Claims and Misconceptions

25.1 Claims about SPV

A full node independently validates every transaction and block. If miners produce an invalid block (for example, one that inflates the supply), full nodes reject it. An SPV client sees only the proof-of-work and assumes validity.

Consider the scenario the trust model exposes. Miners controlling a majority of hashrate create an invalid block awarding themselves a 1000 BTC subsidy instead of 3.125 BTC, and continue building on it. Full nodes reject the block; once it is buried in the most-work header chain, SPV clients accept it.

The whitepaper's security claim is conditional: "as long as honest nodes control the network." If majority hashrate is malicious, SPV verification fails entirely, while full nodes continue enforcing the correct rules.

Conclusion. SPV verification is a strict subset of full-node verification (Figure 25.1). An SPV client trusts miners not to produce invalid blocks; a full node detects and rejects them. The equivalence claim holds only under the whitepaper's own hypothesis of honest majority hashrate, and the two models diverge exactly when that hypothesis fails.

Conclusion. Fraud proofs, if deployed, would narrow the gap between SPV and full validation but would not close it: they transform the trust assumption rather than removing it. No general fraud-proof system exists for Bitcoin as of 2026.

25.2 Claims about Scaling

The figure of 7 transactions per second belongs to the claim's own voice; the limit established in Chapter 15 is approximately 3–7 transactions per second depending on transaction mix. The substantive question is what raising the limit costs, and what the alternatives cost.

Conclusion. On-chain throughput grows linearly with block size, and so do the resource requirements of every verifying node; layer-2 designs multiply the number of payments per on-chain transaction while leaving base-layer requirements unchanged (Example 25.1). Larger blocks are one scaling instrument among several, with costs concentrated on verification (Chapter 15); the claim that they are the only instrument does not survive the comparison, even after layer 2 is charged with the costs of Remark 25.5.

The confirmation hypothesis is substantive: sustained majority censorship, or fee conditions under which the commitment transaction cannot confirm within the timelock, violate it. This failure mode motivates anchor outputs and fee-bumping (Chapters 23 and 24). The enforcement, where the hypothesis holds, is cryptographic rather than legal: no court order and no counterparty cooperation is required.

Conclusion. A Lightning balance is a claim on bitcoin locked in an on-chain contract, enforceable unilaterally under the hypothesis of Proposition 25.1. A custodial IOU is enforceable only with the custodian's cooperation: the third party controls the funds and can refuse withdrawal. The comparison fails at the point of enforcement.

The risk is real but bounded. Checking at intervals shorter than the negotiated to_self_delay is sufficient: once per week comfortably covers a 2016-block (2 week) delay. Watchtowers (Chapter 23) delegate the task, at the cost of assuming the watchtower is online and honest.

Conclusion. The liveness requirement is periodic, with period set by the negotiated timelock, not continuous; a watchtower delegates it under an explicit additional assumption. The claim overstates a bounded, negotiable obligation as an absolute one.

25.3 Claims about Cryptography

Conclusion. Published expert estimates for cryptographically relevant quantum machines range from the 2030s to several decades. The mitigations of Remark 25.8 require deployment ahead of that horizon, and already-exposed public keys are the unresolved part of the problem (Chapter 39). The claim compresses a migration problem with known mechanisms and one open sub-problem into a collapse scenario.

SHA-1 was broken after years of published, gradually improving attacks on reduced and then full versions. SHA-256 shows no comparable trajectory.

Conclusion. No attack on full SHA-256 meaningfully better than the generic bounds is known as of early 2026 (Remark 25.9), and the historical pattern of hash-function failure (long public erosion before a break) has not begun for SHA-256. If weaknesses emerged, script-level uses of SHA-256 could be supplemented by soft fork; replacing the proof-of-work or transaction-identifier hash would be a hard fork requiring the coordination of Chapter 16.

25.4 Claims about Consensus

Conclusion. Majority hashrate confers control over the ordering of valid blocks, not over what is valid (Figure 25.3). The capabilities it grants (reorganization, double-spending of the attacker's own coins, censorship) are serious, and Chapter 36 analyzes them further; arbitrary control is not among them.

Conclusion. Miners select and order transactions within rules enforced by the full nodes of the economy. A rule change that economic nodes reject produces blocks those nodes ignore, whatever its hashrate (Proposition 25.2). The 2017 episode (Example 25.2) shows user-side enforcement entering miners' calculations; Chapter 33 treats the governance question in full.

25.5 Claims about Economics

Conclusion. Fee revenue is variable and demand-driven (Example 25.3), and the subsidy declines on a fixed schedule (Chapter 14). The claim asserts as certain an outcome that the analysis of Chapter 38 leaves open in both directions: neither sustained fee-funded security nor its failure is established.

The technical content separates from the normative content. What can be established is the relationship between consumption and security: the cost to attack Bitcoin is approximately the cost of acquiring and powering hardware equivalent to the existing hashrate (Chapter 14). Energy expenditure is not incidental to the security; it is the mechanism that makes block production costly to replicate. A system with the same consumption and no proof-of-work would obtain no security from it, and a proof-of-work system with negligible consumption would be cheap to attack.

Conclusion. The provable part of the claim's subject is the mechanism: attack cost approximates the cost of replicating the honest hashrate, and energy expenditure is how that cost is imposed. The claim's verdict (that the consumption is waste) is a valuation, contested on both sides, and is recorded as such in Remark 25.13.

25.6 Technical Misconceptions

Conclusion. The protocol has no freeze mechanism: nothing in the validation predicate references identity or a blacklist. Imposing one would require either majority-hashrate censorship sustained at visible cost, or a consensus change that the economy accepts (Remark 25.14); the claim, as stated, assumes a capability the protocol does not provide.

Conclusion. A full node enforces the validation predicate for its operator and, when the operator is economically significant, contributes to the aggregate enforcement that disciplines miners (Remark 25.10). The claim confuses the absence of hashrate with the absence of function; validation and block production are different roles (Figure 25.3). The converse overstatement, that every node protects the network, is examined as Claim 25.19.

25.7 Claims from Within the Community

The claims above circulate mostly among Bitcoin's critics. The same instruments apply to claims that circulate among its advocates; the results of earlier chapters settle several of them.

In August 2010 the value-overflow bug let an attacker create 184 billion BTC in one transaction; the chain was rolled back 53 blocks by a coordinated upgrade (Remark 26.8, Example 36.1). In March 2013 an unwritten, environment-dependent rule split the network for 24 blocks (Example 33.7). In July 2015 half the hashrate extended an invalid chain six blocks deep (Example 17.2). (CVE-2018-17144, a 2018 inflation bug found and patched before exploitation, is a further near-miss rather than a failure.)

Conclusion. The precise claim is true and worth stating: the cryptographic primitives of Volume I have never been broken, and no theft has resulted from a protocol flaw that the network declined to fix. The consensus layer, however, has failed at least three times, and each failure was repaired within hours by exactly the social coordination that Claim 25.18 denies. The strong version of the slogan erases the most instructive events in Bitcoin's history.

Definition 15.2 is a rule inside V(C, B) (Definition 13.18), and rules are changeable by the same processes that created them (Chapter 16). What mathematics guarantees is conditional: under the current rules, total issuance is bounded by 20,999,999.9769 BTC. What protects the rules themselves is the coordination game of Section 26.4 and the incentive analysis of Chapter 38: any chain that inflates the cap must win the fork game of Chapter 26 against the entire economic weight of the existing one.

Conclusion. The cap is a rule of the validation predicate, protected by a coordination game, not by mathematics. That protection is of a different kind from a theorem: an equilibrium of Chapter 26's fork game in which every holder is paid to defend the cap. Describing it as mathematical misstates where the security resides: in participants continuing to choose these rules.

Validation is genuinely permissionless and widely distributed; that much the device-tier analysis of Section 34.1 supports. But block template construction is concentrated in a handful of mining pools; maintainer influence over the de facto specification is real (Remark 33.6); the supermajority of nodes run one implementation (Remark 33.13); and most users occupy the custodial rungs of the ladder in Section 34.5, where they verify nothing. Each of these is a measured quantity that moves over time.

Conclusion. Decentralization is a vector of measurable quantities, several of which are measurably concentrated; it is not a boolean property. "Is Bitcoin decentralized?" is not a well-posed question; "decentralized in which dimension, measured how, compared to what?" is—and the answers differ by dimension.

Every transaction is public indefinitely, and addresses cluster: common-input ownership, change detection, and exchange identity links collapse pseudonyms wholesale. The BIP-37 privacy failure (Chapter 18), the engineering effort behind compact filters (Chapter 19), and the Electrum leakage analysis (Section 20.3) are all responses to the fact that the base protocol leaks. A bank record is private from the public and visible to the state; Bitcoin's ledger is the reverse: visible to everyone, deniable to no one, indefinitely.

Conclusion. Bitcoin is pseudonymous with a permanent public record, and its privacy is poor by default; the privacy chapters of this volume exist because of it. Whether the visibility trade is desirable is debatable; that the system is anonymous is false: the analyses of Chapters 18–20 quantify the linkage.

March 2013 is the decisive counterexample: the 0.8-valid chain was abandoned by agreement, with miners deliberately reorganizing onto the chain the buggy software preferred (Example 33.7): human coordination overruling the deployed code's verdict, within hours. Section 33.9 gives the structural reason the slogan cannot be exact: no canonical statement of the rules exists apart from software that humans write, review, ship, and choose to run.

Conclusion. The code's authority is itself a social fact, and the network has overridden the code's verdict when consensus demanded it. The defensible content of the slogan is narrower: no small group can quietly override the rules, because overriding them requires the broad coordination of Chapter 33.

Remark 25.15 established what a node provides its operator: independent verification of the operator's own funds. Network-level effects are real but aggregate: what disciplines miners is the enforcing economic fraction e of Section 34.4 (validation by actors whose acceptance gives coins value), not the raw count of listening nodes, which is cheaply inflatable and economically weightless. One more node behind a home connection changes e by approximately nothing; a merchant, exchange, or payment processor validating independently changes it materially.

Conclusion. A full node primarily protects its operator; network-level power is a property of the aggregate enforcing economy. Both extremes fail (Claim 25.13 in one direction, this claim in the other), and the resolution is the same in both: verification matters in proportion to the economic activity that depends on it.

25.8 A Procedure for Evaluating Claims

The analyses of Sections 25.1 through 25.7 follow a common procedure, which applies equally to claims from critics and from advocates, and to claims not treated in this chapter.