if any yet can be fully trusted.
I would commend Zcash to your attention. (I'm a founder and developer of Zcash.)
Zcash uses advanced cryptography to provide strong privacy to each user without any centralized party/server/bank. The result is that the currency is strongly censorship-resistant as well as private (and therefore fungible). Zcash, like Bitcoin, has a simple notion of scarcity built in: there will never be more than 21 million Zcash coins.
In order to create Zcash, we advanced the state of the art of cryptography, such as the Zero-Knowledge Proofs that Daniel Nagy rightly praises above.
I noticed David Trost saying in the comments that privacy-preserving cryptocurrencies are illegal, or "effectively illegal". As the founder of Zcash, I've seen arguments like that a *lot* over the years. What David Trost wrote in the comments is mostly incorrect. I'd be happy to delve into details if there is interest, but even better than argument would be experiment!
Experiment 1: Ask your favorite search engine for "Zcash Wallets". Then download a Zcash wallet from the Apple App Store or the Google Play Store. (Assuming you're on mobile. You can do the same on desktop.) Now you have the ability to send, receive, and store Zcash without depending on any third party (custodian, bank, server)! And, you have the ability to control *disclosure* of your Zcash holdings and transactions. By default, nothing about that is disclosed to anyone else. You've now completed experiment 1.
David Trost's arguments in these comments are largely about whether third-party businesses will engage in Zcash transactions with you. That's important. The most common way that people buy or sell cryptocurrency is by using "exchanges", like Coinbase or Binance. If you experiment 1 showed you that you can own and control your own Zcash, but you are unable to conveniently and safely buy any Zcash, then his claim that Zcash is semi-illegal would still be valid.
Experiment 2: Create an account at any one of the three large USA exchanges -- Coinbase, Gemini, or Kraken -- or the largest world-wide exchange -- Binance -- buy some Zcash, and withdraw it to your wallet. (Or, since the "creating an account" part is a time-consuming hassle, ask a friend who already has an account to do this for you.) You've now completed experiment 2.
The one issue your experiment, which I have not yet done, raises is that if I buy ZCash from an exchange, that is presumably not private. So the fact I am a Zcash user is known, what I do with the money is not. That is less true if I buy ZCash from a private individual, since who I got it from is not deducible from public information, especially if I bought it with cash, also an anonymous currency.
The point matters because if there are only a few ZCash users, the fact that you are one of them signals hypothetical spies to watch you, but not if there are a large number of ZCash users.
In any case, thanks for a very informative response.
(Speaking as a founder in the space) It's not illegal for you as a user. But it's effectively illegal due to a confluence of factors.
(1) For the 99.9% of potential users, cryptocurrency is too hard to do purely roll-your-own with open source tools. It's theoretically possible, just not at all practical. This means you need a service provider to make it easy... A company.
(2) A company providing money services to US residents is regulated by the Bank Secrecy Act, the Patriot act, etc. So we MUST know basically everything about who you are, where your money came from and who it is going to and why.
(3) This is fundamentally incompatible with a privacy focused currency like monero. So with all the features of monero effectively removed, you might as well use Bitcoin or whatever other (more popular) cryptocurrency.
Even foreign companies serving US customers must comply. Of course enforcement depends on the US govt's ability to extradite from said country. Not every country, but most countries (all the important ones) have similar Anti money-laundering/anti-terrorism (AML/CFT) laws on the books. This is due to a concerted effort/influence by the US to expand their reach.
Separately, and arguably more importantly from a US perspective, US banks are also responsible for ensuring that the foreign banks that they work with are themselves implementing the same AML/CFT monitoring. So there's this global financial system which is really a US financial system where everyone is playing by the same set of rules. (Kindof analogous to a copy-left open source license). And those rules simply are incompatible with Monero and privacy focused money more generally. If Monero is a big privacy fence around your yard, AML is the laws that say your fence must be see-through glass.
So IF you ignore AML laws,
and IF you lie to your bank about the nature of your business, you can run a business helping customers transact privately with Monero... Until you get caught and have your bank account frozen and get extradited/go to jail of course, which shouldn't take long.
I don't know what Daniel Nagy meant by "illegal" -- I think the status in the U.S. is mostly equivalent to paper cash (my "mostly" coming mostly from income tax being denominated in dollars).
My background: I don't work in cryptocurrencies or follow closely. I've used Zcash for some ordinary cash transactions. My friend Zooko who led the Zcash project at launch recruited me for it as a software engineer (I was tempted but didn't bite).
Zooko knows Patri -- I'll bet he'd be happy to chat. He worked for Chaum too to start his career.
Another very important development in the cryptocurrency space that might help bring about commodity-basket pegged stablecoins is the invention of Automated Marketmakers (AMM) by Uniswap. This is a very big deal, the second reliable price discovery mechanism after the invention of the exchange with a public orderbook thousands of years ago. An AMM is a smart contract holding (in its simplest form) a pair of assets in some quantity that is deemed to be -- by definition -- of equal value. Two types of users can interact with the AMM:
1. Swappers, who want to exchange one asset for the other. They put the asset they want to sell into the smart contract and take the other one out. This decreases the price of what they sold and increases the price of what they bought through the invariant that the assets in the AMM have equal value. They also need to pay a small fee.
2. Liquidity providers (LPs), who have assets they don't need at the moment and want to earn by locking them up in the AMM: they must deposit both kinds of assets in the same proportion as the AMM already holds in exchange for tokens that can be used to claim part of the transaction fees paid by swappers. The tokens can also be used to withrdaw the corresponding amount of assets from the AMM. Of course, if a prospective LP only has one of the assets, they can use the AMM as a swapper in order to get the other one in needed quantities before providing liquidity.
The big advantage of AMMs against orderbooks is that they separate the roles of liquidity providers and swappers, whereas on a traditional exchange, both roles are played by participating traders, so one only has a reliable price signal when there are enough buyers and sellers. With AMMs, one can instantiate reliable price oracles even for very illiquid assets with a tiny market capitalization. This enables all sorts of tokenized assets to be traded permissionlessly, with reliable price oracles. For example, warehouse receipts for commodities. This, together with the algorithmic stablecoin described above, can become a building block of a commodity-basket pegged stablecoin that does not even require locking up large quantities of the commodity tokens, just use their market as a price oracle, locking up Ether or similar assets instead. Unlike commodity tokens, which cause a shortage of the commodity when too many are locked up, locking up Ether simply increases its price in "a tax that nobody pays" (as per your previous essay), since their only value is that they are valuable. There is no loss in having some or even most of it locked up in smart contracts as collateral.
I have a simple question which might not be so simple: what is the difference between money and currency, for economists? Is it entirely a difference of physical vs numbers? I sometimes think that, but a non-fractional reserve gold-based system seems both.
Muggers don't demand your currency or your life. When we need to borrow, we don't ask our friends how much currency they have in their pockets. So to us laymen, money is pretty much everything, but we do sometimes use "currency", although maybe that's just coin collectors, or travelers looking at foreign currency for the first time.
Good question. I don't think of the balance in my checking account as currency, do think of it as money. I think I use "currency" for physical objects such as coins or bank notes but not for money more generally.
But I don't have an explicit definition of the distinction.
That was "Interesting Times" several posts back. My previous post was expected to annoy my Rothbardian readers, at least any who started reading after "Critique of a Version of Austrian Economics." This post might annoy some Bitcoin fans.
I've written four posts on the general subject of tariffs, as well as two on Vance that covered his views on tariffs and one recently on Trump where I wrote " I expect his tariff policy to make both the US and its trading partners poorer." His tariff policy pretty obviously makes no economic sense, but I don't see much interesting to say about it beyond that. Vance is actually the more interesting of the two, since he may have a coherent ideology and economic theory — it's hard to tell, given that he has to support Trump.
His tariff policy obviously makes no sense, has bad consequences. I have already said that. The purpose of this Substack is not to proclaim my political views but to explain and explore ideas, and I think I have already said the things about tariffs, not limited to Trump's, that need saying.
I believe in an expanded version of Bambi's mother's rule: If you don't have anything to say, don't say anything.
Vance does not have to support Trump but he obviously wants to be Trump's successor and, unless things go badly enough to destroy Trump's control of the party, possible but not I think likely, that requires keeping Trump's support. I am disappointed by Vance's behavior but not greatly surprised.
Perhaps I have missed something. Why should this column annoy Trumpists? And given Mr. Friedman’s thorough and well-demonstrated iconoclasm, even if it does, why would you expect him to worry?
"It" in that sentence is "one important feature of a money was that it was the same one used by the people you interacted with." It is still convenient for money to have that feature.
“Except in France”
A shame this post did not come out two days from now.
Then I could have said you made my le weekend…
I didn’t see it until now. It made MY le weekend.
I’ve no idea if this references anything, but I’ll finished what you started.
I think the point is that "le weekend" is an example of a word used in french in violation of the official system for approving words.
This makes sense. I had just seen someone else on substack use 'le weekend' as a joke and couldn't tell if there it was the internet's favorite bit for a week and so referenced additional material.
I wonder a bit about the inherent stability of crypto coins, in that they might be more stable than we give them credit for, but since they interact with tangible goods primarily through fiat currencies they inherit the instability. I am imagining a very sturdy house build upon a thick layer of sand above bedrock. You get some rain, the sand moves around and the house drops at a strange angle and people think the house is unstable, but really it is the sand that moves; the house sitting on the bedrock would be fine. So if a Bitcoin could be the primary unit of exchange for goods, maybe the price would be much more stable, but since people trade Bitcoin for fiat currency then buy goods, the swings in the value of the currency are what cause the swings in value of the Bitcoin.
I honestly don't know, though. I don't have any skin in the game there so I don't keep track, just seems like a possibility.
I think Bitcoin varies in purchasing power considerably more than dollars or Euros do.
I think that is true, but it seems like it is in part due to the fact that a Bitcoin user needs to use dollars or Euros as an intermediary to get goods. As a result, the price of Bitcoin swings around with speculation on the relationship between Bitcoin and other currencies. Gold seems to move around in a similar fashion, although admittedly not as much.
A few clarifications from someone in the industry for a long time:
A bigger problem with Chaumian cash is that it makes the issuer unaccountable, leaving the system wide open to insider fraud. There is no way of veryfing that they have not issued unbacked tokens. This problem has been recently solved with the revolution in cryptography around a little-known (outside of crypto circles) concept called "zero-knowledge proof", this is as big a deal as the invention of public key cryptography in the 1970's, and just as "magical", achieving something that intuitively seems impossible: a third party executing an algorithm can prove that they have executed it correctly, without disclosing some of the inputs. Now there exist some privacy coins, where the blockchain contains publicly verifyable proofs of correctly updating the state with each transaction without disclosing the details such as the participants or the amounts involved. The two most popular privacy coins are Monero and (as a distant second) Z-cash. Needless to say that using them is illegal in most jurisdictions and centralized exchanges have been forced to delist them, so even getting reliable exchange rates is a challenge. Cryptocurrency exchange transactions involving privacy coins automatically "taint" participating non-privacy coins, so AML laws are, unfortunately, I must add, somewhat enforcable despite the existence of privacy coins.
A related development is so-called Layer-2 (or L2, for short) solutions, where the public blockhcain acts as a final arbiter, but most transactions are conducted off-chain. For Bitcoin, the most popular L2 is the Lightning Network (or LN for short). What typically happens is that small transactions are conducted on L2s and sometimes settled on-chain when the amounts involved become big enough. In this world, large transactions are public, but small ones are not. This is not necessarily a bad outcome, I finally don't have to disclose my entire transaction history and account balance each time I buy a cup of coffee, but big-ticket transactions are still traceable. On the Ethereum blockchain, allowing far more sophisticated smart contracts than Bitcoin, there are L2 solutions utilizing ZK proofs under development called ZK rollups. They are expected to solve the problems of both privacy and scalability without compromises. None of them are quite there yet, but it now seems within reach in a very short time.
The non-scam algorithmic stablecoins are "byproducts" of leveraged trading. They have been pioneered by Maker DAO (decentralized autonomous organization -- an organization coordinated by smart contracts), but currently the cleanest implementation is run by a DAO called Liquity. In order to function, they need two things: an independently valuable, but possibly volatile asset, such as Ether (or Bitcoin, if it had better smart contract facilities -- it might get them in the future) and a so-called oracle, a source of the exchange rate between this asset and the peg, typically USD, but could be a basket of commodities in theory (and the future). All stablecoins are issued by a smart contract as over-collateralized credit, with the volatile asset acting as collateral. I.e. in order to borrow 1 XUSD (a hypothetical stablecoin pegged to USD), one must deposing at least, say, 1.5 USD worth of Ether (as per the oracle) as collateral. When the XUSD loan is repaid (with interest) the borrower gets back the collateral. If the value of the collateral falls below the over-collateralization requirement, the collateralized debt position is liquidated, i.e. the collateral is auctioned off for XUSD, the loan is repaid with the proceeds and the borrower only gets back what remains (minus penalty). Experience shows that such stablecoins can steadfastly maintain their peg even in the face of wild fluctuations in the value of the asset used as collateral. What they enable is to allocate volatility risk efficiently: those who need stability, buy these stablecoins, whereas those who want greater exposure to volatility borrow them from the smart contract, sell them to the former kind of user (in exchange for the volatile asset) and borrow some more against the proceeds, selling those as well, thus maintaining a leveraged position in the underlying cryptocurrency. The only connection of this thing with the world outside the blockchain is the exchange rate oracle. The mechanism maintaining the peg is that if the value of the stablecoin goes below it, it makes repaying the loans profitable, thereby reducing supply, whereas if it goes above it, it becomes profitable to borrow and short-sell on the (self-fulfilling) expectation that it will eventually return to the peg.
Have you taken a look at my stablecoin proposal? It obviously requires an oracle, and it is unstable if the demand for the money is declining in the long run. Is there anything else wrong with it? I would be interested in the opinion of someone who knows much more about this stuff than I do. It's an economist's solution to the problem not a cryptographer's.
One solution to the problem with Chaumian cash would be an issuer sufficiently wealthy so there is no significant risk of inability to redeem — the Scottish approach. You still need a legal framework where his obligation to redeem is enforceable, but there should be some way using digital signatures to do that, to prove to a court that he has issued a dollar and refused to redeem it.
I have just re-read your stablecoin proposal carefully. On a very high level, it is very similar to how good algorithmic stablecoins actually work, but your proposal has a weakness in the details: you only throttle issuers when they become insolvent, which is too late. In practice, as such a system grows from obscurity to increased popularity, there is a long time during which the demand is growing so fast that the price pressure is always upwards, allowing all issuers to issue without regard to their financial health. By the time the going gets tough for the first time, it is quite likely that all of them will run out of reserves long before all coins are taken out of circulation. The algorithmic stablecoins that have a reasonably long track record of maintaining their peg -- including times of "crypto winters" -- all monitor their issuers' reserves (the collateral) and require it to be well above the amount they have issued at all times. The collateral gets liquidated not when the issuer becomes insolvent, but when the over-collateralization requirement is not met, which happens a lot earlier.
Your proposed solution to insider fraud with Chaumian cash requiring an issuer to be sufficiently wealthy is a bit unclear about what "sufficient" means here. With Chaumian cash, the problem is that the total amount of tokens in circulation is unknowable. Given the marginally zero cost of minting tokens, a fraudulent insider with access to the private key can mint an arbitrary amount of tokens and get away with it. One solution to limit such damage is to introduce regular epochs (e.g. years) when the issuing private key is changed. Only tokens from the current and the previous epoch are redeemed for collateral or, upon request, exchanged for new tokens of the current epoch. In this case, any excess issue is caught at the end of the next epoch. The drawback is that such tokens can lo longer be stashed away in a passive storage for indefinite time.
I don't think my system requires issuers to have adequate reserves but it does require the long term trend to be believed positive. As long as that is the case, the right to be an issuer, which is transferable along with the private key — there should be a mechanism by which the new owner can change it — has positive value, so if an issuer runs out of money in a decline believed temporary he can sell the right to someone who can afford to redeem.
I think the relevant experience here would be whether, during a free banking regime, it was typical that banks experiencing a bank run to be bought out by sufficiently solvent buyers in the hope of restoring solvency and reaping continued profits from issuing money after the run is over? I do not know, but I would be surprised if that were the case.
In crypto, the experience with different kinds of stablecoins is limited, but here is what happened so far:
1. Single-collateral DAI (later renamed SAI) and LUSD (the kind of algorithmic stablecoins outlined in my comments above) have weathered all calamities thrown at them so far very well. Interestingly, during times of high volatility, they tend to trade slightly above their peg.
2. USDC, a regulated stablecoin issued in exchange for regularly audited bank deposits of USD (and redeemable for them by designated parties), lost its peg when Silicon Valley Bank in which a little over 7% of its reserves were kept failed on Friday, March 10, 2023 and recovered on Monday, when depositors were bailed out.
3. Multi-collateral DAI that "stabilized" its peg by allowing instant issuance in exchange for USDC locked in its smart contract at a 1:1 rate lost the peg together with USDC and its reserves were pumped full of USDC during that time. It took them quite some time to purge that toxic asset, requiring some governance actions on the smart contract.
4. USDT, by far the most popular stablecoin (and the first really popular one), is also (claimed to be) issued in exchange for USD bank deposits, some of which they use to buy short-term US government obligations (and have become the #1 buyers of such by now) and is redeemable for USD only in large quantities. However, unlike USDC, they do not disclose where they keep their reserves, ostensibly to prevent legal attacks on them. They are widely believed to be cheating, buying Bitcoin at the beginning of rallies (which they themselves help setting in motion; they are big enough to be able to do it) for unbacked USDT, making up for the shortfall of USD reserves later in the market cycle selling part of their BTC holdings. We do not know for sure. Unlike USDC, they have a long and spotless track record of maintaining their peg.
5. UST (a.k.a. TerraUSD), an elaborate Ponzi scam running between 2018 and its collapse in 2022. Because of the good timing of its launch at the bottom of the market cycle for cryptocurrencies and effective marketing, the demand kept it alive for four years straight. Before its collapse, it was the third largest stablecoin (after USDT and DAI) in circulation.
The last one is an important cautionary tale about financially unsound designs being able to grow large and live long enough for a large number of people to have confidence in them. Good algorithmic stablecoins start throttling issuance long before actual insolvency.
Some more clarifications. Monero isn't a zero-knowledge chain; that's the direction they want to move to. Zcash has been zero-knowledge since launch in 2016.
"Using them is illegal in most jurisdictions and centralized exchanges have been forced to delist them" is not true of Zcash. U.S. exchanges I know off the top of my head: Coinbase, Gemini, Kraken.
What does "illegal" mean in this context? If I hold Monero am I breaking the law? If I spend it?
Zooko wrote a longer reply to your post as a comment here yesterday, and apparently Substack's spamfilter got triggered: https://bsky.app/profile/zooko2.bsky.social/post/3llz6qerttc2f
Since I know him I'm sure it was polite and on-topic, from someone with firsthand experience in private money since Chaum, so I guess you'd want to hear that Substack ate it.
I have created an account on Bluesky to invite him to email me his comments so I can post them here.
Substack is a very useful institution but their programming is not very good.
Here is relevant part of what Zooko sent me:
> A second problem with Bitcoin as money is that its value is unstable. This is a minor inconvenience for using it as a currency, a much greater inconvenience for using it as a unit of value. To have a cryptocurrency that works as both one needs a cryptocurrency that has a constant value, a stablecoin.
Is it possible that the sort of automation that is loosening the network effect of medium-of-exchange could also dissolve this one, meaning that you do _not_ need a cryptocurrency that has a constant value, and stablecoins are unneeded?
I can think of at least two, complementary, ways that automation might change this:
1. Long-term contracts could become indexed by some other measures of value instead of being indexed by the value of a currency. Alice could agree to lend Bob USD $10,000 today in return for, not 5% annual interest denominated in USD, but 5% annual interest denominated in USD and adjusted for inflation. Or, in return for 5% annual interest denominated in a specific basket of goods that Alice and Bob (or their computer agents operating on their behalf) agree on.
2. Alice needs to hedge against the possibility that her future income from her loan to Bob is worth less than her future expenses, because the currency that Bob is paying her back has fallen in value compared to the expenses she'll incur at that time. But she doesn't *have* to get this protection out of her contract with Bob! (As she does in 1 above.) She can separately buy an instrument which will pay her more, when Bob's loan comes due, in proportion to how much the value of the currency has fallen. Again, her automated agent could do this on her behalf. (And of course, on the other side, Bob needs protection against the eventuality that the value of the currency that he owes Alice has gone _up_ since he took out the loan, and he can get protection against that eventuality in the same way -- by paying a third party to for it.)
When I think about it from this perspective, I think that "stablecoins" are an attempt to provide this feature to users, but in a "one size fits all" fashion -- no user can get greater or lesser protection from future changes in the value of the currency than any other user, just by using a stablecoin as medium-of-exchange (short term) and unit-of-account (long term). Maybe if improved financial tech can provide these in a more customized and efficient solution for each individual, then the need for stablecoins will evaporate. Similar to how the automated currency exchange that comes with your debit card has eliminated the need for you and your vendor to use a common currency.
Next topic:
> There have been a number of projects to create fully anonymous cryptocurrencies and I have not followed them closely enough to judge if any yet can be fully trusted.
I would commend Zcash to your attention. (I'm a founder and developer of Zcash.)
Zcash uses advanced cryptography to provide strong privacy to each user without any centralized party/server/bank. The result is that the currency is strongly censorship-resistant as well as private (and therefore fungible). Zcash, like Bitcoin, has a simple notion of scarcity built in: there will never be more than 21 million Zcash coins.
In order to create Zcash, we advanced the state of the art of cryptography, such as the Zero-Knowledge Proofs that Daniel Nagy rightly praises above.
I noticed David Trost saying in the comments that privacy-preserving cryptocurrencies are illegal, or "effectively illegal". As the founder of Zcash, I've seen arguments like that a *lot* over the years. What David Trost wrote in the comments is mostly incorrect. I'd be happy to delve into details if there is interest, but even better than argument would be experiment!
Experiment 1: Ask your favorite search engine for "Zcash Wallets". Then download a Zcash wallet from the Apple App Store or the Google Play Store. (Assuming you're on mobile. You can do the same on desktop.) Now you have the ability to send, receive, and store Zcash without depending on any third party (custodian, bank, server)! And, you have the ability to control *disclosure* of your Zcash holdings and transactions. By default, nothing about that is disclosed to anyone else. You've now completed experiment 1.
David Trost's arguments in these comments are largely about whether third-party businesses will engage in Zcash transactions with you. That's important. The most common way that people buy or sell cryptocurrency is by using "exchanges", like Coinbase or Binance. If you experiment 1 showed you that you can own and control your own Zcash, but you are unable to conveniently and safely buy any Zcash, then his claim that Zcash is semi-illegal would still be valid.
Experiment 2: Create an account at any one of the three large USA exchanges -- Coinbase, Gemini, or Kraken -- or the largest world-wide exchange -- Binance -- buy some Zcash, and withdraw it to your wallet. (Or, since the "creating an account" part is a time-consuming hassle, ask a friend who already has an account to do this for you.) You've now completed experiment 2.
Regards,
Zooko
The one issue your experiment, which I have not yet done, raises is that if I buy ZCash from an exchange, that is presumably not private. So the fact I am a Zcash user is known, what I do with the money is not. That is less true if I buy ZCash from a private individual, since who I got it from is not deducible from public information, especially if I bought it with cash, also an anonymous currency.
The point matters because if there are only a few ZCash users, the fact that you are one of them signals hypothetical spies to watch you, but not if there are a large number of ZCash users.
In any case, thanks for a very informative response.
(Speaking as a founder in the space) It's not illegal for you as a user. But it's effectively illegal due to a confluence of factors.
(1) For the 99.9% of potential users, cryptocurrency is too hard to do purely roll-your-own with open source tools. It's theoretically possible, just not at all practical. This means you need a service provider to make it easy... A company.
(2) A company providing money services to US residents is regulated by the Bank Secrecy Act, the Patriot act, etc. So we MUST know basically everything about who you are, where your money came from and who it is going to and why.
(3) This is fundamentally incompatible with a privacy focused currency like monero. So with all the features of monero effectively removed, you might as well use Bitcoin or whatever other (more popular) cryptocurrency.
What if the company is not located in the US? How does the US law affect it? Is there no suitable country where it is not illegal?
Even foreign companies serving US customers must comply. Of course enforcement depends on the US govt's ability to extradite from said country. Not every country, but most countries (all the important ones) have similar Anti money-laundering/anti-terrorism (AML/CFT) laws on the books. This is due to a concerted effort/influence by the US to expand their reach.
Separately, and arguably more importantly from a US perspective, US banks are also responsible for ensuring that the foreign banks that they work with are themselves implementing the same AML/CFT monitoring. So there's this global financial system which is really a US financial system where everyone is playing by the same set of rules. (Kindof analogous to a copy-left open source license). And those rules simply are incompatible with Monero and privacy focused money more generally. If Monero is a big privacy fence around your yard, AML is the laws that say your fence must be see-through glass.
So IF you ignore AML laws,
and IF you lie to your bank about the nature of your business, you can run a business helping customers transact privately with Monero... Until you get caught and have your bank account frozen and get extradited/go to jail of course, which shouldn't take long.
I don't know what Daniel Nagy meant by "illegal" -- I think the status in the U.S. is mostly equivalent to paper cash (my "mostly" coming mostly from income tax being denominated in dollars).
My background: I don't work in cryptocurrencies or follow closely. I've used Zcash for some ordinary cash transactions. My friend Zooko who led the Zcash project at launch recruited me for it as a software engineer (I was tempted but didn't bite).
Zooko knows Patri -- I'll bet he'd be happy to chat. He worked for Chaum too to start his career.
Another very important development in the cryptocurrency space that might help bring about commodity-basket pegged stablecoins is the invention of Automated Marketmakers (AMM) by Uniswap. This is a very big deal, the second reliable price discovery mechanism after the invention of the exchange with a public orderbook thousands of years ago. An AMM is a smart contract holding (in its simplest form) a pair of assets in some quantity that is deemed to be -- by definition -- of equal value. Two types of users can interact with the AMM:
1. Swappers, who want to exchange one asset for the other. They put the asset they want to sell into the smart contract and take the other one out. This decreases the price of what they sold and increases the price of what they bought through the invariant that the assets in the AMM have equal value. They also need to pay a small fee.
2. Liquidity providers (LPs), who have assets they don't need at the moment and want to earn by locking them up in the AMM: they must deposit both kinds of assets in the same proportion as the AMM already holds in exchange for tokens that can be used to claim part of the transaction fees paid by swappers. The tokens can also be used to withrdaw the corresponding amount of assets from the AMM. Of course, if a prospective LP only has one of the assets, they can use the AMM as a swapper in order to get the other one in needed quantities before providing liquidity.
The big advantage of AMMs against orderbooks is that they separate the roles of liquidity providers and swappers, whereas on a traditional exchange, both roles are played by participating traders, so one only has a reliable price signal when there are enough buyers and sellers. With AMMs, one can instantiate reliable price oracles even for very illiquid assets with a tiny market capitalization. This enables all sorts of tokenized assets to be traded permissionlessly, with reliable price oracles. For example, warehouse receipts for commodities. This, together with the algorithmic stablecoin described above, can become a building block of a commodity-basket pegged stablecoin that does not even require locking up large quantities of the commodity tokens, just use their market as a price oracle, locking up Ether or similar assets instead. Unlike commodity tokens, which cause a shortage of the commodity when too many are locked up, locking up Ether simply increases its price in "a tax that nobody pays" (as per your previous essay), since their only value is that they are valuable. There is no loss in having some or even most of it locked up in smart contracts as collateral.
You don't need a stablecoin, you need a semi-stablecoin, and the distinction is the emergence of a new unit of account, entirely algorithmic.
https://mirror.xyz/0x283ED9dFc3b58B71cBA427E52714338F09F55DdC/FMZI8UGYge8YBuRGX3spZtrjK-aDgkWjk-pSH-T9k8M
“Except in France.”
Bon mot.
There is a bitcoin-backed implementation of Chaumian ecash, called Cashu, that you might find interesting.
I have a simple question which might not be so simple: what is the difference between money and currency, for economists? Is it entirely a difference of physical vs numbers? I sometimes think that, but a non-fractional reserve gold-based system seems both.
Muggers don't demand your currency or your life. When we need to borrow, we don't ask our friends how much currency they have in their pockets. So to us laymen, money is pretty much everything, but we do sometimes use "currency", although maybe that's just coin collectors, or travelers looking at foreign currency for the first time.
Good question. I don't think of the balance in my checking account as currency, do think of it as money. I think I use "currency" for physical objects such as coins or bank notes but not for money more generally.
But I don't have an explicit definition of the distinction.
Are you worried about annoying your Trump supporting readers?
That was "Interesting Times" several posts back. My previous post was expected to annoy my Rothbardian readers, at least any who started reading after "Critique of a Version of Austrian Economics." This post might annoy some Bitcoin fans.
No.
I was actually wondering you haven't written a post about the tariffs?
Your criticism of Trumpian economics in general seems remarkably muted.
I've written four posts on the general subject of tariffs, as well as two on Vance that covered his views on tariffs and one recently on Trump where I wrote " I expect his tariff policy to make both the US and its trading partners poorer." His tariff policy pretty obviously makes no economic sense, but I don't see much interesting to say about it beyond that. Vance is actually the more interesting of the two, since he may have a coherent ideology and economic theory — it's hard to tell, given that he has to support Trump.
Vance doesn't have to support Trump. He chooses to.
So no response to Trump's actual recent policies?
His tariff policy obviously makes no sense, has bad consequences. I have already said that. The purpose of this Substack is not to proclaim my political views but to explain and explore ideas, and I think I have already said the things about tariffs, not limited to Trump's, that need saying.
I believe in an expanded version of Bambi's mother's rule: If you don't have anything to say, don't say anything.
Vance does not have to support Trump but he obviously wants to be Trump's successor and, unless things go badly enough to destroy Trump's control of the party, possible but not I think likely, that requires keeping Trump's support. I am disappointed by Vance's behavior but not greatly surprised.
Perhaps I have missed something. Why should this column annoy Trumpists? And given Mr. Friedman’s thorough and well-demonstrated iconoclasm, even if it does, why would you expect him to worry?
"It" in that sentence is "one important feature of a money was that it was the same one used by the people you interacted with." It is still convenient for money to have that feature.
Sorry if I was unclear.