b-money is a digital-money proposal presented by Wei Dai in 1998. It describes two ways of maintaining shared balances and handling contracts between people using digital pseudonyms. It was neither a launched currency nor an earlier version of Bitcoin software. The Bitcoin whitepaper later listed it as its first reference.
Imagine Anna commissions artwork from Peter online. They know only each other’s handles. They want to pay and agree on what happens if someone breaks a promise, without first revealing their identities to a bank or another authority. This interested the Cypherpunks community, which explored privacy through cryptography. Wei Dai responded with b-money in 1998. Here a digital pseudonym was more than a made-up username: it was a public key: information that need not be secret and lets others check a message’s signature. Keeping the real identity hidden also depended on the assumed anonymous communication network. [1] [2]
In our example Anna has a balance of 10 units and wants to send Peter 3. She would publish a transfer message and digitally sign it. This is not a picture of a signature: software calculates it from the message and a private key, information Anna keeps secret. Others can then use the public key to check that the instruction was signed by the holder of the matching private key. Account keepers would check the signature and available balance, subtract 3 from Anna and credit Peter, leaving Anna with 7. This moves no coin file; it changes balance records. The crucial question follows immediately: how can all copies stay consistent if Anna sends conflicting instructions? A signature alone cannot produce that agreement. [1] [5]
The first protocol, or proposed set of rules, has every participant maintain a balance database. To let everyone make the same updates, it assumes an anonymous, synchronous and unjammable broadcast channel. In everyday terms, messages must reach everyone with the required timing, their distribution cannot be blocked, and they must not reveal the sender. That is a much stronger assumption than an ordinary internet connection, where messages are delayed or lost. Dai therefore called this first design impractical himself. It was a starting point for his second design, not a finished network ready to operate. [1] [2]
Balances have to begin somewhere. Dai proposed that anyone could publish a solution to a new computationally demanding problem and receive monetary units. Others would need to assess the work easily, and the solution was to have no further practical or intellectual value. New money would be based on the computation’s cost expressed in a standard basket of commodities: an agreed collection of goods used to compare costs. This resembles Proof of Work, evidence of computational effort, but is not yet Bitcoin block mining. A block is a batch of transactions added to the shared payment history. It also needs a common cost estimate, even though people have computers with different capabilities and costs. [1] [2] [5]
In the second protocol, not everyone needs to maintain the whole ledger. A subset of participants, called servers, would take that role. Anna and Peter would check that their payment was processed with a randomly selected subset of those servers. Because this involves some trust in the operators, each server was to post a monetary deposit that could be used to penalise proven misconduct. Servers would also regularly publish the state of balances and money creation. Users would check their own balances and whether total balances exceeded the money created. These are specific checks on account keepers, not the same arrangement as today’s Bitcoin nodes and miners. [1]
Money was only one part of b-money. Anna and Peter’s commission would have a contract setting conditions and maximum compensation for a breach. The parties and any arbitrator, a person deciding a dispute, would sign and put specified amounts into a special account. After an agreed conclusion, funds would be distributed according to the outcome. The proposal went further: if even arbitration failed, parties would publish arguments and each account keeper would decide compensation or fines independently. This exposes a boundary of the design. A signature can confirm agreement to a contract, but cannot itself decide whether artwork was delivered or guarantee that every account keeper reaches the same judgment. [1] [2]
Dai recognised the difficulty of agreeing on real computation costs. Technology changes, and some participants may have advantages unknown to others. Appendix A therefore proposed an alternative usable in either protocol. Account keepers would first plan how many new units to create. Bidders would then offer a computational problem they would solve for a requested amount of money, perform the computation and publish the solution. Issuance based on accepted bids would follow. These four phases—planning, bidding, computation and creation—were to replace a simple cost estimate. This is neither Bitcoin’s predetermined 21 million limit nor its Halving, the regular halving of the new bitcoins created per block. [1] [3]
Adam Back discussed the proposal in December 1998. Among other things, he pointed to differing computation costs and the ability to link payments made under persistent pseudonyms. Hiding a real name does not itself make payments unlinkable. The original text does include server checks, so it would be inaccurate to say that it ignored dishonesty altogether. It did not, however, provide a complete, practically tested method for keeping every database consistent through failures and disputes. Such situations are part of the distance between a proposal and a working system. Reading the surviving debate alongside the proposal is therefore useful. [1] [3] [7]
On 22 August 2008, Satoshi Nakamoto wrote to Wei Dai saying that Adam Back had pointed him to b-money and asking for its publication year for a citation. Dai replied that he had announced it in 1998. The Bitcoin whitepaper then put b-money first in its references. In another email, dated 10 January 2009, Satoshi announced Bitcoin v0.1 and expressed the view that it met nearly all of b-money’s goals. These are documented contacts and recognition of an earlier idea. They do not establish that Wei Dai wrote Bitcoin, that both designs work alike, or how many individual technical solutions were directly inherited. [4] [5] [6]
b-money is an important stop in the history of ideas, not a currency you can put in a wallet today under this proposal. It was not implemented as the working payment system described here. It had neither Bitcoin’s chain of blocks nor its rule for selecting the valid chain with the greatest accumulated work. Yet it posed a clear question: how can digital signatures, money creation and shared bookkeeping fit together without one bank managing everything? Bitcoin later combined its own answers into a functioning network. b-money is worth reading because it separates the idea of digital money from the harder task of maintaining a shared, verifiable state among people who need not trust one another. [1] [4] [5]
For the clearest picture, read this entry together with Wei Dai, Cypherpunks, Reusable Proofs of Work, Proof of Work, Hashcash, Bit Gold. The reverse links also lead from Cypherpunks, Bit Gold, Wei Dai, The Genesis Book.