mircea_popescu:this actually works as an argument. bitcoin needs no assaying, which makes it more fungible than something that does.

"Fungibility refers only to the equivalence of each unit of a commodity with other units of the same commodity. Fungibility does not relate to the exchange of one commodity for another different commodity" https://en.wikipedia.org/wiki/Fungibility

Also, from the same source:

"A good is fungible if one unit of the good is substantially equivalent to another unit of the same good of the same quality at the same time and place."

Notice the wiggle word in there. Fungibility is subjective.

Fungibility does not imply liquidity, and vice versa. Diamonds can be readily bought and sold (the trade is liquid) but individual diamonds, being unique, are not interchangeable (diamonds are not fungible). Indian rupee bank notes are mutually interchangeable in London (they are fungible there because law) but they are not easily traded there (they cannot be spent in London).

Hey I'm just using the dictionary man


That is not what I said.

What I said is the intrinsic properties make something inherently fungible only when there is no useful traceability (or other physical distinguishability). Otherwise if individual units can be distinguished and then it is up to people, not technology or science, to decide whether it is fungible in practice or not. The obvious example here is paper money. Not only is it fungible by law (we'll ignore that here) but it is fungible only because people don't for the most part ever pay any attention to the serial numbers. If people started doing so, fungibility could only be restored by creating money (such as metal coins) without serial numbers.

Obviously intrinsic indistinguishability properties provide stronger fungibility than people do, and because the Bitcoin ledger doesn't have those properties, this thread exists.


Agree with you there but it isn't just them doing it.

Privacy and fungiblity are different concepts, but perhaps there is some overlap?  The fact people often conflate them would indicate this.

When individual or groups of satoshis may be (on the basis of unique traits or general taint) identified and discriminated for/against, how is Bitoin "absolutely fungible?"

If Bitcoin is "absolutely fungible" then how did BTCE [do whatever they did] with the Evolution coins?

I see your point about gold (in spite of the tenuous radioactivity example).  (Non-radioactive) gold is fungible, even if a particular institution acts in a particular way towards some particular customer's particular gold.

But wouldn't the gold be be even more (ie exhaustively) fungible if it could somehow negate the ability of any and all institutions to discern its provenance, thereby destroying the possibility of non-interchangeability in all particular instances?

BTW, if it was illegal for merchants to accept XMR, we'd just use shapeshift or https://xmr.to/ and be on our fungibility-not-affected way!   

This again is incorrect.

We discussed a few posts back that two satoshis coming out of the same transaction (even if different outputs) are indistinguishable (though only if no social convention develops which would distinguish between outputs of the same transaction, as I explained).

But two satoshis from two different transactions are absolutely distinguishable. The have different histories and therefore can be trivially distinguished. It therefore becomes non-fungible (i.e. non-interchangable) if people choose to attach some significance to that difference. The technology or physical properties do not determine fungibility here, people do.

It certainly would be non-fungible if some important property were recognized to apply to the radioactive gold (for example if it were stolen). People would routinely check gold with a geiger counter before accepting it and you would not be able to substitute your radioactive gold for non-radioactive gold.

TLDR; When people speak of Bitcoin's fungibility "issue" they really are referring to a privacy/traceability one. 

You would have essentially zero privacy and anonymity but the coins themselves would still be inherently fungible.

This is incorrect. Any counterparty to a transaction can define things any way they like. If someone doesn't like your coins they can choose not to deal with you, or charge you more. It doesn't take a third party to impose such a view. It is purely a social convention how much weight to attach to to the history. If it becomes widespread, then it won't matter what third parties say, because people won't want coins with problematic histories. If history is widely ignored, then obviously it won't matter.

The important point is that nothing about the technology forces people to behave in one manner or the other.


I guess that depends whether you are the one dealing with the "complications" related to people paying attention to coin histories. I know several such people personally. It isn't marginal to them.

Yes, that tweet may have induced my 'there are no tainted Bitcoins, only tainted institutions' epiphany.

I don't like those tainted institutions any more than davout and you do.

But they could not exist if Bitcoin was perfectly fungible.

You'll never get a notice from Poloniex saying "Hey buddy, we don't like the guys you sent your Monero to, so we're closing your account."

Polo doesn't know that; Polo can't know that (because stealth addresses and ring signatures).

A few months ago, I opined that Monero enables defections which Bitcoin cannot.

This conversation has helped begin putting meat on the bones of that claim, as I'm finding the concept of 'perfect' (ie, exhaustive of all use cases) fungibility an interesting distinction from Bitcoin's circular 'good enough, assuming you are already rich, lol' version.

Yes, that tweet may have induced my 'there are no tainted Bitcoins, only tainted institutions' epiphany.

I don't like those tainted institutions any more than davout and you do.

But they could not exist if Bitcoin was perfectly anonymous

Those "two satoshis" may be indistinguishable, but they are inexorably linked by their common tx.  Hence, the anti-taint cottage industry of mixers and tumblers and shufflers and Darkcoins (lol).  And (more significantly) the booming trade in blockchain analytics.

Let's set aside considerations of fungibility at the recipient level (maybe I'm sending BTC to MPEX, where they don't GAF where my BTC has been).  There is still a privacy-driven fungibility issue for the sender.

IE, a confidential transaction is not, from my sender POV, equal to a public one.  Maybe I don't want my ex-wife/IRS/boss to know where I'm sending BTC.  The public and private tx are not interchangeable, and that's why people pay proportionally extra (directly and in the form of TTP risk) for fresh coins and mixed/joined/tumbled/shuffled ones.

Coins/satoshis/etc. are not uniquely identifiable as you say, although it is possible to define a rule which would do so. For example, I think some of the colored coin schemes use a rule that if you mix colored and non-colored coins, the colored coins come out in a particular sequence (for example, the first input might directly flow to the first output, etc.). An alternative rule, of course, is that mixing colored and uncolored coins simply destroys the coloring. Both can work. Assuming that people are going to observe a similar convention for regular Bitcoins is a bit contrived but not impossible.

Putting that aside, what exists on the blockchain are not coins but outputs, and outputs are uniquely identifiable because each has a unique history. That is very close to the definition of not being fungible, because fungible means interchangeable. How people choose to interpret that history is again up to them, but we've seen numerous examples of people doing it, so it is implausible to flat out say that people won't do it.

If you want to argue that anyone who tries to implement rules like this will be rendered irrelevant when the crypto singularity comes and fiat fails, and anyone who attempts to pay attention to the unique of different outputs will be laughed at, then I don't necessarily disagree, but mostly I'll just wait to see you on the other side/moon.

For now we have the reality that outputs are very much not fungible. Some can be safely used with Coinbase/Bitpay/etc. and some can not.

It took me a second, but I now appreciate the #bitcoin-assets 'there are no tainted Bitcoins, only tainted institutions' POV.

I love the smugness of that serene maxim, and look forward to the day when it has practical value for those of us with <100 BTC.

OTOH, I believe (smooth will have to back me up with The Science) that Bitcoins are not perfectly fungible at the protocol level because they are uniquely identifiable, and thus may be discriminated against (ie, considered "bad") by individuals, if not in the aggregate.

AFAIK, the Monero protocol couldn't tell "good" coins from "bad" ones even if it wanted to, so its coins are perfectly fungible (no matter what, and without need to invoke rosy assumptions about the future of crypto vs fiat).

Bitcoin Black/Whitelists: technically trivial to implement and enforce, commonly done in status quo (eg stolen Evolution coins at BTCE)

Monero Black/Whitelists: technically impossible to implement or enforce (is it true?)

So you are saying the limit is just the intermediate step, and the true basis for the fee pressure is the centralization risk?  That’s fair enough.  But that is a completely different take on the situation than saying ‘we need to limit TPS so a fee market can develop, so we can pay for security’.  I’m not saying you said that or didn’t say that, but the concept is repeated often enough in defense of keeping a block size limit, and it’s bunk.

Why do you think that only Bitcoin offers it?  What about Litecoin? Monetary sovereignty is important, but anyone who wants to already has wealth freedom / sovereignty.  Buy some gold or gems if you are worried about confiscation, or invest in land if you want protection from devaluation.

Bitcoin does have a big lead, but I think you are being too complacent in saying a new form of money is almost impossibly hard to build.  We have $3 Billion.  There are $100's Billions out there that banks could use to boot strap something, and most people in the world seem to like big shiny corporate logos.

So what can the security of the network be left to?  Hoping that miners don’t collude?

For example: https://blockchain.info/charts/tx-trade-ratio?timespan=all&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=

Shows no dramatic change since 2013.

It is not the gross amount that matters, it is the ratio, and especially (since the ratio on its own is largely an uncalibrated number) the change in the ratio.

I don't know, maybe someone can point to some, but I've seen various reports published once or twice a year for the past few years.

The way you differentiate is by identifying what you can, and it seems a lot can be identified with reasonable confidence (probably not perfectly). If there is a huge swath of unknown that can't be then you ask these questions, but that has really never been the case.

Even gross statistics like coin movement on the blockchain relative to reported exchange volume shows a reasonably tight relationship over time. If there were massive amounts of money fleeing capital controls and FATCA now, that relationship would be break down (unless you think this was going on three years ago when FATCA wasn't in force at all and Bitcoin was $20). Instead it hasn't really broken down.

Don't buy all the hype. Some of it might turn out to be true, but be skeptical.

I''m not. If it were it would show up in blockchain analysis, at least under the category of "unknown". It doesn't. Most activity is fairly easy to categorize (speculation, mining, legal and illegal payments). Certainly there is some that isn't but not some massive hidden economy that is larger than all the known exchanges. It just isn't so

That's probably true.


That's probably incorrect. The last study I saw put Bitpay (maybe also including other smaller processors) and black market activities in rough parity, speculation being larger than both.

As for the rest of  your comments about secret trading desks and such, well maybe. It's unproven and largely unprovable so I guess I'll just wait and see how and if that develop into something significant enough to become obvious, because it currently isn't.

No, they don't obey another government's law, so it is likely coins blacklisted in one country will be totally fine in another country. Unless world's government all united (Is that possible?), the black list just makes the coin going for a round trip abroad

It remains to be seen whether that ever actually happens. The way Bitcoin is used today it is predominantly nonsense, given that most usage is exchanges which are all regulated by fiat rules (except, somewhat, BTC-E which also seems to have issues with fungibility anyway), Coinbase/Circle, and Bitpay. The rest is negligible.

I agree with you about the original stated goals, but it hasn't worked out that way at all after 6 years. I don't rule out that it may still evolve in that direction but it seems a bit of a long shot given the high degree of influence that the pro-regulation crowd has in the ecosystem. It also seems plausible that the next adoption surge, if it happens, will be Wall Street money which will also be very pro-regulation.