The Road to Runes
In the week leading up to the latest Bitcoin halving, Runes, a new fungible token standard on Bitcoin, was one of the biggest talking points in crypto. While I was trying to understand what Runes are and why they matter, I realised how little I knew about what came before it or how Bitcoin even worked at a fundamental level. Yes, I know this is a surprising admission to make, given that I work in crypto and Bitcoin is the biggest cryptocurrency.
Yet, I figured, if I am in this boat, surely many others are too. So, I decided to dig deep and write about it.
I went back in time and tried to trace Bitcoin’s journey from its inception to how it got to Runes. Along the way, I came across an early on-chain implementation of DNS, Vitalik Buterin’s first token project (no, it wasn’t Ethereum), permanent ASCII art, a blockchain game from 2015, a divide in the community that forced some to call Bitcoin ‘a failed experiment,’ a maverick developer who changed the face of a trillion-dollar asset, and so much more.
This is a story about Bitcoin’s past and its future. It’s about failed experiments and false starts. It’s about the struggle to bring innovation to a protocol that constantly resists change. It’s about why one-hundred-millionth of a Bitcoin can sell for over a million dollars. Most importantly, it’s about how social consensus can be as crucial as code, even for a digital asset.
Let’s dive in!
UTXOs
We’ll start by understanding one of the fundamental building blocks of the Bitcoin protocol: Unspent Transaction Outputs or UTXOs.
UTXOs are how the Bitcoin protocol keeps track of the ownership of coins. Think of each UTXO as a receipt of ownership—an indivisible chunk of Bitcoin that can only be spent by a specific address (the owner). When the ownership of a Bitcoin changes hands (one user sends it to another), it is recorded on the blockchain as a UTXO associated with the receiver’s address.
In the Bitcoin protocol, there is no inherent concept of an account balance. Instead, the coins owned by an address are captured in UTXOs that are scattered across the blockchain, each created as an output of a transaction. When an application (like a wallet) shows a user their BTC balance, it does so by scanning the blockchain and aggregating the UTXOs belonging to that user.
If my Bitcoin wallet says I own 20 BTC, it means that there are 20 BTC worth of UTXOs associated with my public key. This can be one UTXO of 20 BTC, four of 5 BTC each, or any other combination that adds up to 20 BTC.
Transactions on Bitcoin are structured as a set of input UTXOs, which are consumed (or destroyed) to create output UTXOs. Imagine Joel has UTXOs with the following values associated with his address:
- 10 BTC
- 5 BTC
- 1 BTC
Now, if he wants to pay Saurabh 14BTC, his wallet application would create a transaction with:
- 10 BTC and 5 BTC UTXOS as inputs (the 1 BTC UTXO remains untouched)
- 14 BTC as one output to Saurabh’s address
- 0.9998 BTC as the second output back to his address
The second UTXO is the change he receives from the transaction. Why 0.9998 and not 1 BTC? He also needs to pay the Bitcoin miner a fee as an incentive for including his transaction in a block. The difference between the sum of input and output UTXOs (0.0002 BTC in this case) constitutes the fee offered for a transaction. In most cases, the heavy lifting of creating a valid transaction by setting appropriate inputs, outputs, and fees is abstracted from the user and handled in the background by the wallet application1.
To understand UTXOs better, think of them as currency notes and Bitcoin wallets as physical wallets. Each currency note (like a UTXO) is worth a fixed, indivisible amount, and the total value stored in a physical wallet (like in the case of a Bitcoin wallet) is the sum of the value of all currency notes inside it.
Subscribe
Bitcoin transactions are similar to purchasing items with cash. If I want to purchase a $14 cocktail at a bar in New York City, I can hand over a $10 and a $5 bill and will receive a $1 bill in return. Where this analogy breaks is that while currency notes exist only in set denominations ($1, $5, $10, etc.), UTXOs can be associated with any arbitrary amount of Bitcoin.
(In contrast, other blockchains like Ethereum operate as a ledger of debits and credits and track user balances in-protocol. This is similar to how bank accounts keep track of user balances.)
The design of choice of Bitcoin using UTXOs over other blockchain accounting models is what sets the stage for future token protocols built on top of it.
OP_Return
Satoshi Nakamoto originally created Bitcoin as a form of censorship-resistant peer-to-peer electronic cash system. However, in doing so, he also happened to create the world’s first immutable, non-counterfeitable, transparent, and timestamped ledger.
Soon after its release, early cryptocurrency enthusiasts started realising that such a ledger was useful for applications beyond just payments. This technology could be extended to secure any piece of digital data that was important enough to store on a resilient, distributed ledger. Applications discussed included stock certificates, digital collectibles, property ownership records, and bringing the domain name system (DNS) to Bitcoin2.
Hal Finney, the legendary computer scientist, famous Bitcoin contributor, and receiver of the first BTC sent by Satoshi, proposed a solution to bringing DNS on chain in the BitcoinTalk Forum.
The question of whether one should use Bitcoin to store non-payment data triggered one of the first major debates in the Bitcoin community. One camp viewed Bitcoin exclusively as a payment system and considered storing other data (or “junk”) as abusive to its core purpose. The other camp saw it as a demonstration of Bitcoin’s power and believed that building new applications was crucial to the blockchain’s long-term relevance and diminishing security subsidy.
The debate also had short-term practical implications.
In the absence of the Bitcoin protocol providing a dedicated method to store non-payment data, early experimenters found a workaround. Recall from our previous discussion that a Bitcoin transaction consists of a series of input and output UTXOs. Each output UTXO has fields for the amount and destination Bitcoin address. Developers made use of this 20-byte destination address field to store arbitrary non-payment data.
What kind of arbitrary data? As this blog post documents, a wide range of both the mundane and the creative. From a tribute to Nelson Mandela to an ASCII portrait of then Federal Reserve Chairman Ben Bernanke, and from a link to the WikiLeaks Cablegate files to a PDF of the original Bitcoin whitepaper, enthusiasts preserved any text they deemed worthy of permanent digital existence on the ledger.
However, this approach had a major unintended consequence. Ordinarily, the data in the destination address field is a public key (or the destination address) that the protocol maps to a private key that can control the resulting UTXO. When developers started using this address field to store arbitrary data, these transactions created UTXOs that could not map to a private key, and, as a result, could never be spent. Such transactions are labelled as “fake payments.”
For example, this transaction, which contains the PDF of the original Bitcoin whitepaper, stores the data across almost 950 output UTXOs, none of which are spendable.
The problem with storing data in UTXO outputs.
Fake payments are problematic for anyone running a full Bitcoin node. Full nodes maintain a copy of all valid UTXOs (known as the complete UTXO set) in the blockchain’s history, which they then use while validating new transactions. Ideally, the UTXO set should be small so that transactions can be validated quickly. However, since the UTXOs created in fake payments can never be spent, they result in “UTXO bloat,” or an increase in the size of the UTXO set. Consequently, nodes must permanently bear the costs of storing data that the blockchain was not designed to carry.
Even though the payment purists disagreed with the use of Bitcoin to store non-payment data, there was no way for them to prevent users from adding arbitrary data to a UTXO output. As a compromise, they reluctantly allowed the OP_RETURN script function, previously disallowed, to be included in Bitcoin transactions in 2014.
Their stance (as I interpret the release notes of Bitcoin version 0.9.0) essentially was— ‘Look, we don’t like you storing random data on Bitcoin. That is not what it is for. But there is no way we can stop you from using outputs to do so. So let us reduce the damage you’re causing. We’ll give you a separate limited space for you to continue with your shenanigans, but at the same time, we would strongly suggest you do not use Bitcoin for this. That is not what it is meant for.’
OP_RETURN accepts a user-defined sequence of 40 bytes of data. Although this data is stored on the blockchain, these outputs are provably unspendable and can be excluded from the UTXO set. This means full nodes can ignore outputs marked OP_RETURN while validating payments, partially solving the problem of UTXO bloat. I call the problem only partially solved because these transactions continue to exist on the blockchain and consume disk space.
40 bytes is not a lot of data. One English character typically takes up one byte of data, meaning OP_RETURN could only hold strings of up to 40 characters—certainly not sufficient to store images or complete documents. Thus, the primary use case for OP_RETURN was the storage of the hashed values of bigger pieces of data.
Any piece of digital data, when passed through a hashing algorithm, maps to a unique alphanumeric string called a hash value. These hash values could then be stored in the OP_RETURN field to timestamp pieces of externally stored data on the Bitcoin blockchain. For example, I could create a piece of art and store the hash value of the image file on the blockchain. Anyone could then, in the future, use the transaction to verify the provenance of the image.
Services like Proof of Existence allow users to upload documents, generate hash values, and store them on Bitcoin for a fee (currently 0.00025 BTC or ~$18)3.
A hockey stick chart if there ever was one. (source)
The chart above illustrates the number of transactions containing OP_RETURN outputs over time. Notice the parabolic increase in such transactions in the recent past? We will discuss the reasons for it soon.
The OP_RETURN data limit was increased to 80 bytes in 2015.
Early Token Experiments
As Bitcoin was maturing, developers started dreaming of building other applications that benefitted from blockchain technology. One common application was the creation of alternate currencies or tokens with custom properties and utilities. One way to do this was to spin up a blockchain from the ground up, a path taken by early altcoins like Namecoin and Dogecoin. However, this approach required bootstrapping a miner base and bore the risk of the token being centralised, at least initially.
A more attractive proposition for some was to somehow create a token on the Bitcoin protocol itself, benefitting from its security and existing distribution.
Today, Vitalik Buterin is famous for being the cofounder of Ethereum, the second-largest cryptocurrency after Bitcoin. However, before he created Ethereum, Vitalik was very much an active part of the Bitcoin community. He started his crypto career writing for the publication Bitcoin Weekly. After that shut down, Vitalik co-founded Bitcoin Magazine, which many consider the first serious publication in the industry.
Cover of the October 2013 edition of the Bitcoin Magazine. You can purchase original physical prints of these using BTC in the Bitcoin Magazine Store. This one currently sells for $1000!
In 2013, Vitalik, along with four other authors, released the whitepaper for Colored Coins, a way to store “alternative currencies, commodity certificates, smart property, and other financial instruments” on the Bitcoin blockchain. This was done by marking, or “coloring”, Bitcoins with information that specifies their intended use.
What does it mean to mark a Bitcoin? Recall that BTC is stored on the blockchain as UTXOs, which are created and destroyed when BTC is transferred from one wallet to another. This mechanism enables the tracing of the origin and ownership history of a Bitcoin as it moves between wallets.
Let’s say I receive a 5 BTC UTXO from Saurabh. I then transfer 7 BTC to Sid, created from one 5 BTC UTXO (the one I received from Saurabh) and another 2 BTC UTXO (one I already had in my wallet). Now, Sid transfers 10 BTC to Joel, made up of the two UTXOs – the one he received from me and another he had from before. Joel’s BTC can now be traced back to Saurabh, Sid, and me by following the trail of transactions that led to the UTXOs in his wallet.
Subscribe
Let’s revisit our analogy of Bitcoin UTXOs and currency bills. Each currency bill has a unique serial number that is preserved as it moves from one holder to another. The difference is that while I may not have a complete history of the holders of a currency bill before me (since there is no place this is recorded), all Bitcoin transactions happen on a public ledger where each satoshi (sat), the smallest unit of Bitcoin (1 BTC = 100 million sats), can be traced right back to its original owner. Had there been a way to record the movement of currency notes on the basis of their serial numbers, we would be able to trace them back to the printing press, just as we can trace every BTC to the block at which it was created.
Because BTC can be traced across transactions, so will the metadata associated with a particular UTXO. This is the basis of the process of marking or “coloring” BTC. The Colored Coins protocol uses a combination of input, output, and OP_RETURN to create and transfer tokens from one address to another.
The structure of a Colored Coins transaction.
This is an example of a Colored Coin transfer transaction. The data in OP_RETURN defines the properties of the Colored Coin, while the input and output values (along with a few additional fields not shown in this diagram) define the movement of the coin across different wallets.
There are two key points to note about this implementation of external tokens on the Bitcoin blockchain.
First, the values in the input and output fields represent actual Bitcoin moving from one wallet to another, with Colored Coins tagged to these sats. This means that if I want to send x Colored Coins, I’ll have to send x sats as well. The true value transferred is the value of the Colored Coins plus the value of the sats. This is an obvious drawback of the protocol.
If you’re creating a new currency, you almost certainly want it to be valued independently and not combined with another currency. For example, the value of a fiat currency bill should be what is mentioned on it, unrelated to the value of the paper it is printed on. This, I believe, is one of the reasons Colored Coins never caught on as a way to issue new tokens. For non-monetary use cases, like issuing shares of ownership, Colored Coins still made sense.
Second, Bitcoin doesn’t recognize Colored Coins and their metadata as a part of the protocol. We saw earlier how nodes can choose to ignore the information in the OP_RETURN field, which is crucial for interpreting the movement of Colored Coins. This means that to participate in the creation and trading of Colored Coins, users have to use specialised wallets that recognize the rules of the protocol.
If users use an ordinary wallet (designed for sending and receiving BTC) to interact with UTXOs that were previously involved in Colored Coin transactions, they risk losing or corrupting the metadata associated with their UTXOs. This incompatibility between wallets remains a thorn in the side of even future implementations of token standards on Bitcoin, as we will see shortly.
Another early project that allowed users to create digital tokens on top of Bitcoin was Counterparty. Counterparty also uses OP_RETURN to store token-related metadata, but unlike Colored Coins, Counterparty tokens are not tied to the BTC balance of an address. This detachment allows these tokens to have independent trading and price discovery.
Independent token prices enabled Counterparty to create one of the first decentralised exchanges on top of the Bitcoin protocol. Users could submit their orders via messages (e.g., “I want to purchase 10 tokens of A for 20 tokens of B”), and the protocol would hold their funds in a trustless escrow till an order ̇was either fulfilled or expired.
Counterparty’s native token, XCP, was initially created and distributed via a fair launch called “Proof-of-Burn” where users had to burn BTC to mint the token. XCP acts as a utility token that allows developers to pay for creating named Counterparty coins. Counterparty also provides developers with simple APIs to create tokens, transfer assets, issue dividends, and more.
Notable projects that were created using Counterparty include Spells of Genesis, the first NFT blockchain-based mobile game (yes, blockchain gaming was a thing as far back as 2015!), and Rare Pepes, an NFT collection that holds its value even today (the floor price of the 298 supply collection is almost ~$1 million as of early June 2024).
Segwit
Even though OP_RETURN, Colored Party, and Counterparty enabled the storage of tokens on Bitcoin, their growth was hindered by a fundamental limitation of the protocol: the 1MB block size limit.
1MB is not a lot of data. A typical Bitcoin transaction was around 300 bytes, meaning a single 1MB block could hold approximately 3000 transactions. Since Bitcoin blocks are produced every 10 minutes, the network’s transaction per second (TPS) value hovered around 5. This throughput was woefully inadequate for a payments network. For perspective, Visa processes 1,700 TPS and has a peak capacity of over 24,000 TPS.
The discussion about increasing Bitcoin’s block size, much like the previous debate over payment and non-payment data, also divided the community into two camps.
One camp, the so-called big blockers, campaigned for a hard fork (a protocol change that would require all nodes and users to upgrade their software) to permanently increase the block size to 2MB, followed by subsequent periodic hard forks to continue expanding the block size. This group believed that for Bitcoin to be a viable payment system for millions of users, it needed higher TPS and low fees. The only viable way to achieve this was to continually increase the block size as demand grew.
Subscribe
The small blockers, on the other hand, advocated against hard forks and other such drastic changes to the protocol. To them, part of Bitcoin’s value lay in its stability. They argued that increasing the block size would make it difficult for users to run full nodes, thus decreasing Bitcoin’s decentralisation and overall allure as a robust, revolutionary currency4.
The block wars became one of the main talking points of the time. This headline is from the Wall Street Journal.
The big blockers ended up creating Bitcoin Cash, a fork of the Bitcoin blockchain with an 8MB block size limit. The small blockers, on the other hand, enabled an upgrade called Segregated Witness, or Segwit, to increase the block size without enforcing a hard fork.
Apart from a series of inputs and outputs, a Bitcoin transaction also contains one other structure that we haven’t discussed yet—witness data. Witness data, which includes cryptographic signatures and other validation information, constitutes up to 65% of the transaction size.
The SegWit upgrade changed the structure of a block. Instead of having all data (inputs, outputs, signatures) reside in a single 1MB block, the upgrade divided the block into two sections: a base transaction block, containing all inputs and outputs, and an extended block, storing the witness data.
Along with this change, SegWit also shifted the metric used to calculate the capacity of a block from data size to weight units. The weight of a block is calculated using the formula:
Weight = Base Size × 4 + Witness Size
For example, a transaction with a base size of 100 bytes and witness data size of 200 bytes would occupy 600 weight units [(100 × 4) + 200]. The new limit on block capacity increased from 1MB to 4 million weight units, effectively quadrupling the block capacity without requiring a hard fork.
Importantly, the base block remained around 1MB, preserving the initial block size limit. This allowed the protocol to accept both legacy and SegWit blocks simultaneously, ensuring that miners and nodes were not forced to upgrade their software immediately to accommodate the change.
Segwit wasn’t adopted by miners overnight; it took almost 5 years for 90% of Bitcoin blocks to be Segwit ones. On the surface, this gradual adoption seems to justify the decision to implement a soft fork. However, we can only speculate on how the counterfactual, a hard fork, would have played out and impacted miners’ behaviour.
Regardless, Segwit gave Bitcoin a much-needed boost in TPS and was a crucial milestone in scaling the network and supporting use cases beyond just BTC payments.
What’s on Tap?
The 2021 Taproot Upgrade was the most significant upgrade to the Bitcoin protocol since Segwit. However, unlike the contentious block size wars, the changes proposed by Taproot were accepted almost unanimously by the Bitcoin community.
The Taproot upgrade was a combination of three Bitcoin Improvements Proposals (BIPs) implementing several changes that made Bitcoin safer and more efficient. While these changes covered multiple facets of the protocol, we will focus on those that laid the groundwork for future token protocols on the chain.
The first major change brought about by the Taproot upgrade was the replacement of the Elliptical Curve Digital Signature Algorithm (ECDSA) signatures with Schnorr signatures. Blockchains rely on digital signatures—messages cryptographically signed by a user’s private key and verified with their public key—to operate. Digital signatures come in various forms, each following different cryptographic schemes, with some being more efficient than others. The shift to Schnorr signatures provided two key boosts for scalability.
First, recall that the witness data, which includes the signature, occupies a significant portion of transaction space. Schnorr signatures are smaller compared to ECDSA ones, leading directly to space savings and allowing for more transactions to fit into a single block.
Second, Bitcoin supports complex payment types like multisig transactions, where multiple parties must approve a transaction based on specific conditions for it to be executed. Before Taproot, a multisig transaction required each individual signature to be included in the transaction inputs. With Schnorr signatures, multiple signatures can be combined into a single signature (and, thus, single input), making multisig transactions significantly more efficient and private.
The Taproot upgrade also expanded Bitcoin’s scripting capabilities, allowing developers to create more complex transaction conditions. The upgrade also provided a new way to store arbitrary data on the Bitcoin blockchain, offering greater flexibility than the OP_RETURN opcode discussed earlier.
In practice, this meant that the amount of arbitrary data developers could store in a Bitcoin transaction was now only limited by the maximum allowed size of a transaction, which was 400,000 bytes. This was five thousand times the amount of data that OP_RETURN allowed them to store.
By making transactions more efficient and allowing for additional flexibility in their content, the Taproot upgrade paved the way for the most explosive experiment yet in bringing tokens to Bitcoin.
Ordinal Theory
Kanwaljeet, my best friend’s father, is a numismatist—a collector of currencies. His collection is notable not just for its historical and limited-edition items but also for a unique category of currency bills he collects solely for their serial numbers. For instance, he owns a 500 INR bill with the serial number “001947,” corresponding to the year India gained independence. Purchased for 750 INR, it is now worth 1000 INR due to its serial number.
Money holds a special place in society, serving as a medium of exchange and a symbol of status, freedom, and power. Its significance is evident in the way we work for it, the conflicts it incites, and the reverence some cultures have for it. This also explains why money is a popular collectible and highlights the work of numismatists.
Subscribe
Bitcoin is the first instance of a new form of money: cryptocurrency. Now more than fifteen years old and a trillion-dollar asset class, Bitcoin has grown popular enough for enthusiasts to assign it provenance and historical value. But how does one even do this for a digital currency?
Enter Casey Radamor and his Ordinals theory.
When a central bank issues currency notes, each one is assigned a serial number in the order of its printing. Similarly, the Ordinals theory is a convention, a numbering system, to assign a serial number to every satoshi (sat) that has ever existed or will exist when mined in the future. Let’s look at how this works.
Recall that each satoshi can be traced back to its origin through the UTXO model. Satoshis are created as rewards for miners who mine Bitcoin blocks and are numbered in the order they were mined.
For example, the first block mined, known as the Genesis Block, rewarded the miner with 50 BTC. Since each Bitcoin comprises 100 million sats, the first block reward contained sats numbered 0 to 4,999,999,999. The second contained sats numbered 5,000,000,000 to 9,999,999,999, and this pattern continues. Consequently, the last satoshi will be numbered 2,099,999,999,999,999.
The Ordinals theory uses a first-in-first-out (FIFO) system to track the numbering of sats as they move between UTXOs. When a Bitcoin transaction consumes a UTXO, the sats are split among the newly created UTXOs in the order in which they appear in the output.
For example, if the miner of the Genesis Block received a UTXO containing sats numbered 0 to 4,999,999,999, and they want to isolate a particular sat—say sat number 21 million—they would structure the transaction as follows:
The Ordinals theory, by assigning each satoshi a unique number, makes them somewhat non-fungible. I say somewhat because, in the context of making a Bitcoin payment, the merchant will not care about which sats constitute that payment, making them fungible in that scenario. However, for someone who is on the lookout for a specific numbered sat, like Kanwaljeet does with currency notes, sats become very much non-fungible5.
Once the Ordinals theory gained popularity, the emergence of BTC numismatists—rare Bitcoin hunters—became inevitable (Wired published an excellent article documenting their world). What are rare Bitcoins? It’s a spectrum. Casey Radamor provides a framework for assessing rarity:
In reality, however, rarity is highly subjective and depends on numbers the collective believes hold value. Kanwaljit collects notes with serial number 150847 because it represents the date India achieved independence. For a currency collector from another country, this number might be completely irrelevant. Similarly, Bitcoin hunters value sats for all sorts of reasons—from obvious ones like a sat being mined by Satoshi to more enigmatical ones like a sat number forming a palindrome.
Rare sats are not only traded on marketplaces like Magic Eden and Magisat, both of which provide users with icons and guides to help them accurately assess the value of the sats they’re purchasing but also on more traditional auction houses like Sotheby’s, where a rare sat is sold for over $150,000.
Recently, viaBTC, a Bitcoin mining pool, auctioned off an epic sat (the first sat of the recent halving) for 33.3 BTC, which is over $2 million. This amount compares to the most expensive fiat currency note sale ever: a rare 1,000 US dollar treasury note issued in 1890 that sold for over $3 million in an auction in 2014.
Remarkably, this note, dubbed the “The Grand Watermelon” due to the shape and colour of the zeros on the reverse, is still valid tender!
Apart from spawning a class of digital numismatists, the Ordinal’s theory, by introducing a convention to number sats, also unlocked the next step in Casey Radamor’s plan: bringing “digital artefacts” to Bitcoin.
Inscriptions
The 2021 release of the Taproot upgrade coincided with a major wave in the crypto industry—that of NFTs. More than $25 billion worth of NFTs were traded in 2021, a majority on Ethereum. Pixel art, monkey pictures, sporting moments, photographs, music, sneakers, coffee vouchers, and even plain English words — there was an NFT for seemingly everything. The movement signalled the biggest intersection of crypto with mainstream media and brands yet, and onboarded more new people to crypto than any other use case till then.
Now, the debate over whether NFTs, or even digital art as a category, should be inherently valuable is something that has been written about and discussed enough, so we won’t get into it. What matters is that at least a subsection of the Bitcoin community, including Casey, looked at what was happening on other chains, particularly Ethereum, and decided that it was something they wanted to bring to Bitcoin as well.
If Bitcoin were to have a standard for NFTs, Casey wanted it to be “unplagued” from the flaws of its predecessors. His solution: Inscriptions. From Casey’s blog post on Inscriptions:
Inscriptions are digital artifacts, and digital artifacts are NFTs, but not all NFTs are digital artifacts. Digital artifacts are NFTs held to a higher standard, closer to their ideal. For an NFT to be a digital artifact, it must be decentralized, immutable, on-chain, and unrestricted. The vast majority of NFTs are not digital artifacts. Their content is stored off-chain and can be lost, they are on centralized chains, and they have back-door admin keys. What’s worse, because they are smart contracts, they must be audited on a case-by-case basis to determine their properties.
Inscriptions are unplagued by such flaws. Inscriptions are immutable and on-chain, on the oldest, most decentralised, most secure blockchain in the world. They are not smart contracts, and do not need to be examined individually to determine their properties. They are true digital artefacts.
Here’s how they work.
Inscriptions inscribe data onto individual sats, which are then tracked by the Ordinals theory. To mark a particular sat with some data, developers have to create a transaction that isolates that sat and places it in the first output of a Bitcoin transaction. The data itself resides in the transaction witness (the upgrade introduced by SegWit) and is stored in the script-path append scripts introduced by the Taproot upgrade.
Since an inscription is etched on a sat, it can be moved, traded, bought, or sold by transferring the inscribed sats in simple Bitcoin transactions. However, like previous token standards, they required a wallet that recognised the protocol and structured transactions accordingly. In other words, you do not want your wallet to accidentally send an inscribed sat as part of a normal transaction.
Each inscription is also given an index number in order of its creation. Thus, we know that over 70 million inscriptions have been created so far. Additionally, while you can create collections of inscriptions (like you can do with NFTs on Ethereum), each inscription in a collection requires a separate transaction to create (and in turn, fees to be paid). These properties do away with what Casey saw as weaknesses of NFTs on smart contract blockchains like Ethereum.
What content can you store in inscriptions? Most content formats supported on the web, including PNG, JPEG, GIF, MPEG, and PDF files. It also supports HTML and SVG files that can be executed in sandbox environments (they cannot interact with outside code). Further, inscriptions can be linked to each other and, thus, remix content from other inscriptions. While most users chose to inscribe sats with simple JPEGs, some enterprising ones have experimented with inscriptions like full video games.
Some developers realised that this flexibility of content can be used to create further token standards for Bitcoin.
The most notable of these experiments was the BRC-20 protocol created by domodata. While inscriptions were conceived as a way to bring non-fungible tokens to Bitcoin, the BRC-20 standard (a quip on Ethereum’s ERC-20 token standard) used them to create a fungible token standard for Bitcoin.
The mechanism itself is remarkably simple: fungible tokens are deployed, minted, and transferred using JSON data blobs inscribed on sats. For example, this is what the inscription that deployed ORDI, the first BRC-20 token, looked like:
This inscription defined the parameters for the ORDI token, specifying it as a BRC-20 token, deploying it with a maximum supply of 21 million units, and limiting each minting transaction to 1,000 units. By inscribing such JSON data onto sats, developers could create, manage, and transfer fungible tokens directly on the Bitcoin blockchain.
Similarly, BRC-20 tokens can be transferred by creating a new inscription with data like:
Inscriptions, along with the rudimentary BRC-20 protocol built on top of them, drove a massive wave of attention, capital, and activity to the Bitcoin blockchain. Multiple meaningful on-chain metrics skyrocketed, including miner fees, the percentage of full blocks (defined as blocks where transactions completely fill the 4MB limit), the size of the mempool, Taproot upgrade adoption, and the pending transaction count in the mempool.
Number of inscriptions over time (source)
This surge in activity meant that inscriptions could be considered the first meaningfully adopted token standard on Bitcoin. Top ordinals (another term for inscription collections) continue to hold strong floor prices months after launch. These include NodeMonkes (0.244 BTC), Bitcoin Puppets (0.169 BTC), and Quantum Cats (0.306 BTC). ORDI, the first BRC-20 token, has a market capitalization of over a billion dollars and is listed on top exchanges like Binance.
Why did inscriptions succeed where Colored Coins, Counterparty, and other experiments failed? I think there are two reasons for this.
First, launching after the Segwit and Taproot upgrades meant that inscriptions benefitted from a more mature Bitcoin protocol. Higher block sizes, lower fees, and greater data flexibility allowed inscriptions to avoid the complex, roundabout implementation routes of their predecessors.
Second, the timing was right. The creation of inscriptions was preceded by the 2021 cycle, where almost anyone even remotely tuned into internet trends had heard of NFTs. Crypto traders were comfortable trading them. Even ORDI, launched in the depths of the bear market, benefited from fortunate timing. Only weeks before its launch, PEPE, a memecoin on Ethereum, induced a short-lived memecoin-mania in an otherwise dry market, which it could capitalised on.
Runes
Finally, all of that context brings us to our destination: Runes.
Alongside BRC-20, a bunch of other protocols also attempted to use inscriptions to bring fungible tokens to Bitcoin. This created a fragmented token landscape, with each implementation carrying its own pros and cons. The opportunity to create a superior fungible standard, like Ordinals did for non-fungible tokens, was there for the taking.
And taken it was! Casey Radamor6 stepped in once again, this time with the Rune Protocol, or simply Runes, intending for it to be the de facto fungible standard for Bitcoin tokens. His motivation was simple: “A decent token standard should exist on Bitcoin.”
So, how are Runes different from other standards like BRC-20? A few weeks ago, my colleague Saurabh wrote an excellent piece explaining Runes and its improvements over predecessors in detail. For a full deep dive, I suggest reading his article.
Here is the gist.
Recall that BRC-20 tokens created a new inscription every time you had to deploy, mint, or transfer a token. Further, each token is stored in a separate UTXO. The protocol doesn’t specify a way to include multiple tokens in a single UTXO. This leads to a proliferation of UTXOs, or, in other words, UTXO bloat.
Number of UTXOs over time (source)
Runes simplifies this process. First, instead of inscriptions, it stores data in the OP_RETURN field. Second, it allowed users to hold multiple tokens, including BTC, in the same UTXO. This makes transfers more efficient and reduces UTXO bloat. Third, it is compatible with the Lightning network, Bitcoin’s scaling solution. (Remember the spike in OP_RETURN transactions we saw earlier? You now know what caused it.)
The Runes launch, scheduled to coincide with the latest Bitcoin halving, was accompanied by much hype. Ordinals had already proven to be successful (though it took a while to take off), and that was in a bear market. Runes launched with the BTC price more than thrice higher since.
Given the hype, many (including me!) considered its aftermath and impact to be underwhelming, at least if you go by the sentiment on Crypto Twitter (CT). It’s not uncommon to hear people opine that “runes failed” or “runes are dead.”
However, the numbers on-chain paint a very different picture.
Source: @cryptokoryos on Dune
Source: @cryptokoryos on Dune
Runes is dominating non-payment Bitcoin activity. On most days since launch, it has had more transactions than ordinals and BRC-20 combined, and seems to have replaced the latter as the most popular fungible token standard on Bitcoin. This is also reflected in the market cap of Runes, which has already eclipsed that of BRC-20. This is despite it not being listed on any major centralised exchange.
We’re still very early in the journey of Runes. Without a CEX listing, Runes (and other fungible tokens) still trade on a slow, order-book-like system. Trading is slow because Bitcoin’s 10 minute block times prevent high-frequency trading. Given the lack of decentralised exchanges on Bitcoin, you also cannot yet trade one Rune directly for another (you have to settle in BTC first). Moreover, the UX remains complex. Runes, like previous token standards, require special wallets to trade and hold.
These challenges are preventing it from being more widely adopted.
Subscribe
Some parting thoughts
One of the reasons Bitcoin is valuable is that it is the first purely digital currency, uninfluenced by centralised actors or power brokers, and backed fully by code. Yet, it is astounding how much of the innovation around token standards building on top of Bitcoin relies on social consensus.
Runes or ordinals, for example, are not part of the Bitcoin protocol. They are, as Casey likes to term it, “an opt-in lens with which to view Bitcoin.” You can think of them as a convention that has been “memed into existence.” Yet, they are worth billions of dollars in value because a sufficient number of people have socially coordinated to accept them as the conventions that define them.
Yes, Runes was a much improved fungible token standard compared to its predecessors. Yet, a significant part of its wide adoption is due to the backing of Casey Radamor and the social capital he has built over the years. This is also why people readily accept unorthodox rules like the initial 13-characters limits on Rune names.
We also hold the opinion that Bitcoin NFTs have found product market fit. Because NFTs are relatively illiquid and trade with less frequency, Bitcoin’s 10-minute block times are not a hindrance to their existence. Moreover, given that Bitcoin blockspace is the most valuable blockspace in the industry, and inscriptions reside completely on chain, the allure of owning a digital artefact on this new medium will continue to exist.
I looked at the top 10 NFTs and tokens on both Ethereum and Bitcoin. Find the full analysis here.
Fungible tokens, on the other hand, are very much restrained by Bitcoin’s slow block times and the lack of automated market makers. Despite that, they have already surpassed ordinals in market cap. The top 10 ERC20 tokens on Ethereum are 64x greater in market cap than the top 10 NFT collections. For Bitcoin, this ratio still stands at only 7.7x. Once we have the means to make their trading more efficient, the potential upside could be substantial.7 What might those means look like? Maybe Bitcoin L2 solutions provide the answer.
But that is a story for another day.
Excited for Sunday’s Euro final,
This is an excellent resource to understand how Bitcoin transactions work in more detail.
The original Bitcoin DNS system proposal. After Satoshi himself rejected this use case, the developers forked Bitcoin to create their own blockchain, Namecoin, which became one of the first alt-coins.
A demo of Proof of Existence with an explanation of OP_RETURN.
The block wars, as this debate came to be known, raged fiercely over two years from 2015 to 2017. It was not just a battle over small blocks versus big blocks, but also over how Bitcoin should be governed and the more fundamental question of whether Bitcoin was a payment system or a form of digital gold. Vitalik’s recent post draws upon two books authored by members from each camp—The Blocksize Wars by Jonathan Bier and Hijacking Bitcoin by Roger Ver—and provides a high-level overview of their arguments. What is relevant to us is the outcome of this conflict.
A variant of the ordinal theory was first proposed in the BitcoinTalk forum way back in 2012.
Casey Rodarmor hosts an underrated but incredibly fun podcast called @hellmoney">Hell Money.
My colleague Saurabh slightly disagrees with this analysis. He believes that unlike Ethereum, productive (non-meme) tokens on Bitcoin will launch directly on L2s, and not on the L1. This is because Ethereum allows holders to trade, lend, and do other things with the token on the base layer, whereas Bitcoin does not because the former chain is built for it and the latter isn’t. What’s the point of launching tokens on Bitcoin if they cannot be used for their intended purpose? If they sit on Bitcoin, they do so only in the hope of some liquidity helping them catch a bid, no different from memecoins on Bitcoin. He believes we tolerate the Bitcoin blockchain because we want to use BTC, the asset. It is unlikely that other assets achieve the same status. I hold the opinion that irrespective of whether you can do anything with a token on Bitcoin L1 or not, teams would still want it to be their token’s home because of the provenance and interoperability between chains it enables.
Disclaimer：
- This article is reprinted from [Decentralised.co]. All copyrights belong to the original author [SHLOK KHEMANI]. If there are objections to this reprint, please contact the Gate Learn team, and they will handle it promptly.
- Liability Disclaimer: The views and opinions expressed in this article are solely those of the author and do not constitute any investment advice.
- Translations of the article into other languages are done by the Gate Learn team. Unless mentioned, copying, distributing, or plagiarizing the translated articles is prohibited.
Related articles
BTC and Projects in The BRC-20 Ecosystem
What Is a Cold Wallet？
What is the Altcoin Season Index?
The Road to Runes
UTXOs
OP_Return
Early Token Experiments
Segwit
What’s on Tap?
Ordinal Theory
Inscriptions
Runes
Some parting thoughts
In the week leading up to the latest Bitcoin halving, Runes, a new fungible token standard on Bitcoin, was one of the biggest talking points in crypto. While I was trying to understand what Runes are and why they matter, I realised how little I knew about what came before it or how Bitcoin even worked at a fundamental level. Yes, I know this is a surprising admission to make, given that I work in crypto and Bitcoin is the biggest cryptocurrency.
Yet, I figured, if I am in this boat, surely many others are too. So, I decided to dig deep and write about it.
I went back in time and tried to trace Bitcoin’s journey from its inception to how it got to Runes. Along the way, I came across an early on-chain implementation of DNS, Vitalik Buterin’s first token project (no, it wasn’t Ethereum), permanent ASCII art, a blockchain game from 2015, a divide in the community that forced some to call Bitcoin ‘a failed experiment,’ a maverick developer who changed the face of a trillion-dollar asset, and so much more.
This is a story about Bitcoin’s past and its future. It’s about failed experiments and false starts. It’s about the struggle to bring innovation to a protocol that constantly resists change. It’s about why one-hundred-millionth of a Bitcoin can sell for over a million dollars. Most importantly, it’s about how social consensus can be as crucial as code, even for a digital asset.
Let’s dive in!
UTXOs
We’ll start by understanding one of the fundamental building blocks of the Bitcoin protocol: Unspent Transaction Outputs or UTXOs.
UTXOs are how the Bitcoin protocol keeps track of the ownership of coins. Think of each UTXO as a receipt of ownership—an indivisible chunk of Bitcoin that can only be spent by a specific address (the owner). When the ownership of a Bitcoin changes hands (one user sends it to another), it is recorded on the blockchain as a UTXO associated with the receiver’s address.
In the Bitcoin protocol, there is no inherent concept of an account balance. Instead, the coins owned by an address are captured in UTXOs that are scattered across the blockchain, each created as an output of a transaction. When an application (like a wallet) shows a user their BTC balance, it does so by scanning the blockchain and aggregating the UTXOs belonging to that user.
If my Bitcoin wallet says I own 20 BTC, it means that there are 20 BTC worth of UTXOs associated with my public key. This can be one UTXO of 20 BTC, four of 5 BTC each, or any other combination that adds up to 20 BTC.
Transactions on Bitcoin are structured as a set of input UTXOs, which are consumed (or destroyed) to create output UTXOs. Imagine Joel has UTXOs with the following values associated with his address:
- 10 BTC
- 5 BTC
- 1 BTC
Now, if he wants to pay Saurabh 14BTC, his wallet application would create a transaction with:
- 10 BTC and 5 BTC UTXOS as inputs (the 1 BTC UTXO remains untouched)
- 14 BTC as one output to Saurabh’s address
- 0.9998 BTC as the second output back to his address
The second UTXO is the change he receives from the transaction. Why 0.9998 and not 1 BTC? He also needs to pay the Bitcoin miner a fee as an incentive for including his transaction in a block. The difference between the sum of input and output UTXOs (0.0002 BTC in this case) constitutes the fee offered for a transaction. In most cases, the heavy lifting of creating a valid transaction by setting appropriate inputs, outputs, and fees is abstracted from the user and handled in the background by the wallet application1.
To understand UTXOs better, think of them as currency notes and Bitcoin wallets as physical wallets. Each currency note (like a UTXO) is worth a fixed, indivisible amount, and the total value stored in a physical wallet (like in the case of a Bitcoin wallet) is the sum of the value of all currency notes inside it.
Subscribe
Bitcoin transactions are similar to purchasing items with cash. If I want to purchase a $14 cocktail at a bar in New York City, I can hand over a $10 and a $5 bill and will receive a $1 bill in return. Where this analogy breaks is that while currency notes exist only in set denominations ($1, $5, $10, etc.), UTXOs can be associated with any arbitrary amount of Bitcoin.
(In contrast, other blockchains like Ethereum operate as a ledger of debits and credits and track user balances in-protocol. This is similar to how bank accounts keep track of user balances.)
The design of choice of Bitcoin using UTXOs over other blockchain accounting models is what sets the stage for future token protocols built on top of it.
OP_Return
Satoshi Nakamoto originally created Bitcoin as a form of censorship-resistant peer-to-peer electronic cash system. However, in doing so, he also happened to create the world’s first immutable, non-counterfeitable, transparent, and timestamped ledger.
Soon after its release, early cryptocurrency enthusiasts started realising that such a ledger was useful for applications beyond just payments. This technology could be extended to secure any piece of digital data that was important enough to store on a resilient, distributed ledger. Applications discussed included stock certificates, digital collectibles, property ownership records, and bringing the domain name system (DNS) to Bitcoin2.
Hal Finney, the legendary computer scientist, famous Bitcoin contributor, and receiver of the first BTC sent by Satoshi, proposed a solution to bringing DNS on chain in the BitcoinTalk Forum.
The question of whether one should use Bitcoin to store non-payment data triggered one of the first major debates in the Bitcoin community. One camp viewed Bitcoin exclusively as a payment system and considered storing other data (or “junk”) as abusive to its core purpose. The other camp saw it as a demonstration of Bitcoin’s power and believed that building new applications was crucial to the blockchain’s long-term relevance and diminishing security subsidy.
The debate also had short-term practical implications.
In the absence of the Bitcoin protocol providing a dedicated method to store non-payment data, early experimenters found a workaround. Recall from our previous discussion that a Bitcoin transaction consists of a series of input and output UTXOs. Each output UTXO has fields for the amount and destination Bitcoin address. Developers made use of this 20-byte destination address field to store arbitrary non-payment data.
What kind of arbitrary data? As this blog post documents, a wide range of both the mundane and the creative. From a tribute to Nelson Mandela to an ASCII portrait of then Federal Reserve Chairman Ben Bernanke, and from a link to the WikiLeaks Cablegate files to a PDF of the original Bitcoin whitepaper, enthusiasts preserved any text they deemed worthy of permanent digital existence on the ledger.
However, this approach had a major unintended consequence. Ordinarily, the data in the destination address field is a public key (or the destination address) that the protocol maps to a private key that can control the resulting UTXO. When developers started using this address field to store arbitrary data, these transactions created UTXOs that could not map to a private key, and, as a result, could never be spent. Such transactions are labelled as “fake payments.”
For example, this transaction, which contains the PDF of the original Bitcoin whitepaper, stores the data across almost 950 output UTXOs, none of which are spendable.
The problem with storing data in UTXO outputs.
Fake payments are problematic for anyone running a full Bitcoin node. Full nodes maintain a copy of all valid UTXOs (known as the complete UTXO set) in the blockchain’s history, which they then use while validating new transactions. Ideally, the UTXO set should be small so that transactions can be validated quickly. However, since the UTXOs created in fake payments can never be spent, they result in “UTXO bloat,” or an increase in the size of the UTXO set. Consequently, nodes must permanently bear the costs of storing data that the blockchain was not designed to carry.
Even though the payment purists disagreed with the use of Bitcoin to store non-payment data, there was no way for them to prevent users from adding arbitrary data to a UTXO output. As a compromise, they reluctantly allowed the OP_RETURN script function, previously disallowed, to be included in Bitcoin transactions in 2014.
Their stance (as I interpret the release notes of Bitcoin version 0.9.0) essentially was— ‘Look, we don’t like you storing random data on Bitcoin. That is not what it is for. But there is no way we can stop you from using outputs to do so. So let us reduce the damage you’re causing. We’ll give you a separate limited space for you to continue with your shenanigans, but at the same time, we would strongly suggest you do not use Bitcoin for this. That is not what it is meant for.’
OP_RETURN accepts a user-defined sequence of 40 bytes of data. Although this data is stored on the blockchain, these outputs are provably unspendable and can be excluded from the UTXO set. This means full nodes can ignore outputs marked OP_RETURN while validating payments, partially solving the problem of UTXO bloat. I call the problem only partially solved because these transactions continue to exist on the blockchain and consume disk space.
40 bytes is not a lot of data. One English character typically takes up one byte of data, meaning OP_RETURN could only hold strings of up to 40 characters—certainly not sufficient to store images or complete documents. Thus, the primary use case for OP_RETURN was the storage of the hashed values of bigger pieces of data.
Any piece of digital data, when passed through a hashing algorithm, maps to a unique alphanumeric string called a hash value. These hash values could then be stored in the OP_RETURN field to timestamp pieces of externally stored data on the Bitcoin blockchain. For example, I could create a piece of art and store the hash value of the image file on the blockchain. Anyone could then, in the future, use the transaction to verify the provenance of the image.
Services like Proof of Existence allow users to upload documents, generate hash values, and store them on Bitcoin for a fee (currently 0.00025 BTC or ~$18)3.
A hockey stick chart if there ever was one. (source)
The chart above illustrates the number of transactions containing OP_RETURN outputs over time. Notice the parabolic increase in such transactions in the recent past? We will discuss the reasons for it soon.
The OP_RETURN data limit was increased to 80 bytes in 2015.
Early Token Experiments
As Bitcoin was maturing, developers started dreaming of building other applications that benefitted from blockchain technology. One common application was the creation of alternate currencies or tokens with custom properties and utilities. One way to do this was to spin up a blockchain from the ground up, a path taken by early altcoins like Namecoin and Dogecoin. However, this approach required bootstrapping a miner base and bore the risk of the token being centralised, at least initially.
A more attractive proposition for some was to somehow create a token on the Bitcoin protocol itself, benefitting from its security and existing distribution.
Today, Vitalik Buterin is famous for being the cofounder of Ethereum, the second-largest cryptocurrency after Bitcoin. However, before he created Ethereum, Vitalik was very much an active part of the Bitcoin community. He started his crypto career writing for the publication Bitcoin Weekly. After that shut down, Vitalik co-founded Bitcoin Magazine, which many consider the first serious publication in the industry.
Cover of the October 2013 edition of the Bitcoin Magazine. You can purchase original physical prints of these using BTC in the Bitcoin Magazine Store. This one currently sells for $1000!
In 2013, Vitalik, along with four other authors, released the whitepaper for Colored Coins, a way to store “alternative currencies, commodity certificates, smart property, and other financial instruments” on the Bitcoin blockchain. This was done by marking, or “coloring”, Bitcoins with information that specifies their intended use.
What does it mean to mark a Bitcoin? Recall that BTC is stored on the blockchain as UTXOs, which are created and destroyed when BTC is transferred from one wallet to another. This mechanism enables the tracing of the origin and ownership history of a Bitcoin as it moves between wallets.
Let’s say I receive a 5 BTC UTXO from Saurabh. I then transfer 7 BTC to Sid, created from one 5 BTC UTXO (the one I received from Saurabh) and another 2 BTC UTXO (one I already had in my wallet). Now, Sid transfers 10 BTC to Joel, made up of the two UTXOs – the one he received from me and another he had from before. Joel’s BTC can now be traced back to Saurabh, Sid, and me by following the trail of transactions that led to the UTXOs in his wallet.
Subscribe
Let’s revisit our analogy of Bitcoin UTXOs and currency bills. Each currency bill has a unique serial number that is preserved as it moves from one holder to another. The difference is that while I may not have a complete history of the holders of a currency bill before me (since there is no place this is recorded), all Bitcoin transactions happen on a public ledger where each satoshi (sat), the smallest unit of Bitcoin (1 BTC = 100 million sats), can be traced right back to its original owner. Had there been a way to record the movement of currency notes on the basis of their serial numbers, we would be able to trace them back to the printing press, just as we can trace every BTC to the block at which it was created.
Because BTC can be traced across transactions, so will the metadata associated with a particular UTXO. This is the basis of the process of marking or “coloring” BTC. The Colored Coins protocol uses a combination of input, output, and OP_RETURN to create and transfer tokens from one address to another.
The structure of a Colored Coins transaction.
This is an example of a Colored Coin transfer transaction. The data in OP_RETURN defines the properties of the Colored Coin, while the input and output values (along with a few additional fields not shown in this diagram) define the movement of the coin across different wallets.
There are two key points to note about this implementation of external tokens on the Bitcoin blockchain.
First, the values in the input and output fields represent actual Bitcoin moving from one wallet to another, with Colored Coins tagged to these sats. This means that if I want to send x Colored Coins, I’ll have to send x sats as well. The true value transferred is the value of the Colored Coins plus the value of the sats. This is an obvious drawback of the protocol.
If you’re creating a new currency, you almost certainly want it to be valued independently and not combined with another currency. For example, the value of a fiat currency bill should be what is mentioned on it, unrelated to the value of the paper it is printed on. This, I believe, is one of the reasons Colored Coins never caught on as a way to issue new tokens. For non-monetary use cases, like issuing shares of ownership, Colored Coins still made sense.
Second, Bitcoin doesn’t recognize Colored Coins and their metadata as a part of the protocol. We saw earlier how nodes can choose to ignore the information in the OP_RETURN field, which is crucial for interpreting the movement of Colored Coins. This means that to participate in the creation and trading of Colored Coins, users have to use specialised wallets that recognize the rules of the protocol.
If users use an ordinary wallet (designed for sending and receiving BTC) to interact with UTXOs that were previously involved in Colored Coin transactions, they risk losing or corrupting the metadata associated with their UTXOs. This incompatibility between wallets remains a thorn in the side of even future implementations of token standards on Bitcoin, as we will see shortly.
Another early project that allowed users to create digital tokens on top of Bitcoin was Counterparty. Counterparty also uses OP_RETURN to store token-related metadata, but unlike Colored Coins, Counterparty tokens are not tied to the BTC balance of an address. This detachment allows these tokens to have independent trading and price discovery.
Independent token prices enabled Counterparty to create one of the first decentralised exchanges on top of the Bitcoin protocol. Users could submit their orders via messages (e.g., “I want to purchase 10 tokens of A for 20 tokens of B”), and the protocol would hold their funds in a trustless escrow till an order ̇was either fulfilled or expired.
Counterparty’s native token, XCP, was initially created and distributed via a fair launch called “Proof-of-Burn” where users had to burn BTC to mint the token. XCP acts as a utility token that allows developers to pay for creating named Counterparty coins. Counterparty also provides developers with simple APIs to create tokens, transfer assets, issue dividends, and more.
Notable projects that were created using Counterparty include Spells of Genesis, the first NFT blockchain-based mobile game (yes, blockchain gaming was a thing as far back as 2015!), and Rare Pepes, an NFT collection that holds its value even today (the floor price of the 298 supply collection is almost ~$1 million as of early June 2024).
Segwit
Even though OP_RETURN, Colored Party, and Counterparty enabled the storage of tokens on Bitcoin, their growth was hindered by a fundamental limitation of the protocol: the 1MB block size limit.
1MB is not a lot of data. A typical Bitcoin transaction was around 300 bytes, meaning a single 1MB block could hold approximately 3000 transactions. Since Bitcoin blocks are produced every 10 minutes, the network’s transaction per second (TPS) value hovered around 5. This throughput was woefully inadequate for a payments network. For perspective, Visa processes 1,700 TPS and has a peak capacity of over 24,000 TPS.
The discussion about increasing Bitcoin’s block size, much like the previous debate over payment and non-payment data, also divided the community into two camps.
One camp, the so-called big blockers, campaigned for a hard fork (a protocol change that would require all nodes and users to upgrade their software) to permanently increase the block size to 2MB, followed by subsequent periodic hard forks to continue expanding the block size. This group believed that for Bitcoin to be a viable payment system for millions of users, it needed higher TPS and low fees. The only viable way to achieve this was to continually increase the block size as demand grew.
Subscribe
The small blockers, on the other hand, advocated against hard forks and other such drastic changes to the protocol. To them, part of Bitcoin’s value lay in its stability. They argued that increasing the block size would make it difficult for users to run full nodes, thus decreasing Bitcoin’s decentralisation and overall allure as a robust, revolutionary currency4.
The block wars became one of the main talking points of the time. This headline is from the Wall Street Journal.
The big blockers ended up creating Bitcoin Cash, a fork of the Bitcoin blockchain with an 8MB block size limit. The small blockers, on the other hand, enabled an upgrade called Segregated Witness, or Segwit, to increase the block size without enforcing a hard fork.
Apart from a series of inputs and outputs, a Bitcoin transaction also contains one other structure that we haven’t discussed yet—witness data. Witness data, which includes cryptographic signatures and other validation information, constitutes up to 65% of the transaction size.
The SegWit upgrade changed the structure of a block. Instead of having all data (inputs, outputs, signatures) reside in a single 1MB block, the upgrade divided the block into two sections: a base transaction block, containing all inputs and outputs, and an extended block, storing the witness data.
Along with this change, SegWit also shifted the metric used to calculate the capacity of a block from data size to weight units. The weight of a block is calculated using the formula:
Weight = Base Size × 4 + Witness Size
For example, a transaction with a base size of 100 bytes and witness data size of 200 bytes would occupy 600 weight units [(100 × 4) + 200]. The new limit on block capacity increased from 1MB to 4 million weight units, effectively quadrupling the block capacity without requiring a hard fork.
Importantly, the base block remained around 1MB, preserving the initial block size limit. This allowed the protocol to accept both legacy and SegWit blocks simultaneously, ensuring that miners and nodes were not forced to upgrade their software immediately to accommodate the change.
Segwit wasn’t adopted by miners overnight; it took almost 5 years for 90% of Bitcoin blocks to be Segwit ones. On the surface, this gradual adoption seems to justify the decision to implement a soft fork. However, we can only speculate on how the counterfactual, a hard fork, would have played out and impacted miners’ behaviour.
Regardless, Segwit gave Bitcoin a much-needed boost in TPS and was a crucial milestone in scaling the network and supporting use cases beyond just BTC payments.
What’s on Tap?
The 2021 Taproot Upgrade was the most significant upgrade to the Bitcoin protocol since Segwit. However, unlike the contentious block size wars, the changes proposed by Taproot were accepted almost unanimously by the Bitcoin community.
The Taproot upgrade was a combination of three Bitcoin Improvements Proposals (BIPs) implementing several changes that made Bitcoin safer and more efficient. While these changes covered multiple facets of the protocol, we will focus on those that laid the groundwork for future token protocols on the chain.
The first major change brought about by the Taproot upgrade was the replacement of the Elliptical Curve Digital Signature Algorithm (ECDSA) signatures with Schnorr signatures. Blockchains rely on digital signatures—messages cryptographically signed by a user’s private key and verified with their public key—to operate. Digital signatures come in various forms, each following different cryptographic schemes, with some being more efficient than others. The shift to Schnorr signatures provided two key boosts for scalability.
First, recall that the witness data, which includes the signature, occupies a significant portion of transaction space. Schnorr signatures are smaller compared to ECDSA ones, leading directly to space savings and allowing for more transactions to fit into a single block.
Second, Bitcoin supports complex payment types like multisig transactions, where multiple parties must approve a transaction based on specific conditions for it to be executed. Before Taproot, a multisig transaction required each individual signature to be included in the transaction inputs. With Schnorr signatures, multiple signatures can be combined into a single signature (and, thus, single input), making multisig transactions significantly more efficient and private.
The Taproot upgrade also expanded Bitcoin’s scripting capabilities, allowing developers to create more complex transaction conditions. The upgrade also provided a new way to store arbitrary data on the Bitcoin blockchain, offering greater flexibility than the OP_RETURN opcode discussed earlier.
In practice, this meant that the amount of arbitrary data developers could store in a Bitcoin transaction was now only limited by the maximum allowed size of a transaction, which was 400,000 bytes. This was five thousand times the amount of data that OP_RETURN allowed them to store.
By making transactions more efficient and allowing for additional flexibility in their content, the Taproot upgrade paved the way for the most explosive experiment yet in bringing tokens to Bitcoin.
Ordinal Theory
Kanwaljeet, my best friend’s father, is a numismatist—a collector of currencies. His collection is notable not just for its historical and limited-edition items but also for a unique category of currency bills he collects solely for their serial numbers. For instance, he owns a 500 INR bill with the serial number “001947,” corresponding to the year India gained independence. Purchased for 750 INR, it is now worth 1000 INR due to its serial number.
Money holds a special place in society, serving as a medium of exchange and a symbol of status, freedom, and power. Its significance is evident in the way we work for it, the conflicts it incites, and the reverence some cultures have for it. This also explains why money is a popular collectible and highlights the work of numismatists.
Subscribe
Bitcoin is the first instance of a new form of money: cryptocurrency. Now more than fifteen years old and a trillion-dollar asset class, Bitcoin has grown popular enough for enthusiasts to assign it provenance and historical value. But how does one even do this for a digital currency?
Enter Casey Radamor and his Ordinals theory.
When a central bank issues currency notes, each one is assigned a serial number in the order of its printing. Similarly, the Ordinals theory is a convention, a numbering system, to assign a serial number to every satoshi (sat) that has ever existed or will exist when mined in the future. Let’s look at how this works.
Recall that each satoshi can be traced back to its origin through the UTXO model. Satoshis are created as rewards for miners who mine Bitcoin blocks and are numbered in the order they were mined.
For example, the first block mined, known as the Genesis Block, rewarded the miner with 50 BTC. Since each Bitcoin comprises 100 million sats, the first block reward contained sats numbered 0 to 4,999,999,999. The second contained sats numbered 5,000,000,000 to 9,999,999,999, and this pattern continues. Consequently, the last satoshi will be numbered 2,099,999,999,999,999.
The Ordinals theory uses a first-in-first-out (FIFO) system to track the numbering of sats as they move between UTXOs. When a Bitcoin transaction consumes a UTXO, the sats are split among the newly created UTXOs in the order in which they appear in the output.
For example, if the miner of the Genesis Block received a UTXO containing sats numbered 0 to 4,999,999,999, and they want to isolate a particular sat—say sat number 21 million—they would structure the transaction as follows:
The Ordinals theory, by assigning each satoshi a unique number, makes them somewhat non-fungible. I say somewhat because, in the context of making a Bitcoin payment, the merchant will not care about which sats constitute that payment, making them fungible in that scenario. However, for someone who is on the lookout for a specific numbered sat, like Kanwaljeet does with currency notes, sats become very much non-fungible5.
Once the Ordinals theory gained popularity, the emergence of BTC numismatists—rare Bitcoin hunters—became inevitable (Wired published an excellent article documenting their world). What are rare Bitcoins? It’s a spectrum. Casey Radamor provides a framework for assessing rarity:
In reality, however, rarity is highly subjective and depends on numbers the collective believes hold value. Kanwaljit collects notes with serial number 150847 because it represents the date India achieved independence. For a currency collector from another country, this number might be completely irrelevant. Similarly, Bitcoin hunters value sats for all sorts of reasons—from obvious ones like a sat being mined by Satoshi to more enigmatical ones like a sat number forming a palindrome.
Rare sats are not only traded on marketplaces like Magic Eden and Magisat, both of which provide users with icons and guides to help them accurately assess the value of the sats they’re purchasing but also on more traditional auction houses like Sotheby’s, where a rare sat is sold for over $150,000.
Recently, viaBTC, a Bitcoin mining pool, auctioned off an epic sat (the first sat of the recent halving) for 33.3 BTC, which is over $2 million. This amount compares to the most expensive fiat currency note sale ever: a rare 1,000 US dollar treasury note issued in 1890 that sold for over $3 million in an auction in 2014.
Remarkably, this note, dubbed the “The Grand Watermelon” due to the shape and colour of the zeros on the reverse, is still valid tender!
Apart from spawning a class of digital numismatists, the Ordinal’s theory, by introducing a convention to number sats, also unlocked the next step in Casey Radamor’s plan: bringing “digital artefacts” to Bitcoin.
Inscriptions
The 2021 release of the Taproot upgrade coincided with a major wave in the crypto industry—that of NFTs. More than $25 billion worth of NFTs were traded in 2021, a majority on Ethereum. Pixel art, monkey pictures, sporting moments, photographs, music, sneakers, coffee vouchers, and even plain English words — there was an NFT for seemingly everything. The movement signalled the biggest intersection of crypto with mainstream media and brands yet, and onboarded more new people to crypto than any other use case till then.
Now, the debate over whether NFTs, or even digital art as a category, should be inherently valuable is something that has been written about and discussed enough, so we won’t get into it. What matters is that at least a subsection of the Bitcoin community, including Casey, looked at what was happening on other chains, particularly Ethereum, and decided that it was something they wanted to bring to Bitcoin as well.
If Bitcoin were to have a standard for NFTs, Casey wanted it to be “unplagued” from the flaws of its predecessors. His solution: Inscriptions. From Casey’s blog post on Inscriptions:
Inscriptions are digital artifacts, and digital artifacts are NFTs, but not all NFTs are digital artifacts. Digital artifacts are NFTs held to a higher standard, closer to their ideal. For an NFT to be a digital artifact, it must be decentralized, immutable, on-chain, and unrestricted. The vast majority of NFTs are not digital artifacts. Their content is stored off-chain and can be lost, they are on centralized chains, and they have back-door admin keys. What’s worse, because they are smart contracts, they must be audited on a case-by-case basis to determine their properties.
Inscriptions are unplagued by such flaws. Inscriptions are immutable and on-chain, on the oldest, most decentralised, most secure blockchain in the world. They are not smart contracts, and do not need to be examined individually to determine their properties. They are true digital artefacts.
Here’s how they work.
Inscriptions inscribe data onto individual sats, which are then tracked by the Ordinals theory. To mark a particular sat with some data, developers have to create a transaction that isolates that sat and places it in the first output of a Bitcoin transaction. The data itself resides in the transaction witness (the upgrade introduced by SegWit) and is stored in the script-path append scripts introduced by the Taproot upgrade.
Since an inscription is etched on a sat, it can be moved, traded, bought, or sold by transferring the inscribed sats in simple Bitcoin transactions. However, like previous token standards, they required a wallet that recognised the protocol and structured transactions accordingly. In other words, you do not want your wallet to accidentally send an inscribed sat as part of a normal transaction.
Each inscription is also given an index number in order of its creation. Thus, we know that over 70 million inscriptions have been created so far. Additionally, while you can create collections of inscriptions (like you can do with NFTs on Ethereum), each inscription in a collection requires a separate transaction to create (and in turn, fees to be paid). These properties do away with what Casey saw as weaknesses of NFTs on smart contract blockchains like Ethereum.
What content can you store in inscriptions? Most content formats supported on the web, including PNG, JPEG, GIF, MPEG, and PDF files. It also supports HTML and SVG files that can be executed in sandbox environments (they cannot interact with outside code). Further, inscriptions can be linked to each other and, thus, remix content from other inscriptions. While most users chose to inscribe sats with simple JPEGs, some enterprising ones have experimented with inscriptions like full video games.
Some developers realised that this flexibility of content can be used to create further token standards for Bitcoin.
The most notable of these experiments was the BRC-20 protocol created by domodata. While inscriptions were conceived as a way to bring non-fungible tokens to Bitcoin, the BRC-20 standard (a quip on Ethereum’s ERC-20 token standard) used them to create a fungible token standard for Bitcoin.
The mechanism itself is remarkably simple: fungible tokens are deployed, minted, and transferred using JSON data blobs inscribed on sats. For example, this is what the inscription that deployed ORDI, the first BRC-20 token, looked like:
This inscription defined the parameters for the ORDI token, specifying it as a BRC-20 token, deploying it with a maximum supply of 21 million units, and limiting each minting transaction to 1,000 units. By inscribing such JSON data onto sats, developers could create, manage, and transfer fungible tokens directly on the Bitcoin blockchain.
Similarly, BRC-20 tokens can be transferred by creating a new inscription with data like:
Inscriptions, along with the rudimentary BRC-20 protocol built on top of them, drove a massive wave of attention, capital, and activity to the Bitcoin blockchain. Multiple meaningful on-chain metrics skyrocketed, including miner fees, the percentage of full blocks (defined as blocks where transactions completely fill the 4MB limit), the size of the mempool, Taproot upgrade adoption, and the pending transaction count in the mempool.
Number of inscriptions over time (source)
This surge in activity meant that inscriptions could be considered the first meaningfully adopted token standard on Bitcoin. Top ordinals (another term for inscription collections) continue to hold strong floor prices months after launch. These include NodeMonkes (0.244 BTC), Bitcoin Puppets (0.169 BTC), and Quantum Cats (0.306 BTC). ORDI, the first BRC-20 token, has a market capitalization of over a billion dollars and is listed on top exchanges like Binance.
Why did inscriptions succeed where Colored Coins, Counterparty, and other experiments failed? I think there are two reasons for this.
First, launching after the Segwit and Taproot upgrades meant that inscriptions benefitted from a more mature Bitcoin protocol. Higher block sizes, lower fees, and greater data flexibility allowed inscriptions to avoid the complex, roundabout implementation routes of their predecessors.
Second, the timing was right. The creation of inscriptions was preceded by the 2021 cycle, where almost anyone even remotely tuned into internet trends had heard of NFTs. Crypto traders were comfortable trading them. Even ORDI, launched in the depths of the bear market, benefited from fortunate timing. Only weeks before its launch, PEPE, a memecoin on Ethereum, induced a short-lived memecoin-mania in an otherwise dry market, which it could capitalised on.
Runes
Finally, all of that context brings us to our destination: Runes.
Alongside BRC-20, a bunch of other protocols also attempted to use inscriptions to bring fungible tokens to Bitcoin. This created a fragmented token landscape, with each implementation carrying its own pros and cons. The opportunity to create a superior fungible standard, like Ordinals did for non-fungible tokens, was there for the taking.
And taken it was! Casey Radamor6 stepped in once again, this time with the Rune Protocol, or simply Runes, intending for it to be the de facto fungible standard for Bitcoin tokens. His motivation was simple: “A decent token standard should exist on Bitcoin.”
So, how are Runes different from other standards like BRC-20? A few weeks ago, my colleague Saurabh wrote an excellent piece explaining Runes and its improvements over predecessors in detail. For a full deep dive, I suggest reading his article.
Here is the gist.
Recall that BRC-20 tokens created a new inscription every time you had to deploy, mint, or transfer a token. Further, each token is stored in a separate UTXO. The protocol doesn’t specify a way to include multiple tokens in a single UTXO. This leads to a proliferation of UTXOs, or, in other words, UTXO bloat.
Number of UTXOs over time (source)
Runes simplifies this process. First, instead of inscriptions, it stores data in the OP_RETURN field. Second, it allowed users to hold multiple tokens, including BTC, in the same UTXO. This makes transfers more efficient and reduces UTXO bloat. Third, it is compatible with the Lightning network, Bitcoin’s scaling solution. (Remember the spike in OP_RETURN transactions we saw earlier? You now know what caused it.)
The Runes launch, scheduled to coincide with the latest Bitcoin halving, was accompanied by much hype. Ordinals had already proven to be successful (though it took a while to take off), and that was in a bear market. Runes launched with the BTC price more than thrice higher since.
Given the hype, many (including me!) considered its aftermath and impact to be underwhelming, at least if you go by the sentiment on Crypto Twitter (CT). It’s not uncommon to hear people opine that “runes failed” or “runes are dead.”
However, the numbers on-chain paint a very different picture.
Source: @cryptokoryos on Dune
Source: @cryptokoryos on Dune
Runes is dominating non-payment Bitcoin activity. On most days since launch, it has had more transactions than ordinals and BRC-20 combined, and seems to have replaced the latter as the most popular fungible token standard on Bitcoin. This is also reflected in the market cap of Runes, which has already eclipsed that of BRC-20. This is despite it not being listed on any major centralised exchange.
We’re still very early in the journey of Runes. Without a CEX listing, Runes (and other fungible tokens) still trade on a slow, order-book-like system. Trading is slow because Bitcoin’s 10 minute block times prevent high-frequency trading. Given the lack of decentralised exchanges on Bitcoin, you also cannot yet trade one Rune directly for another (you have to settle in BTC first). Moreover, the UX remains complex. Runes, like previous token standards, require special wallets to trade and hold.
These challenges are preventing it from being more widely adopted.
Subscribe
Some parting thoughts
One of the reasons Bitcoin is valuable is that it is the first purely digital currency, uninfluenced by centralised actors or power brokers, and backed fully by code. Yet, it is astounding how much of the innovation around token standards building on top of Bitcoin relies on social consensus.
Runes or ordinals, for example, are not part of the Bitcoin protocol. They are, as Casey likes to term it, “an opt-in lens with which to view Bitcoin.” You can think of them as a convention that has been “memed into existence.” Yet, they are worth billions of dollars in value because a sufficient number of people have socially coordinated to accept them as the conventions that define them.
Yes, Runes was a much improved fungible token standard compared to its predecessors. Yet, a significant part of its wide adoption is due to the backing of Casey Radamor and the social capital he has built over the years. This is also why people readily accept unorthodox rules like the initial 13-characters limits on Rune names.
We also hold the opinion that Bitcoin NFTs have found product market fit. Because NFTs are relatively illiquid and trade with less frequency, Bitcoin’s 10-minute block times are not a hindrance to their existence. Moreover, given that Bitcoin blockspace is the most valuable blockspace in the industry, and inscriptions reside completely on chain, the allure of owning a digital artefact on this new medium will continue to exist.
I looked at the top 10 NFTs and tokens on both Ethereum and Bitcoin. Find the full analysis here.
Fungible tokens, on the other hand, are very much restrained by Bitcoin’s slow block times and the lack of automated market makers. Despite that, they have already surpassed ordinals in market cap. The top 10 ERC20 tokens on Ethereum are 64x greater in market cap than the top 10 NFT collections. For Bitcoin, this ratio still stands at only 7.7x. Once we have the means to make their trading more efficient, the potential upside could be substantial.7 What might those means look like? Maybe Bitcoin L2 solutions provide the answer.
But that is a story for another day.
Excited for Sunday’s Euro final,
This is an excellent resource to understand how Bitcoin transactions work in more detail.
The original Bitcoin DNS system proposal. After Satoshi himself rejected this use case, the developers forked Bitcoin to create their own blockchain, Namecoin, which became one of the first alt-coins.
A demo of Proof of Existence with an explanation of OP_RETURN.
The block wars, as this debate came to be known, raged fiercely over two years from 2015 to 2017. It was not just a battle over small blocks versus big blocks, but also over how Bitcoin should be governed and the more fundamental question of whether Bitcoin was a payment system or a form of digital gold. Vitalik’s recent post draws upon two books authored by members from each camp—The Blocksize Wars by Jonathan Bier and Hijacking Bitcoin by Roger Ver—and provides a high-level overview of their arguments. What is relevant to us is the outcome of this conflict.
A variant of the ordinal theory was first proposed in the BitcoinTalk forum way back in 2012.
Casey Rodarmor hosts an underrated but incredibly fun podcast called @hellmoney">Hell Money.
My colleague Saurabh slightly disagrees with this analysis. He believes that unlike Ethereum, productive (non-meme) tokens on Bitcoin will launch directly on L2s, and not on the L1. This is because Ethereum allows holders to trade, lend, and do other things with the token on the base layer, whereas Bitcoin does not because the former chain is built for it and the latter isn’t. What’s the point of launching tokens on Bitcoin if they cannot be used for their intended purpose? If they sit on Bitcoin, they do so only in the hope of some liquidity helping them catch a bid, no different from memecoins on Bitcoin. He believes we tolerate the Bitcoin blockchain because we want to use BTC, the asset. It is unlikely that other assets achieve the same status. I hold the opinion that irrespective of whether you can do anything with a token on Bitcoin L1 or not, teams would still want it to be their token’s home because of the provenance and interoperability between chains it enables.
Disclaimer：
- This article is reprinted from [Decentralised.co]. All copyrights belong to the original author [SHLOK KHEMANI]. If there are objections to this reprint, please contact the Gate Learn team, and they will handle it promptly.
- Liability Disclaimer: The views and opinions expressed in this article are solely those of the author and do not constitute any investment advice.
- Translations of the article into other languages are done by the Gate Learn team. Unless mentioned, copying, distributing, or plagiarizing the translated articles is prohibited.
Related articles
BTC and Projects in The BRC-20 Ecosystem
What Is a Cold Wallet？