Bitcoin Field Notes

Geo Nicolaidis
  • 0.0 (0)
  • Technology

Bitcoin Field Notes is a research podcast for people who want Bitcoin analysis with receipts. Each episode unpacks one question — security budgets, fee markets, mining economics, privacy heuristics — using primary sources, traceable numbers, and falsifiable predictions. No price calls, no tribalism, no hype. Just the economics hiding under the protocol, explained clearly enough to argue with. If you've ever wondered what the data actually says — and where the consensus narrative breaks — start here. New episodes follow the Field Notes newsletter.

Episodes

  1. May 13

    Episode 12: The Block Space Market — Are Bitcoin's New Tenants Paying Enough Rent?

    ============================================================== EPISODE DESCRIPTION ============================================================== Ordinals, BRC-20, Runes, Babylon — every one of them proved Bitcoin's block space has real demand. Every one of them generated dramatic fee spikes. And every one of them collapsed back to baseline within days or weeks. In this episode, Geo Nicolaidis looks at fee revenue the way an investor looks at earnings — not the peaks, but the average Tuesday in March — and asks whether the new tenants are paying enough rent to keep the building standing. ============================================================== SHOW NOTES ============================================================== In Issue 11 we walked through the mechanics of Ordinals, BRC-20, and Runes. This episode asks the harder question: does any of that demand actually solve the security budget problem from Issue 9? Spoiler — as of March 2026, fees are still at roughly $300,000 per day, less than 1% of miner revenue, and the 2028 halving is coming. What we cover: • Every major fee event since Ordinals launched — and critically, what happened after each spike - Jan 2023: Ordinals launch, 50% block space consumed, fees barely moved - May 2023: BRC-20 mania — fees first exceeded the subsidy since 2017, 465K mempool backlog, collapsed within weeks - Dec 2023: Ordinals peak, 245 sats/byte, slow burn for a month - Apr 2024: Runes + halving day — $80M daily fees ATH, 98% decline in 8 days - Aug 2024: Babylon staking — 9.52 BTC per block fee spike lasting hours - Late 2024–2026: the floor collapses and stays collapsed • Block space as a market: Huberman, Leshno & Moallemi's "Monopoly Without a Monopolist" and why fees only exist when supply meets real congestion • The three types of demand — payments (stable, modest), inscriptions/tokens (spiky, event-driven), staking/protocol (brief, intense) — and why only one of them looks like a business model • Roughgarden on transaction fee mechanism design, and why Bitcoin's first-price auction has no revenue floor the way Ethereum's EIP-1559 does (2.6M ETH burned in year one) The sustainability test, with numbers: • Current state: $33–34M daily miner revenue, 1% from fees • 2028 halving math: fees need to grow ~55x at $74K BTC, ~37x at $100K • 2032 halving math: fees need to grow ~80x from today's baseline • The three problems with relying on price appreciation: it's not a mechanism, the attack-cost-to-secured-value ratio degrades, and 2032 is brutal The Layer 2 paradox revisited: Lightning reduces L1 fee pressure exactly when inscriptions are trying to increase it. Volatility is almost as bad as low revenue when miners need to make capital allocation decisions for ASICs and power contracts. Where I might be wrong: • Price appreciation has worked 4 halvings in a row • BitVM, institutional settlement, and ETF flows could create structural L1 demand • Ordinals today could be Ethereum NFTs in 2020 — a trough before maturation • The solution is probably hybrid: price + spikes + gradual baseline growth Key takeaway: The data does not support confidence that fees will replace the subsidy on schedule. It also does not support confidence that the system will fail. The uncertainty itself is the finding — and for a $1.4 trillion network, that's not a comfortable place to be. ============================================================== LINKS ============================================================== Read the full essay on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    28 min

  2. Apr 29

    Episode 11: The New Tenants — Ordinals, BRC-20, and Runes

    EPISODE DESCRIPTION In the middle of Bitcoin's documented security budget crisis, something unexpected happened: people started paying unprecedented amounts in transaction fees for images, JSON tokens, and protocols Satoshi never designed for. This episode explores how Ordinals, BRC-20, and Runes work — and whether the fee spikes they generate can sustain Bitcoin's mining revenue long-term. SHOW NOTES What we cover: • Ordinals: Casey Rodarmor's January 2023 invention to uniquely identify and track every satoshi as a distinguishable asset via sequential numbering, creating six rarity tiers from common through mythic • Why Ordinals are purely a Schelling point — a social convention rather than a protocol change. Bitcoin nodes don't know ordinal numbers exist; value derives entirely from collective agreement • Inscriptions: the technical mechanism that embeds arbitrary data (images, text, video) in Bitcoin's witness data, exploiting SegWit's four-to-one discount and Taproot's removed size limits • The unintended consequences: block size jumped 47-75 percent (1.2 MB to 1.7-2.5 MB), inscriptions drove 60 percent of block space at peak, and Taproot adoption became dominated by JPEGs instead of privacy features • BRC-20 tokens: Domo's JSON-based fungible token standard that requires two transactions to move tokens (vs. one for payments), creates permanent UTXO bloat, and depends entirely on off-chain indexers with no on-chain dispute resolution • The speed of adoption: BRC-20 market cap hit 991 million dollars in under two months (May 2023); fees surged to 16-29 dollars and mempool backlog exceeded 469,000 transactions • UTXO set explosion: BRC-20 drove growth from 86 million to 140 million UTXO entries; by mid-2025, 30 percent of all UTXOs were inscription-linked, and chainstate database exceeded 11 gigabytes • Fee externalities: inscription transactions individually carry lower fees than payment transactions in the same block, but their presence reduces available space and forces payments to bid higher • Runes: Rodarmor's April 2024 response to BRC-20 damage, using OP_RETURN for data (which can be pruned) instead of witness data, reducing transaction requirements to one instead of two or three • The Runes halving-day launch generated Bitcoin's most dramatic fee spike: 127 dollars average, 2.4 million dollars in a single block, 1,805 satoshis per vbyte median • Pattern recognition: dramatic fee spikes (May 2023 for BRC-20, April 2024 for Runes) followed by rapid normalization — but whether this reflects speculative froth or structural demand remains open The developer schism: • Luke Dashjr proposed filtering inscriptions as an exploit of SegWit's witness discount, but miners rejected filtering that removes fee-paying transactions (January 2024) • The 80-byte OP_RETURN limit debate (April-June 2025) led to increasing the limit to 4 megabytes, because the old limit was causing worse UTXO bloat via fake spendable outputs • Bitcoin Core's node share dropped from 98 percent to 88 percent after the OP_RETURN increase; Bitcoin Knots grew to 5 percent • The contradiction: academic research shows Bitcoin's fee market requires congestion, but developers alarmed about the security budget gap are often the same ones wanting to filter high-fee transactions The unresolved question: Do 135 million dollars in Runes fees represent genuine revenue that compounds into miner income, or speculative spikes that normalize within weeks? This determines whether the new tenants are paying sustainable rent on Bitcoin's security infrastructure. LINKS Read the full essay on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    18 min

  3. Apr 29

    Episode 10: Energy Wars — When AI Outbids Bitcoin for Electricity

    EPISODE DESCRIPTION Bitcoin's theoretical security budget problem meets real-world energy economics as AI data centers systematically outbid Bitcoin miners for the same electricity. This episode traces the displacement happening across hashrate, geography, and centralization — and what it reveals about Bitcoin's actual security model. SHOW NOTES What we cover: • The revenue shock: Galaxy Digital leasing 133 MW to CoreWeave for 300 million dollars per year, versus 22 million from Bitcoin mining — a 10x increase in revenue per megawatt • Sector-wide pivot: 65 billion dollars in announced AI/high-performance computing contracts by late 2025, including Core Scientific (8 billion), Hut 8 (7 billion with Google backing), and Crusoe Energy's complete exit from mining • Energy consumption scale: 415 terawatt-hours in 2024, projected 945 by 2030; AI surpassed Bitcoin mining in energy consumption in 2025 • The buyer-of-last-resort framework: Bitcoin mining works as flexible load for intermittent, remote, low-quality power; AI data centers need uninterrupted baseload power and cannot flex • Riot Platforms' evidence: earned more from grid curtailment credits during Texas heat waves than from mining itself that month • Dual-use model attempts: IREN designing facilities for dynamic load shifting between Bitcoin and NVIDIA GPU workloads, but generalization remains unclear • Geographic migration patterns: Ethiopia (2.5 percent hashrate, 55 million dollars in 2024 mining revenue), Paraguay (4 percent hashrate, 3 dollars per MWh costs), Africa broadly at 3 percent hashrate via renewables • The clean energy narrative caveat: Bitcoin's renewable share dropped from 41.6 percent (pre-China ban) to 25 percent, recovered to 52 percent, but mining chases cost, not climate impact • Carbon externality data: coal-powered mining generates 3-7 dollars in external damages per one-dollar Bitcoin price increase — quantifiable cost at the marginal facility • Hashrate paradox: all-time highs (1 zettahash sustained by September 2025) despite institutional miner displacement; new-generation efficient miners in low-cost jurisdictions replaced exits faster than they occurred • Economics breakdown: all-in mining costs hit 138,000 dollars per BTC (early 2026), while BTC traded 90,000-110,000; hardware payback periods exceeded 1,200 days (vs. 300-500 historically); only capital-efficient operators with stranded energy remain viable • Concentration trend: hashrate at records, but industry producing it is narrower and more concentrated than ever The security model stress test: • Hashrate-based attack cost (6 billion dollars) assumes hardware acquisition, but ignores pool concentration • Foundry USA (34 percent) plus AntPool (18 percent) = 51 percent; six pools control 95+ percent of all blocks • Pool operators control block template and transaction inclusion — coordination or compromise requires no hardware acquisition • Selfish mining profitable at 33 percent; Foundry USA crosses this alone • Geopolitical risk: AntPool (Bitmain) operates from Singapore but Chinese-origin; second-largest pool governed by entity with ties to jurisdiction that banned mining • Hardware monopoly: Bitmain manufactures 82 percent of ASICs globally — vertical integration of chip fabrication, pool operation, and geopolitical leverage in one entity The open question: Whether mining-to-AI pivot is durable depends on AI demand trajectory. Goldman Sachs projects supply-demand balance around 2027; 65 billion dollar contracts are typically 10-15 year commitments that don't convert back to mining easily. Stranded-energy miners may emerge more distributed and resilient, but concentration risk increases. LINKS Read the full essay on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    13 min

  4. Apr 28

    Episode 9: The Security Budget Cliff — Why Bitcoin's Mining Revenue is Disappearing on Schedule

    BITCOIN HEURISTICS — FIELD NOTES Episode 9: The Security Budget Cliff — Why Bitcoin's Mining Revenue is Disappearing on Schedule EPISODE DESCRIPTION ================================================ Bitcoin's block subsidy halves every four years on a fixed schedule. The protocol assumes transaction fees will replace this declining revenue to fund security. Academic research — from Princeton, Duke, and the world's top economics journals — says this assumption may not hold. This episode explores the mathematics and the stakes. SHOW NOTES ================================================= What we cover: • Bitcoin's two revenue sources: block subsidy (currently 3.125 BTC, declining deterministically) and transaction fees (currently 1-2% of miner revenue) • The halving schedule: 50 BTC (genesis) → 25 → 12.5 → 6.25 → 3.125 (2020) → 1.5625 (2028) → 0.78 (2032) → 0.39 (2036) • Current mining economics: 30-50 million dollars per day from subsidy; 1-2 million from fees; the design intent is clear, but the execution bet is unproven • Carlsten et al. (Princeton, 2016): in a pure-fee economy, miners can profitably fork at high-fee blocks to incentivize competition rather than consensus; "undesirable security properties" • Eric Budish (QJE, 2024): proof-of-work security requires miner revenue proportional to transaction value being secured. To secure gold's market cap (18 trillion dollars), Bitcoin would need hundreds of billions per year in mining spend — not currently possible • The arithmetic trap: to replace current subsidy at today's throughput, each transaction needs to pay 72 dollars — not realistic. 500 transactions per second at current prices might work, but scaling success undermines fees • The scaling paradox: Bitcoin that successfully scales (millions TPS, no congestion) may kill the congestion-dependent fee market that funds security • Tim Roughgarden's insight: optimal fee markets require fees to burn (like Ethereum base-fee), not pay miners — suggesting that well-designed fee systems might worsen security economics • Attack cost scale: 6 billion dollars for one-week 51% attack (0.4% of market cap) — adequate now, but declining in real terms • Critical windows: 2028 and 2032, when subsidy halves again. By 2032, maintaining today's security spending requires 50+ dollars per transaction • Three counterarguments and their status: (1) unpredicted fee demand like Ordinals/Runes might sustain the market, (2) Bitcoin price appreciation could compensate (historically true, but price-dependent), (3) Peter Todd's permanent small block reward (elegant but consensus-resistant) • The academic consensus: Budish (Quarterly Journal of Economics), Carlsten (major cryptography conferences), Review of Economic Studies all identify this as real and structural — not theoretical hand-wringing The thermostat analogy: Difficulty adjustment converts energy into security without creating extra coins. But thermostats need fuel. Block subsidy is the fuel, declining on schedule. Transaction fees are meant to replace it, but academic literature says "maybe, with serious caveats." LINKS ================================================ Read the full essay on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    8 min

  5. Apr 21

    Episode 8: Energy, Scarcity, and the Difficulty Adjustment—What Happens When Energy Is Free?

    Bitcoin's Thermostat: A Dyson Sphere Mines the Same 450 BTC/Day Popular narrative: Bitcoin converts energy into money—fiat leaks to inflation, Bitcoin preserves value via real energy. Physically wrong. Bitcoins are ledger entries; SHA-256 dissipates electricity irreversibly as heat. Zero energy stored. The real mechanism: the difficulty adjustment decouples energy input from monetary output. Snapshot (early 2026). April 2024 halving cut rewards to 3.125 BTC/block (~450/day). Production cost averages $77–92K/BTC with huge spread—largest miners $33.7K, median $49K, subsidized regions $1.3K, Europe $300K+. Energy = 60–80% of opex; each ¢/kWh shifts cost ~$18K/BTC. Despite revenue halving, hashrate doubled from 505 EH/s to 1,000+ EH/s, hitting 1 ZH on 4 Apr 2025. Top 2 pools = 50–55% of blocks (60–70% with proxies), top 6 = 96–99%. Three Chinese firms make 99%+ of ASICs (one = 82%); advanced chips fab at one of two Taiwan/Korea sites. Mechanism. Every 2,016 blocks: difficulty = old × (actual/14 days), clamped at 4×. More energy = more security, never more coins. China ban (May–Jul 2021) tested it: hashrate fell ~50%, difficulty ~28% over epochs, never hit the clamp. Block production has never meaningfully deviated from 144/day across ~10^21 hashrate growth since 2009. Weaknesses. Lucas Critique: backward-looking adjustment becomes dynamically unstable when reward-elasticity of hash supply >1—approached but not crossed in Nov 2018. Timewarp attack (~2011): 51% miner can collapse difficulty to ~1 in 38 days via timestamp manipulation; unpatched. Top two pools already exceed the 33% selfish-mining threshold. Energy-as-value is wrong; unforgeable costliness is defensible. Saylor/Musk's "stored labor" fails thermodynamically. Szabo's framing—money needs production costs that are high, verifiable, uncheatable (Bit Gold, "Shelling Out"; root: Back's Hashcash)—is coherent but never peer-reviewed. Empirics: gold (1981–2013) causality runs price→cost, and Bitcoin follows suit. Top-journal work finds crypto returns load on network factors (addresses, active users), not production factors. Cost-of-production describes pricing, not value. Aluminum analogy breaks. Pre-1886 aluminum was rarer than gold; electrolytic reduction + cheap electricity crashed prices ~94% by 1894. Every energy-intensive commodity shows elastic supply. Bitcoin's supply is perfectly inelastic by protocol—cheaper energy yields more security, identical coins. Inelasticity alone doesn't guarantee value: silver lost its monetary premium post-1873; NFTs (supply=1) saw volume collapse 95% in 2022–2023. Stock-to-flow ~119, ~2× gold. Dyson sphere. 3.8×10^26 W vs. humanity's 18–20 TW (~20 trillion×); could power ~22 quadrillion Bitcoin networks. Outcome: difficulty adjusts astronomically, 450 BTC/day unchanged, security becomes impervious to anything short of another Dyson sphere. Under energy abundance, binding constraints shift to (1) miner revenue (subsidy + fees × price), (2) fab capacity (TSMC dominates 3nm, $20–40B and 3–5 years per fab; gallium bottleneck in one country), (3) the difficulty adjustment itself. Waste-heat radiation becomes the civilizational ceiling. Caveats. Timewarp unpatched; "no entity >50%" already strained. Peer-reviewed work: ~33% of BTC held by non-transactors, volatility ~10× fiat—arguably speculative, not yet money. Censorship resistance drives advocacy but has almost no rigorous academic treatment. Takeaway. Bitcoin's value doesn't require expensive energy—it requires the difficulty adjustment making energy irrelevant to supply. Energy buys security, not value. Value comes from scarcity, network effects, censorship resistance. Next: what happens when the revenue funding that security starts disappearing. Links: https://geonicolaidis.substack.com · https://geonicolaidis.com · https://linkedin.com/in/geo-nicolaidis/ Hosted by Geo Nicolaidis

    30 min

  6. Apr 21

    Episode 7: The Economic Privacy Floor

    EPISODE DESCRIPTION Bitcoin advocacy focuses on technical privacy solutions—CoinJoin, atomic swaps, confidential transactions. But most users will never adopt them. Meanwhile, the actual privacy that protects ordinary Bitcoin transactions has almost nothing to do with cryptography. It's economic. When the cost of forensic analysis exceeds the value of the information produced, the heuristics become economically pointless. Geo examines why the economic privacy floor explains more about real-world Bitcoin privacy than any cryptographic technique—and what happens when tools get cheaper and smarter. SHOW NOTES What we cover: • The concept of the economic privacy floor: analysis can be technically possible but economically pointless. If it costs $50,000 in analyst time to trace a $100 transaction, nobody bothers. • Scale matters. Forensic investigation into a real theft (100 BTC) justifies weeks of analyst time. A trace on 0.01 BTC gets zero attention. This isn't a designed privacy feature—it's de facto privacy for the vast majority of transactions. • Fragmentation as a privacy lever: split 1 BTC across 50 transactions into 50 small UTXOs. Heuristics still work at each individual hop (CIOH, change detection, taint propagation), but the analyst now has 50 paths to follow instead of 1. The tree of possibilities expands exponentially. Budget runs out before reaching terminal nodes. • Privacy through economics beats technical solutions for ordinary users: - CoinJoin: requires specific software, costs fees, still fingerprint-able - Lightning: requires channel management and liquidity - Atomic swaps: complex, rarely used - Confidential transactions: sidechain-only, limited adoption - Meanwhile: every wallet already fragments through normal change creation and multi-address receiving • The real question isn't whether you're traceable—you are. The question is whether anyone will spend money to trace you. For most users, the answer is no. • The gap between automated scoring and manual investigation: Risk platforms say "3% exposure to high-risk sources" but don't report whether that would survive detailed forensic scrutiny. In most cases, nobody verifies. • Forensic accuracy is resource-dependent, not method-dependent. FBI investigating a $100M hack produces accurate traces. Automated compliance scan on a $500 deposit produces loose approximations. Same blockchain, same heuristics, different outcomes due to budget. • Privacy as spectrum, not binary: Fragmenting across 100 UTXOs isn't cryptographic privacy—it's raising the cost of analysis to levels most adversaries won't tolerate. • Who gets investigated? Enforcement becomes literal: large amounts get traced, small amounts don't. This creates undetectable small-value money laundering, not for technical reasons but economic ones. The counterargument: Automation is improving. ML models traverse graphs faster. Computing costs drop. What's impractical today could be trivial in five years. The countervailing force: The Bitcoin transaction graph also grows. More transactions, more addresses, more branching paths. Graph complexity increases costs simultaneously with automation decreasing them. The empirical question: Which force—tool improvement or graph growth—wins over time? For small-value transactions, combinatorial path growth may make exhaustive analysis impractical regardless of automation. Open questions: • How much does machine learning improve over rule-based heuristics in practice? • Does graph growth outpace automation improvements? • What's the crossover point where automated analysis stops being reliable? • Can we build forensic tools that are honest about resource constraints? LINKS More from Geo: • Substack: https://geonicolaidis.substack.com • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ 🎙 Hosted by Geo Nicolaidis

    12 min

  7. Apr 15

    Episode 6: Change Address Detection

    Bitcoin's ledger is transparent, but it's also ambiguous. Every transaction where you spend more than you send creates a puzzle: which output is the payment, and which is the change? Change address detection is the second-most critical heuristic in forensic analysis—after Common Input Ownership. Get it wrong, and your trace goes sideways. In this episode, Geo walks through the six major heuristics used to identify change, a practical five-step workflow for applying them, and the real-world scenarios where they catastrophically fail. SHOW NOTES What we cover: • The fundamental challenge: Bitcoin doesn't label outputs as "payment" or "change." Both look identical on-chain. Misidentifying which is which means following the money backward instead of forward. • Six change detection heuristics and their individual limitations: 1. Address type matching — relies on wallet developers keeping consistent patterns across SegWit, native SegWit, Taproot transitions (increasingly unreliable) 2. Value heuristics — assumes change is the larger output (fails for wallet consolidation and large payments) 3. Round number analysis — assumes payments are round amounts, change is fractional (fails for automated systems) 4. Address reuse — assumes change goes to fresh addresses (inverts when recipients provide new addresses) 5. Spending behavior — post-hoc; assumes change is spent sooner (can't help real-time analysis) 6. The optimal change heuristic — assumes change is smaller than any input (strongest theoretical basis, but fails on single-input transactions) • A five-step practical workflow for applying these heuristics: 1. Classify the transaction structure first (single-input/two-output is the classic case; multi-output is harder) 2. Apply heuristics in priority order, scoring rather than trusting any single one 3. Aggregate scores across signals instead of relying on one definitive heuristic 4. Cross-validate against clustering data and known entities 5. Propagate errors carefully—misidentified change at hop three compounds through a fifteen-hop trace Where change detection breaks down: • Wallet heterogeneity — dozens of implementations, each with different change behaviors. No universal pattern. • Taproot adoption — as more wallets use Taproot for both sending and receiving, address type matching becomes useless • Deliberate heuristic evasion — privacy-aware users can invert all signals (round change, mismatched types, delayed spending) • Batch transactions — exchanges with fifty+ outputs per transaction; identifying the single change output becomes unreliable • No-change transactions — when a wallet has an exact UTXO, change detection misidentifies the sole output as change, reversing the trace direction entirely • Intra-wallet transfers — consolidations where every output belongs to the same entity; two-party transaction heuristics don't apply Open questions for the field: • How much is Taproot adoption actually reducing heuristic reliability? • Can machine learning models outperform rule-based heuristics? • How do change detection errors and CIOH clustering errors interact? • How do we get ground truth for validation without compromising user privacy? Key takeaway: Change detection determines whether your trace goes forward to the recipient or backward to the sender. When heuristics degrade—either through wallet evolution or deliberate evasion—forensic costs increase. And increased forensic costs have policy consequences. If on-chain analysis becomes harder, regulators may push for mandatory identity disclosure at the protocol level rather than relying on after-the-fact chain analysis. LINKS More from Geo: • Substack: https://geonicolaidis.substack.com • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ 🎙 Hosted by Geo Nicolaidis

    17 min

  8. Apr 14

    Episode 5: Blockchain Transparency and AI Interpretability

    SHOW NOTES Both blockchain forensics and AI interpretability promise transparency but deliver something more fragile: data you can see, but meaning you can only approximate through heuristics. This episode explores what that convergence reveals about building tools people can trust. The transparency paradox: • Blockchain is "transparent" but a list of transactions tells you nothing about intent, identity, or structure without heuristic interpretation • Neural networks have fully inspectable weights but those weights don't reveal reasoning or decision-making without mechanistic interpretability • Both systems are "opaque in the sense that the data's meaning is not self-evident" • Interpretation requires assumptions, and assumptions can be wrong How blockchain forensics and mechanistic interpretability mirror each other: • Blockchain: cluster addresses into entities; AI: identify circuits (groups of neurons performing recognizable functions) • Blockchain: use heuristics like Common Input Ownership, change address detection, timing analysis; AI: identify features, directions, circuits • Both: work until they don't; both: the question is always how do you know when they've stopped working? • Both: when researchers identify patterns, the temptation is to treat findings as ground truth, but edge cases reveal fragility The arms race dynamic (both fields): • Blockchain: every time analysts develop a clustering method, privacy advocates develop countermeasures (CoinJoin, atomic swaps, chain-hopping) • AI: adversarial attacks, jailbreaks, prompt injections probe model interpretations and reveal fragility • In both: treating failures as information (not embarrassments) drives better methodology • CoinJoin forced blockchain analysts toward probabilistic confidence scoring; adversarial examples push interpretability research toward more robust theories "The lesson from blockchain is that the scrambling phase is inevitable. And it's much less painful if you've been honest about your confidence levels from the start." Universal questions for building trustworthy tools: • What assumptions am I making? • How would I know if they were wrong? • What happens to people relying on my tool if my assumptions fail? Blockchain example: wrong assumptions = innocent people flagged for money laundering AI example: wrong assumptions = thinking a model is safe when it isn't Stakes differ; methodology for avoiding failure shouldn't. Key takeaway: Blockchain forensics and AI interpretability are epistemologically identical challenges: validating interpretations of systems too complex to fully understand, communicating uncertainty to stakeholders who want certainty, and building responsibly on imperfect methods. Success requires methodological rigor, honest confidence reporting, empirical testing of heuristics, and treating adversarial failures as information rather than embarrassments. The industry must prioritize transparency about limitations over false precision. Open questions for both fields: • How do you validate interpretations of systems too complex for complete understanding? • How do you communicate uncertainty to stakeholders demanding definitive answers? • How do you build responsibly on methods you know are imperfect? • What governance structures ensure adversarial feedback improves rather than just bypasses systems? LINKS Read more on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    12 min

  9. Apr 11

    Episode 4: Taint Analysis

    SHOW NOTES Taint analysis is the quantitative framework that determines whether funds are frozen, whether a transaction is flagged, and ultimately which assets get recovered in investigations. But it's also one of the most misunderstood methodologies in blockchain forensics. What we cover: • The three dominant taint models and their formulas: 1. Poison model: any input with any taint > 0 means output is 100% tainted (binary, conservative) 2. Haircut/pro-rata model: output taint = (sum of tainted input values × taint %) / total input value (proportional dilution) 3. FIFO (First-In-First-Out): temporal ordering of UTXOs by confirmation time, with sequential spending (accounting convention) • Concrete examples showing how one transaction gets different taint scores: - 3.0 BTC clean + 2.0 BTC fully tainted = 5.0 BTC output • Poison: 100% taint • Haircut: 40% taint • FIFO: depends on wallet spending order - That 5.0 BTC mixes with 5.0 BTC clean = 10.0 BTC • Poison: still 100% • Haircut: dilutes to 20% • Industry-accepted compliance thresholds (not regulated, but observed): - 100%: direct association (immediate sanctioned outputs) - >50%: high confidence suspicious (triggers enhanced due diligence) - 5-25%: elevated risk (manual review) - 1%: de minimis (commercially reasonable) • Why regulatory uncertainty matters: FATF and FinCEN don't specify numerical thresholds; institutions set their own policies; tools like Chainalysis and Elliptic may report different scores for identical transactions • Real-world context: Bybit hack ($1.5B, February 2025) using flood-the-zone laundering; Tornado Cash sanctions lifted (March 2025) after courts ruled OFAC can't sanction immutable smart contracts Where taint analysis breaks down: • Mixing service ambiguity: centralized mixers with temporal delays and pool balances create mathematical indeterminacy • CoinJoin violations of CIOH: equal-value outputs make input-output mapping undefined • Exchange integration: high-volume exchanges naturally dilute taint through legitimate trading volume • Dust and fractional splits: 1 BTC split into 100 × 0.01 BTC outputs reduces individual taint significantly • Cross-chain bridges: Bridges act as de facto mixers; no unified single-chain taint model works across ecosystems • Temporal decay: older transactions arguably carry less compliance risk than recent ones, but no standard decay function exists Emerging research directions: • Temporal decay models weighting historical associations less than recent activity • Cross-chain attribution tracking taint across Bitcoin, Ethereum, wrapped tokens, atomic swaps • Machine learning change detection to improve heuristic reliability • Probabilistic confidence scoring instead of binary labels Key takeaway: No single taint model is universally correct. Poison models overstate contamination and can mark large portions of Bitcoin supply as tainted through transitive contamination. Haircut models may understate risk in early transactions. FIFO applies accounting conventions not technically enforced by the Bitcoin protocol. The model you choose depends on regulatory context and investigative goals. Responsible practice requires documenting which model was used, explaining the choice, and presenting results with appropriate confidence levels rather than false precision. Open question: Should the industry converge on a standard taint model for jurisdictional consistency, or does model diversity serve as a check against overstated contamination? LINKS Read more on Substack: https://open.substack.com/pub/geonicolaidis/p/issue-4-taint-analysis?r=561mq7&utm_campaign=post&utm_medium=podcast More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    17 min

  10. Apr 9

    Episode 3: Peel Chains

    In research across 900+ days of Bitcoin transaction data, one pattern showed up in 33% of traced laundering flows — more than CoinJoin mixing, more than exchange deposits, more than anything else. It's called the peel chain. And it also appears in countless legitimate transactions every day. In this episode, Geo Nicolaidis breaks down what a peel chain actually is, how to detect one, and — more importantly — where that detection breaks down. SHOW NOTES The peel chain is deceptively simple: one input, two outputs, most of the value flows one way, a small amount gets peeled off. Repeat fifteen, twenty, fifty times. It's the single most common pattern in Bitcoin laundering — and one of the easiest to mistake for ordinary wallet behavior. What we cover: • A precise definition of the peel chain pattern — one input, two outputs, asymmetric value split (often 90-10 or 99-1), repeating across three or more consecutive transactions • The academic foundation — Ron & Shamir (2012) on long chains, Meiklejohn et al. (2013) on layering behavior • Why the pattern exists: gradual extraction, unplanned continuation, control retention • The change-output connection — how peel chains exploit standard Bitcoin transaction structure A five-step practical detection workflow: 1. Identify candidate transactions (1-input, 2-output) 2. Calculate output asymmetry (ratio formula, thresholds) 3. Chain traversal (follow the larger output) 4. Analyze termination points (exchange, distribution, mixer, consolidation) 5. Cross-reference with timing (automated vs. human-driven) Where detection breaks down — and why this section matters: • HD wallets and routine payments naturally create peel-chain-like structures • The arbitrary ratio threshold problem — confirmed laundering chains as low as 85-15, legitimate ones above 98-2 • Sophisticated actors deliberately injecting variation and structural noise • Legitimate businesses (payroll, treasury, payment processors) produce identical patterns • Cross-chain escape — bridging to Ethereum mid-chain to break continuity • The chain-length problem — 20+ transaction cold-wallet withdrawals as security practice • Privacy-conscious users intentionally mimicking the pattern for plausible deniability A worked example: An 18-transaction chain starting with 10 BTC from a suspected illicit source, averaging 95.2% asymmetry over 6 days, terminating at a known exchange cluster. What we can conclude — and, crucially, what we still can't. Open questions: • What combination of chain length, asymmetry, and timing maximizes true positives while minimizing false positives? • Can heuristics separate malicious peel chains from coincidental ones? • Should we move from rule-based detection to machine learning? • How should peel chain detection interact with CIOH clustering from episode one? • At what chain length does structural evidence become meaningful on its own? Key takeaway: Peel chains are a powerful investigative signal — not a verdict. The structure exists in both legitimate and illicit transactions. Context matters. Timing matters. Termination points matter. When I see a peel chain, I treat it as the starting question of an investigation, not the answer. LINKS Read the full essay on Substack: https://geonicolaidis.substack.com More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    16 min

  11. Apr 8

    Episode 2: Following Bitcoin Through the Maze

    In Episode 2 of Bitcoin Heuristics — Field Notes, we get into flow tracing: the methodology behind every major crypto investigation you've heard of, from Colonial Pipeline to Silk Road. It's powerful. It's also one of the easiest places in this field to fool yourself. What we cover: • What flow tracing actually is, and why the UTXO model makes Bitcoin feel deceptively easy to follow • The academic foundations — Reid & Harrigan (2011), Ron & Shamir (2012) — and how graph analysis got imported from social science and epidemiology • The three tracing paradigms you need to know: UTXO-based, value-based, and entity-based — and the trade-offs between them • The fungibility problem: why the blockchain literally cannot tell you which Bitcoin ended up where, and why FIFO, pro-rata, and specific identification are all accounting conventions imposed on a system that doesn't support them • A full seven-step practical workflow, refined from real investigations and from building TrailBit's tracing algorithms: 1. Define scope 2. Build the initial graph 3. Filter and prioritize 4. Iterate and analyze 5. Apply taint propagation 6. Resolve entities 7. Document and confidence-score everything Where flow tracing breaks down — and why honest investigators have to say so: • The mixing problem — CoinJoin, Wasabi, Whirlpool, and why tracing "through" a mixer is methodologically indefensible • The exchange black box — why on-chain tracing effectively stops at a deposit address • UTXO consolidation ambiguity • Dust and change heuristic failures (including a case where following the larger output led to the wrong wallet entirely) • The temporal gap problem — funds sitting unspent for years • Cross-chain escape via bridges, wrapped tokens, and atomic swaps • The psychological trap: a clean-looking ten-hop trace is not ten times as certain as a one-hop trace — it may be exponentially less certain A worked example: A compliance team asks for an exposure assessment on a deposit three hops downstream from an OFAC-sanctioned address. We walk through the trace, the peel chain, the distribution pattern, and — most importantly — how to report confidence honestly at each layer instead of handing over a binary tainted-or-not verdict. Open questions for the field: • How should confidence degrade mathematically across hops? Is there a Bayesian framework that fits? • Should the industry standardize taint propagation — and would that just help adversaries? • How do we build unified traces across chains with fundamentally different data structures? • How do we formally integrate temporal signal (inter-transaction intervals, mempool behavior, timezone patterns) into tracing? • What does the privacy-vs-forensics arms race mean for calibrating confidence? • And the big one: How do we meet the Daubert standard when most tracing tools cannot report error rates against ground truth? Key takeaway: Flow tracing determines who gets investigated, whose funds get frozen, and what evidence reaches courts. Getting the methodology right — and being honest about its limits — matters in both directions. Catching actual criminals. And protecting innocent users from false accusations. Use it carefully. Document your assumptions. Be honest about your uncertainty. LINKS Read the full essay on Substack: https://geonicolaidis.substack.com/p/following-bitcoin-through-the-maze More from Geo: • Website: https://geonicolaidis.com/ • LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ • Substack (Bitcoin Heuristics — Field Notes): https://geonicolaidis.substack.com 🎙 Hosted by Geo Nicolaidis

    22 min

  12. Apr 7

    Episode 1: The Common-Input-Ownership Heuristic

    If you've ever read that the FBI "traced" a Bitcoin ransomware payment, you've already trusted the Common-Input-Ownership Heuristic — the single assumption that turned Bitcoin from an opaque transaction graph into a forensic map. It's how the FBI built the case against Ross Ulbricht. It's how the $2.3 million from the Colonial Pipeline attack came back. It's how Chainalysis collapses 184 million Bitcoin addresses down to 40 million "entities." It's also wrong about 63% of the time. This is Episode 1 of Bitcoin Heuristics — Field Notes, the audio companion to my research newsletter. In this episode I unpack the assumption that built the entire blockchain forensics industry: where it came from, why it works, and the specific ways it's being broken right now by privacy tools that didn't exist five years ago. In this episode: • The line in Satoshi's whitepaper that turned out to be one of the few things he got wrong • How Reid & Harrigan (2011) and Sarah Meiklejohn's "A Fistful of Bitcoins" (2013) formalized address clustering — and won the ACM Test-of-Time Award doing it • Why the heuristic hits a 63.46% error rate in controlled simulations, and why that matters for the Daubert standard in court • How CoinJoin (Maxwell, 2013), Wasabi's WabiSabi protocol, and Samourai's Whirlpool deliberately weaponize the heuristic against itself • Why PayJoin (BIP78) is the most elegant attack of all — a transaction that looks completely normal, but silently poisons every cluster an analyst builds from it • Dust attacks, super-clusters, taint dispersion, and the other ways adversaries pollute the data • What this means for the future of Bitcoin forensics: probabilistic confidence scoring, machine-learning change detection, and the end of binary "this address belongs to X" claims If you want Bitcoin analysis with receipts — primary sources, traceable numbers, and a willingness to say where the consensus narrative breaks — this is the show. No price calls. No tribalism. Just the economics and cryptography hiding under the protocol, explained clearly enough to argue with. New episodes follow each issue of the Field Notes newsletter on Substack. ——— SHOW NOTES & LINKS Read the full written issue (with citations and diagrams): https://geonicolaidis.substack.com/p/the-common-input-ownership-heuristic Subscribe to the newsletter on Substack: https://geonicolaidis.substack.com Personal website: https://geonicolaidis.com/ Connect on LinkedIn: https://www.linkedin.com/in/geo-nicolaidis/ ——— KEY SOURCES REFERENCED • Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System • Reid, F. & Harrigan, M. (2011). An Analysis of Anonymity in the Bitcoin System • Meiklejohn, S. et al. (2013). A Fistful of Bitcoins: Characterizing Payments Among Men with No Names • Gong et al. (2022). Empirical error-rate study of clustering heuristics • Maxwell, G. (2013). Original CoinJoin proposal • BIP78 (PayJoin) and BIP77 (Serverless PayJoin v2) • Harrigan, M. & Fretter, C. (2016). The Unreasonable Effectiveness of Address Clustering ——— If this episode was useful, the single most helpful thing you can do is leave a rating and share it with one person who'd argue with me about it. Thanks for listening.

    15 min
  • 12 Episodes

About

Bitcoin Field Notes is a research podcast for people who want Bitcoin analysis with receipts. Each episode unpacks one question — security budgets, fee markets, mining economics, privacy heuristics — using primary sources, traceable numbers, and falsifiable predictions. No price calls, no tribalism, no hype. Just the economics hiding under the protocol, explained clearly enough to argue with. If you've ever wondered what the data actually says — and where the consensus narrative breaks — start here. New episodes follow the Field Notes newsletter.

Information

  • Creator
    Geo Nicolaidis
  • Years Active
    2K
  • Episodes
    12
  • Rating
    Clean
  • Copyright
    © Geo Nicolaidis
  • Show Website
    Bitcoin Field Notes