Zcash Co-Inventor: ''Capping the supply of Bitcoin at 21M doesn't make sense"

[Dogedegen]

I disgree however a (little) bit about the development incentives. The opposing fraction has always the threat to hard fork away. So if the development goes so wrong that the majority of hodlers oppose a certain change, they can take away the dev tax.

This does not really work in practice, it is only a theoretic argument because in shitcoins everything is extremely centralized around the original team that creating a viable opposition is not practical. We have seen many cases whether of chains or tokens where the founders did all kinds of things that are bad and many in the community disagree with it but ultimately they had to accept it, there were very few examples of opposition like ETC. So yeah while it is true that it could be done, it is not realistic in those conditions. This is why many of these things stay so centralized and the founders keep extracting value since opposition is not possible, usually there are very few people or none who could even continue protocol development. This is different in Bitcoin that must be mentioned.

500,000 per year? I would not believe that at all, I find it even 100,000 per year to be high if you ignore the early days and satoshi.

You may be correct. I checked the sources and the ones that gave high five-fold or sixfold numbers either take into account much earlier years (not always Satoshi-era, but mid-2010s) or seem outright speculative.

For example BitGo estimates that "if only 0,5% lose their coins, then we have >90,000", but 0.5% of hodlers aren't the same as 0.5% of the supply. Big holders tend to have excellent security practices and thus are much less likely to lose the coins. And a lot of the coins are in ETFs, treasuries and other big wallets very unlikely to get lost. River Financial estimates a total of 1.4 million plus Satoshi's coins, that would roughly amount to 100k per year but also very likely most of them were lost in early years.

A source that claims 500,000 or more are lost is this one at Binance Square citing Cane Island (3-4% per year). There's a terrible lack of details and thus I consider it untrustworthy. Perhaps this was used as the source for that Zcash X comment ...

In contrast there is this report that claims that "experts" in 2025 estimated the number to be only 1,500 to 2,000 per year. I think this could still be true, and it would prove my point of course that 4% is way too high for a tail emission.

Yeah exactly the number of holders has nothing to do with the number of coins, and there are going to be many outliers. I have never lost any coins and neither did any people that I have known, so any extrapolation from big cases or known cases will be extremely suspicious and speculative with high inaccuracy. This is one of those cases where we should be publicly admitting that there simply is no way to provide a good estimate for this instead of speculating and making things up as some of those examples did. Any metric that you use is not going to be true, like using number of days since coin has never moved or public admissions of lost keys.

With these numbers I would strongly argue for a emission like Monero's under 1% per year. (But as written above, only as an emergency measure, or as a "guideline value" for new altcoins.)

Only if there is a proven issue that is happening and requires an emergency measure, but not in speculative stories of it will be an issue or like some people like to panic about everything and then overthink and imagine scenarios. If it does become an issue there is plenty of time to think and do something, the whole industry is not going to collapse in a day.

[joniboini]

Bitcoin's unique advantage lies in its strictly limited supply. anyone who wants Bitcoin without a 21 million coin limit and with 4% annual inflation should create a fork. although we've already seen the poor fate of virtually all Bitcoin forks.

I've also seen similar forks with the same supply limit (or even lower iirc) failed to get any traction. The fact is that it's hard to sell your fork if the advantage is too small to notice or if the number of early adopters are small. After all no one is going to risk buying a coin with a chain that can get rewritten so easily due to low hash rate, lower mining incentive, and so on.

[BlackHatCoiner]

Isn't Zcash capped at 21 million? The guy literally hardcoded Bitcoin's exact monetary policy into his own chain, but please, tell us how capping the supply at 21 million on a network with 100% chance of having higher transaction volume than Zcash doesn't make sense.

Altcoin developers will literally post the dumbest thing to get some attention. Nobody can reach Satoshi's intellect.

[pawel7777]

As I posted in another thread, I see this as being similar to the so-called Race Course paradox, i.e., you travel from point A to point B, you must first travel half the distance. Once there, you must travel half of the remaining distance, and so on. Meaning you will always keep moving, but will never reach point B.

To relate this paradox to Bitcoin, there will always be some bitcoins getting lost, but, as the remaining ones will be infinitely divisible (assuming we can easily increase places after decimal if needed), whatever is left would be distributed among the active users.
That's why Bitcoin is described as deflationary money (or asset).

[tromp]

I strongly support a clear monetary policy with an absolute upper bound on the # of Bitcoins in the future. Say, fix a max issuance rate and you get that (a good choice is 4% a year, this is a reasonable upper bound on human population expansion).

This way, you ensure there's enough to go around.

You don't need any yearly percentage increase to have enough to go around.
A simple tail emission suffices both for compensating against lost coins and for expanding the user base.
If N coins are emitted yearly, and 1% of all coins get lost every year, then the supply will simply converge to 100N
(100N -1% + N = 100N).

Also, 4% is more of an arbitrary than a clear monetary policy. Cryptocurrencies should contrast with fiat by being at worst disinflationary.

Bitcoin would have been much better off with a tail emission. Not in terms of marketcap, which due to a reduction of FOMO and speculative use would have been much lower, but in terms of sustainability and decentralization of wealth.
It would not make it substantially less hard of a currency [1].

But monetary policy has to be set in stone from the start. Any forks changing the supply limit deserve to die a painful death. (Zcash messed with its policy when its developers reneged on the original 10% premine by continuing the 20% dextax beyond the first 4 years). Bitcoin will just have to make the most of lacking a tail emission, and find other ways to guarantee a sufficient security budget, even if they end up emulating a tail emission in more complicated ways.

[1] https://tromp.github.io/blog/2020/12/20/soft-supply

[JeffBrad12]

Isn't Zcash capped at 21 million? The guy literally hardcoded Bitcoin's exact monetary policy into his own chain, but please, tell us how capping the supply at 21 million on a network with 100% chance of having higher transaction volume than Zcash doesn't make sense.

Altcoin developers will literally post the dumbest thing to get some attention. Nobody can reach Satoshi's intellect.

Maybe they should start increasing that cap for Zcash because apparently they said 21 million supply doesn't make sense. It will be a good experimentation and serve as an example to truly shed light onto us about what is the benefit of increasing the supply and move to yearly emission.
They themselves don't want to implement it and if not for the same 21 million hardcoded total supply, I wonder if Zcash could be this big.

[Dogedegen]

If N coins are emitted yearly, and 1% of all coins get lost every year, then the supply will simply converge to 100N
(100N -1% + N = 100N).

But that involves a big assumption, nobody has any real data on how many coins are lost per year. There are just baseless speculations with many assumptions, the reality could be that 0.1% or even 0.01% per year are only lost. And if you go with an assumption that is very wrong with that, it will have big negative impacts in the cumulative long term.

Also, 4% is more of an arbitrary than a clear monetary policy. Cryptocurrencies should contrast with fiat by being at worst disinflationary.

Yeah arbitrary, big and unnecessary.

Bitcoin would have been much better off with a tail emission. Not in terms of marketcap, which due to a reduction of FOMO and speculative use would have been much lower, but in terms of sustainability and decentralization of wealth.
It would not make it substantially less hard of a currency [1].

I do not understand at all how it would have a positive impact on decentralization of wealth when mining is done by large and industrial miners, I think it would have the opposite effect like POS networks do with infinite supply. The only change there is that instead of stake locked, people have capital locked in hardware and infrastructure but they are the ones that are getting most of the new supply.

Isn't Zcash capped at 21 million? The guy literally hardcoded Bitcoin's exact monetary policy into his own chain, but please, tell us how capping the supply at 21 million on a network with 100% chance of having higher transaction volume than Zcash doesn't make sense.

Altcoin developers will literally post the dumbest thing to get some attention. Nobody can reach Satoshi's intellect.

Maybe they should start increasing that cap for Zcash because apparently they said 21 million supply doesn't make sense. It will be a good experimentation and serve as an example to truly shed light onto us about what is the benefit of increasing the supply and move to yearly emission.
They themselves don't want to implement it and if not for the same 21 million hardcoded total supply, I wonder if Zcash could be this big.

Overall it is best not to listen to anyone pretending to be an expert from the shitcoin world. Zcash was made as a trojan horse attack against Monero, they created a competitor to attack the adoption of Monero. Nobody who is serious about anonymity and privacy uses Zcash. If you look at dark web, basically it is not accepted or trusted by anyone.

[d5000]

This does not really work in practice, it is only a theoretic argument because in shitcoins everything is extremely centralized around the original team that creating a viable opposition is not practical. We have seen many cases whether of chains or tokens where the founders did all kinds of things that are bad and many in the community disagree with it but ultimately they had to accept it, there were very few examples of opposition like ETC.

Imo it depends on the degree of centralization. Of course, on super-centralized coins (say something like Sui or XRP) any opposition would not have any effect.

Zcash had, in comparison with coins like Ethereum, a relatively small premine (the dev tax would make up 10% of the total supply). The Ethereum founders in contrast premined 50% of the supply of the first years, even if they sold a part in an ICO. So they had more threat potential to dump the ETC coins. In Zcash's case probably a strong community still could create pressure.

It's however a bit a point for your side that Zcash seems to have extended its dev tax, and they were able to do it without a major hard fork (see tromp's answer).

I have never lost any coins and neither did any people that I have known, so any extrapolation from big cases or known cases will be extremely suspicious and speculative with high inaccuracy.

I know people that have lost coins. It was only faucet rewards or small gifts at that time (pre-2015) but it would be worth at least some hundreds or even thousands of USD today.

This is one of those cases where we should be publicly admitting that there simply is no way to provide a good estimate for this instead of speculating and making things up as some of those examples did. Any metric that you use is not going to be true, like using number of days since coin has never moved or public admissions of lost keys.

I think if they really thought there would be at least a chance to get the order of magnitude.

For example, you could combine:

- a good poll on long term holders' behavior ("good" means: not a simple online poll, but at least an online panel)
- another good poll on lost Bitcoins
- the Bitcoins that are not moved since a year (5 years ago for example)

Most estimates are based only on one of these indicators, above all the "not moved Bitcoins". But that's too shallow. Ideally you do several polls over a timeframe of at least a year, and then contrast them with on-chain data.

I have found out that the Cane Island method is even worse: they derive their number from money that is "typically" lost in every economic system (e.g. lost banknotes and valuables, lost access to payment platforms or prepaid cards ...). But even then: Do you really lose 3-4% of your money per year? I've seen estimations of 1-2% but I think it's still a bit high.

Only if there is a proven issue that is happening and requires an emergency measure

Agreed. However it hasn't to be necessarily a 51% attack in progress. I think if Bitcoin had only a (raw, i.e. not marketcap-bound) attack cost of 2013/14 levels or earlier, then I would be worried and support such a measure.

Bitcoin would have been much better off with a tail emission. Not in terms of marketcap, which due to a reduction of FOMO and speculative use would have been much lower,

I disagree that it would be much lower. I think the missed FOMO and the FUD about the security budget (which is a type of FUD that even "could" have a litte truth in it) should be roughly equivalent. The whole "mining death spiral" theory would probably collapse too, because it heavily is derived from the argument that the security budget is "too low due to the halvings".

This even strengthens your point however

(Zcash messed with its policy when its developers reneged on the original 10% premine by continuing the 20% dextax beyond the first 4 years).

Thanks, I was just looking for the answer of that question to answer Dogedegen's post.

[PrivacyG]

Bitcoin would have probably been about as successful even with a Tail emission instead of the 21 million Bitcoin cap.  The reason of its success is not particularly the cap but many reasons in one big successful chunk, one of the main ones being that it was 'THE' first and strongest.

I kind of disagree with you d5000, Monero not being as successful as Bitcoin does not necessarily mean people chose Bitcoin fits the 'perfect' description.  I would rather think it has to do with the fact that moving from Bitcoin to Monero is a WAY more difficult thing to do than 'simply' changing Bitcoin.  Because this involves a migration that feels like moving from a two story house to a three story house versus building one more floor.  The second option feels more comfortable.

There fore.  In my view, it goes like this.  If Bitcoin had Tail emissions from the start and Monero came second with a fixed supply cap, it would have still not pushed Monero above Bitcoin.

[Dogedegen]

Imo it depends on the degree of centralization. Of course, on super-centralized coins (say something like Sui or XRP) any opposition would not have any effect.

Zcash had, in comparison with coins like Ethereum, a relatively small premine (the dev tax would make up 10% of the total supply). The Ethereum founders in contrast premined 50% of the supply of the first years, even if they sold a part in an ICO. So they had more threat potential to dump the ETC coins. In Zcash's case probably a strong community still could create pressure.

It does depend a lot, that is why I named a single example where this did happen despite the difficulties that you mention. But still the data that we have this based on cases of actually successful splits or alternatives shows us that this happens in practice very rarely, it simply is not feasible for shitcoins because of their centralization. SUI and similar new generation coins are good examples because the whole protocol development is centered around the company or foundation and besides that almost nobody would be able to continue developing it, and often even all projects that relate to it like DeFi are done with grants coming from the same source providing even more power of control.

It's however a bit a point for your side that Zcash seems to have extended its dev tax, and they were able to do it without a major hard fork (see tromp's answer).

there are even coins that changed its supply model strongly by using mostly foundation and adherent coins with some insiders and other whales that are connected. Nothing surprises me with how far shitcoins are willing to go..

This is one of those cases where we should be publicly admitting that there simply is no way to provide a good estimate for this instead of speculating and making things up as some of those examples did. Any metric that you use is not going to be true, like using number of days since coin has never moved or public admissions of lost keys.

I think if they really thought there would be at least a chance to get the order of magnitude.

For example, you could combine:

- a good poll on long term holders' behavior ("good" means: not a simple online poll, but at least an online panel)
- another good poll on lost Bitcoins
- the Bitcoins that are not moved since a year (5 years ago for example)

Most estimates are based only on one of these indicators, above all the "not moved Bitcoins". But that's too shallow. Ideally you do several polls over a timeframe of at least a year, and then contrast them with on-chain data.

You can do a proper methodology to get a better estimate that will be on orders of magnitude more accurate than bad examples like the one that was provided. Still even that is a dark number, for us to be able to be certain to any degree how accurate it is we would need to confirm some of those losses. For example if we estimate a 100k coin loss today, verifying 95% of them would be quite accurate. The problem with even good methodologies in cases like this is that we have no verification at all. So you may estimate 100k coins per year or 500k coins per year, first being conservative and the second quite liberal but it does no change at all that in either case the accuracy ratio remains completely dark. It could be 50% true in either case or 90% and that is a big difference. And to connect this also a bit to your poll, it is really hard because Bitcoin is worldwide and has so many different users and use cases that the main limitation of the poll will be that it will capture some audiences but completely ignore many others.

Due to these challenges, I am not so confident in the estimates but because of that it should be understood that a conservative estimate is always the better path for two reasons. The first is that in relation to the accuracy rate, the error will be smaller in the absolute number of coins. The second is that by itself it has a higher chance of being an underestimate, and if the number of coins lost is bigger than this it is a good thing.

I have found out that the Cane Island method is even worse: they derive their number from money that is "typically" lost in every economic system (e.g. lost banknotes and valuables, lost access to payment platforms or prepaid cards ...). But even then: Do you really lose 3-4% of your money per year? I've seen estimations of 1-2% but I think it's still a bit high.

I remember losing maybe $100 worth in the last 10 years, so that percentage would be high for me personally but I am not a person that loses things. Maybe it is an accurate average when you count people who are less organized and frequently lose things? What about you?

[d5000]

I kind of disagree with you d5000, Monero not being as successful as Bitcoin does not necessarily mean people chose Bitcoin fits the 'perfect' description.  I would rather think it has to do with the fact that moving from Bitcoin to Monero is a WAY more difficult thing to do than 'simply' changing Bitcoin. [...]
There fore.  In my view, it goes like this.  If Bitcoin had Tail emissions from the start and Monero came second with a fixed supply cap, it would have still not pushed Monero above Bitcoin.

Yes I think there are more facts in play than the simple tail emission issue. I interpret that your opinion is that Monero is less easy to use and above all to buy (due to all the delistings). And yes, I have to agree here too. There is also Bitcoin's first mover advantage.

However, what I think is that if the tail emission issue was that important (i.e. the market decided that it was the better concept), then we should see a continuous growth of the "tail emission coins" like Doge, Monero or Grin. With the exception of Monero which has probably other reasons (privacy concept) the opposite is happening and these coins are losing importance and market cap. And even Monero on the long term scale is clearly losing value to BTC.

Or at least we could see a "Bitcoin Tail" fork with at least as much hashrate and market cap as another major fork like BSV or even BCH. In fact I haven't found a single fork with a tail emission, not even something minuscule like BTC, XEC or Bitcoin Diamond.

It's of course a possibility that the market is mis-pricing that, because of course it isn't popular in the Bitcoin space proper (e,g, Bitcoin maximalists). It would be interesting if someone tried such a fork, to see if it would reach at least the level of something like XEC.

You can do a proper methodology to get a better estimate that will be on orders of magnitude more accurate than bad examples like the one that was provided. Still even that is a dark number, for us to be able to be certain to any degree how accurate it is we would need to confirm some of those losses.

I think this is not really necessary, and it is also not possible easily. With one exception perhaps: if Jameson Lopp's anti-quantum fork went through and the lost coins were frozen ... It's even likely that Lopp's timeline (freeze in 5-10 years?) would still be early enough to tackle the reward/security budget problem. But it would be an one-time "confirmation", later I hope we don't need such a freeze again (well I hope we don't need even Lopp's freeze). 

An alternative is to try different methodologies and see if they come to the same order of magnitude without sharing too many variables. I think there's a good chance the result would be accurate enough to at least give a rough idea about the magnitude of a tail emission. We don't need exact data for that, because it's not critical if Bitcoin's supply shrinks a bit. The opposite, that it expands too much, is more of a danger due to the "hard money" paradigm BTC caters to.

Regarding money I could have lost, I also think it should be in the 100$ in 10 years order of magnitude

[reagansimms]

I think the reason he thinks so is because Zcash itself has a different philosophy, Zcash focuses on privacy and monetary policy flexibility. Meanwhile, Bitcoin focuses on “immutability,” a concept that aligns with the fundamental promise that underpins Bitcoin value as absolute scarcity. The 21 million unit maximum limit is very important, its rigid rules make Bitcoin more attractive, if the 21 million limit is changed, confidence in Bitcoin will immediately collapse, the majority of investors hold Bitcoin because they know the supply is final.
The number of 21 million units is not a question of whether it is enough or not, but rather a matter of trust. If today the Bitcoin supply increases to 22 million and tomorrow it could be 25 million, this is what causes Bitcoin to lose its primary value. In my opinion, it is better to be rarer than more numerous, even though the growth is slow, but sure.