The Ledger That Does Something
A vending machine is the most boring contract ever written. You put in a coin, you press a button, and a can of something drops into the tray. Nobody behind the counter checks your money, nobody decides whether you deserve the drink, and nobody can change their mind halfway through. The terms are built into the machine, and the machine carries them out the same way for everyone who walks up to it. Nick Szabo used exactly this example in the 1990s, when he coined the phrase "smart contract": an agreement enforced by the mechanism itself, with no keeper standing between the two parties.
In The Ledger That Costs Something I described how Bitcoin removed the keeper from the ledger. Nobody holds the book, nobody decides which lines are allowed in, and the only way to write a line or rub one out is to spend energy that every node can check. It's a genuine achievement, and it leaves most of finance untouched. A payment is the simplest thing money does. Almost everything else is an agreement: a loan, an escrow, an exchange, an insurance policy, a wage paid on a schedule, a share that pays a dividend. Every one of those comes with its own keeper, a bank or a broker or a clearing house or a court, and Bitcoin, by design, has almost nothing to say about any of them.
In late 2013 a nineteen-year-old programmer called Vitalik Buterin, who had spent the previous two years writing about Bitcoin, published a whitepaper asking the obvious next question. If a ledger can run without a keeper, why stop at balances? Why not put the vending machine on the ledger too, and let anyone write one? The project raised its starting funds in a public sale in 2014, paid for largely in bitcoin, and the network went live on 30 July 2015. It's called Ethereum, and this post is about how it works, what it fixed, and what it traded away to fix it.
Before going further, I should defend something I've said more than once: that in the crypto space, Bitcoin and Ethereum are the only two worth taking seriously. Bitcoin earns its place through maturity. It's the longest-running chain, it has the deepest mining ecosystem and the most conservative codebase, its hashrate is out of reach of anything else built on the same principle, and it has done what nobody expected in 2009 by entering the mainstream: institutional money, spot ETFs, and the energy anchor I spent most of the last post on. Ethereum earns its place through utility. As it stands today it could plausibly carry most of what the existing financial system does, and I suspect we would carry on functioning. Almost everything else in the space is a variation on one of the two, usually trading away security for speed, and usually with a smaller group of people able to change the rules.
Writing that paragraph, though, I can already see the cracks in it, and I'd rather name them now than have you find them later. Every route Bitcoin took into the mainstream runs through a keeper. Around 80% of the bitcoin held by US spot ETFs sits with a single custodian, Coinbase, which also holds the coins for eight of the nine spot Ethereum ETFs. Block production concentrates in a handful of mining pools. The thing that makes Bitcoin worth taking seriously, the fact that institutions take it seriously, is also the door through which the keeper walks back in. Hold onto that, because Ethereum is going to show the same pattern in almost every section below, usually more quickly.
This post is shorter than the Bitcoin one, because a lot of the groundwork is already laid. Hashing, signatures, the hash-linked chain and the idea of proof of work all carry over, and where I lean on them I'll link back rather than explain them twice. The structure is the same. We'll start with what Ethereum added (a ledger that runs programs), then the primitives that differ, then gas, the metering that makes the programs possible. Then the first time the community rewrote history on purpose, the monetary policy, and the move from work to stake, which is where most of my argument lives. After that come the pieces that grew around the chain once it worked (rollups, block builders, stablecoins and wrapped assets) and what will have to change. As before, where the mechanics get dense I've given an intuitive version first and an exact version for anyone who wants it, and nothing later depends on the exact ones.
A Ledger That Runs Programs
Bitcoin's ledger already contains programs, of a sort. Every output is locked by a small script, and in the common case the script says "spendable by whoever can produce a valid signature for this key". Script can do a little more than that: require two signatures out of three, or refuse to release coins before a certain date. What it can't do is loop, and that limitation is deliberate. A program that can't loop always finishes, and every node can check every script in a predictable, bounded amount of time. Satoshi gave Bitcoin a calculator and left it there.
Ethereum gives the ledger a general-purpose computer, the Ethereum Virtual Machine. Anyone can write a program, deploy it to the chain, and from then on it lives at its own address, holding its own balance and its own stored data, waiting to be called. Send it a transaction and every node on the network runs the same code on the same inputs and arrives at the same result, which is what lets thousands of machines that don't trust each other agree on what the program did. The programs are called smart contracts, borrowing Szabo's phrase, and the name oversells them slightly. They're closer to his vending machine: code that holds value and releases it when its conditions are met.
Think about what that does to the keepers I listed in the introduction. An escrow is a third party who holds money until both sides are satisfied; on Ethereum, it's a few dozen lines of code that release the funds when a condition is met, or return them after a deadline. An exchange is a company that matches buyers with sellers and holds both sides' money while it does; on Ethereum, it can be a contract holding two pools of tokens and a formula that prices one against the other. A lender who takes collateral and seizes it if its value falls is, on Ethereum, a contract that watches a price and liquidates automatically. None of these needs anyone at a desk. The rules are published, anybody can read them, and the machine runs them the same way for everyone.
That's the utility I meant when I said Ethereum earned its place, and it's real. It's also the source of every problem in the rest of this post, because a computer that anyone can program is a much larger thing to secure than a ledger of payments, and a program that does exactly what it says is only as good as what it says.
Same Fingerprints, Different Book
A lot of Ethereum will look familiar from the Bitcoin post. Keys live on the same elliptic curve, secp256k1, and signatures work the same way: a private key signs, a public key verifies, and nobody can go from one to the other (the full version is here). Blocks are chained by hashes in the same tamper-evident way. Three things differ, and each matters later.
The first is the hash function. Ethereum uses Keccak-256, the design that won the competition NIST ran to choose SHA-3. NIST tweaked the padding slightly before publishing the final standard, and Ethereum, which had already committed to the original, kept it, so Ethereum's "SHA-3" and the official SHA-3 give different answers for the same input. Here's the word I used in the last post, run through it, next to its SHA-256 fingerprint from Bitcoin:
Valeon Keccak-256 12f6e96535d8d6de9c8a75de5fb0bda66cb2a67b76d90687eaada38a19dd64c7
Valeon SHA-256 401b6cfba9bbb8c34aeaaa90d5c88355f9ff8b28e56b76994917ce274cc5309d
valeon Keccak-256 a4a66f45f313372ec32eb64c25e243f312531fd8c65bb113fedb404bd98b86d4
Different function, same properties. Change the capital V to a lower-case one and 124 of the 256 bits flip, as close to half as makes no difference. Everything I said about fingerprints in the last post holds here.
The second difference is the address. In Bitcoin an address is a hash of the public key, and the key itself only appears when you spend. In Ethereum an address is the last 20 bytes of the Keccak-256 hash of the public key, which sounds similar, and it is, right up until you send your first transaction. Ethereum accounts are meant to be reused. You keep the same address for years, and from the moment it signs anything, its public key can be recovered from the signature and sits on the public ledger for good. Remember that one for the section on quantum computers.
The third difference is the one that changes how everything else works.
There Are Balances
In the Bitcoin post I said the ledger records no balances, only unspent outputs, each consumed whole and replaced by new ones. Ethereum goes back to the way your bank does it. The ledger holds a set of accounts, and each account has a balance that gets edited in place.
There are two kinds of account. An externally owned account is controlled by a private key, the kind you hold in a wallet. A contract account is controlled by its code: it has no private key at all, and the only way to move its funds is to call it and let the code decide. Both kinds have a balance, and both have a nonce, a counter that goes up by one with every transaction an account sends.
The nonce is how Ethereum handles the double spend without outputs. Every transaction carries the sender's next nonce, and the network will only accept a transaction whose nonce is exactly one more than the last. Sign two conflicting transactions with the same nonce and only one of them can ever be included; whichever lands first makes the other invalid. It does the job Bitcoin's outputs do, in a structure that's much easier to build programs on, at the cost of every account's entire history being tied to one public key.
The Exact Version
Every block header in Ethereum commits to more than the transactions in it. It contains a state root, a single 32-byte hash covering the balance, nonce, code and storage of every account on the network at the end of that block. The structure underneath is a Merkle Patricia trie, a cousin of the Merkle tree from the Bitcoin post adapted for a set of keys and values that changes constantly. Change one balance anywhere and the root changes, just as changing one transaction changes a Bitcoin block's Merkle root.
That's a heavier commitment than Bitcoin makes. A Bitcoin node needs the set of unspent outputs; an Ethereum node needs the entire world state, every account and every byte every contract has ever stored, and that state only grows. Keeping it manageable is one of the oldest unsolved problems on Ethereum's roadmap.
Gas
A computer that anyone can program has an obvious weakness. Write a program that never stops, deploy it, call it, and every node on the network is now running your infinite loop. You can't screen these out in advance. Alan Turing proved in 1936 that there's no general method for deciding whether an arbitrary program will ever finish, which is the halting problem, and it applies to the Ethereum Virtual Machine as much as to anything else.
Ethereum's answer is to stop asking. Every operation the machine can perform has a fixed price, measured in a unit called gas. Adding two numbers costs 3 gas. Writing a fresh value into a contract's permanent storage costs more than 20,000. A plain transfer of ETH from one account to another costs exactly 21,000. When you send a transaction, you set a gas limit, the most you're willing to spend, and you pay for whatever is used. If the program runs out of gas before it finishes, everything it did is undone, and you pay for the gas anyway, because the network did the work. An infinite loop on Ethereum is simply a very expensive way of burning your own money.
Blocks have a gas limit too, around 60 million at the moment, which caps how much computation the whole network can be asked to do every 12 seconds. That cap is Ethereum's version of Bitcoin's block size, and the arguments about raising it are Ethereum's version of the block size war.
Notice what gas does to the theme of the last post. In Bitcoin, the cost attaches to writing a line in the ledger: blocks are expensive to produce, and every line inherits that cost. In Ethereum, the cost attaches to every step of every computation, and it's paid in the chain's own currency. You don't just pay to be written down. You pay, step by step, for the network to think on your behalf.
What a Transaction Costs
The fee you pay per unit of gas has two parts, and the split between them is one of the most consequential design decisions Ethereum has made. Since the London upgrade in August 2021, under a proposal called EIP-1559, every block has a base fee per unit of gas, set by the protocol, and senders can add a tip on top. The tip goes to whoever produced the block. The base fee is burned: destroyed, removed from the supply forever.
A plain transfer at a base fee of 1 gwei (a billionth of an ETH) and a tip of 0.1 gwei costs
of which 21,000 gwei is burned and 2,100 gwei is paid to the block producer.
The Exact Version
The base fee adjusts itself every block. The protocol targets blocks that are half full; if a block uses more gas than the target, the next block's base fee rises, and if it uses less, it falls, by at most an eighth either way:
where
which ties the burn directly to how much the chain is used. Hold onto that relationship; it decides whether ETH's supply grows or shrinks, and it's the reason a later upgrade designed to make Ethereum cheaper ended up making it inflationary.
When Code Was Law
In the spring of 2016, less than a year after launch, a group of developers deployed a contract called The DAO, short for decentralised autonomous organisation. It was meant to be a venture fund with no fund manager: people sent in ETH, received tokens in return, and voted on which projects the pooled money should back. It was the vending-machine idea at its most ambitious, and it was enormously popular. Within weeks it held around 12 million ETH, something like a seventh of every ETH in existence.
On 17 June someone found a flaw in its withdrawal function. The contract sent ETH to the person withdrawing before it updated their balance, and the attacker's own contract was written to call back into the withdrawal function the moment the ETH arrived, again and again, each time before the balance changed. The bug is now called re-entrancy, and it's taught as a standard example of how not to write a contract. Before anyone could stop it, about 3.6 million ETH had been drained into a contract the attacker controlled.
Here's the uncomfortable part. The attacker didn't break anything. They called the contract's public functions in a way its authors hadn't anticipated, and the contract did exactly what its code said. If the promise of smart contracts is that the code is the agreement, then by that promise, the attacker was entitled to the money.
The Ethereum community decided otherwise. On 20 July 2016, at block 1,920,000, a hard fork moved the drained ETH, and the rest of The DAO's funds, into a contract from which the original depositors could withdraw. A minority refused to run the new software, on the principle that a ledger whose history can be rewritten when the outcome is unpopular isn't the ledger it claims to be. They carried on with the original chain, and it still exists today as Ethereum Classic. The fork everyone else followed kept the name.
Set that next to the bug I described in the Bitcoin post, the 2010 transaction that created 184 billion bitcoin. That one was also reversed by people choosing to run new software. The difference is what was being enforced. In 2010, the bad block broke Bitcoin's rules, and the fix restored them: the network refused a transaction that should never have been valid. In 2016, nothing broke Ethereum's rules. The code ran as written, and the network rewrote the outcome because it disagreed with it.
I don't think the people who forked were wrong to want the money back, and plenty of thoughtful people still argue it was the right call. But it settled, ten years before anyone proposed freezing Satoshi's coins, the question I left open at the end of the Bitcoin post: what happens when the shared agreement behind a ledger is asked to rule on ownership? On Ethereum, it already has. In The Short Circuit I argued that whoever holds the pen never needs to break a rule, because they can simply move it. For one summer, the Ethereum community held the pen, and used it. The keeper was never removed from Ethereum. It was distributed across everyone who chooses which software to run, and in 2016 it woke up.
Mint and Burn
Bitcoin's supply is a formula published in 2009 that nobody has ever changed. Ethereum's is a policy, and it has been changed several times.
It started with an allocation. At launch, about 72 million ETH existed: roughly 60 million sold in the 2014 public sale, and around 12 million set aside for the Ethereum Foundation and the people who built it. Bitcoin had no equivalent. The closest thing is the 1.1 million or so coins attributed to Satoshi from the early months of mining, when almost nobody else was competing for them, which is an informal allocation of its own, though it had to be mined like everyone else's. After launch, new ETH came from mining, at 5 ETH a block, cut to 3 in 2017 and to 2 in 2019, each cut agreed and activated by hard fork. There has never been a cap.
Then came the burn. From August 2021, the base fee from every transaction was destroyed, so ETH had, for the first time, a mint and a burn running at once. A year later the Merge replaced mining rewards with staking rewards, cutting issuance by around 90% overnight. For a while the burn outran the mint. During busy stretches of 2022 and 2023 the total supply of ETH actually fell, and a slogan took hold among its holders: Bitcoin was sound money, ETH was "ultrasound money", deflationary by design.
It didn't last. In March 2024 an upgrade called Dencun gave the rollups I'll describe shortly a cheap new place to post their data, and a large share of activity moved off the main chain. Base fees on Ethereum fell by around 90%, the burn collapsed with them, and supply started climbing again. By March 2026 there were about 121.5 million ETH, roughly a million more than at the Merge. That's still a much lower inflation rate than ETH ever had under proof of work. It's just a long way from the slogan.
If this structure sounds familiar, it's because I've described it before. In The Dollar as Token I compared the dollar to a token with a mint (government spending, banks lending deposits into existence) and a burn (taxation), and borrowed EIP-1559 as the analogy because it was the cleanest example of a burn I knew. ETH runs the same architecture with the committee taken out. The mint pays validators, the burn takes a cut of every fee, and the balance between them floats with how much the chain gets used. Nobody sets it in a meeting.
Nobody sets it in a meeting, but the rules that produce it have been rewritten at least four times in ten years, each time by the same process that reversed The DAO: a proposal, an argument, and everyone choosing which software to run. Bitcoin's monetary policy is fixed and its security budget is the problem I left hanging in the last post. Ethereum's security budget is less of a worry, since it rests on the value of the ETH at stake rather than on what block producers earn from fees, and its monetary policy is whatever the community currently agrees it should be.
The Exact Version
The change in supply over any period is the issuance minus the burn:
Under proof of stake, issuance depends on how much ETH is staked. Rewards per validator shrink as more stake joins, but total issuance still rises, roughly with the square root of the stake. A good approximation, with
With a little over 43 million ETH staked by mid-2026, that gives
and a yield, before any tips or fees, of
which matches what stakers were actually earning. For ETH's supply to hold flat, the burn has to match that issuance, which works out at about 3,000 ETH destroyed every day. Since Dencun, it usually hasn't.
From Work to Stake
On 15 September 2022, Ethereum stopped mining. The chain had been secured by proof of work since 2015, by the same lottery of hashes I described in The Ledger That Costs Something, run on graphics cards rather than ASICs. Then, in a single block, it handed its security over to a second chain that had been running alongside it for almost two years. The event is called the Merge. By the Ethereum Foundation's own estimate it cut the network's energy use by more than 99.9%, and every mining rig pointed at Ethereum became, overnight, a very warm piece of furniture.
What replaced the work was money. That's the shortest honest description of proof of stake, and nearly everything that follows is about whether it's enough.
The Intuitive Version
To take part in securing the chain, you lock up 32 ETH in a deposit contract and become a validator. Time is cut into 12-second slots. In each slot one validator, chosen at random and weighted by stake, proposes a block, and committees of other validators vote on it. They're attesting that this is the block they see at the head of the chain. Do your job and you earn a modest yield, paid in newly issued ETH. Go offline and you slowly bleed a little of your deposit.
Lie, and you lose a great deal more. A validator who signs two different blocks for the same slot, or votes for two conflicting versions of history, has produced cryptographic proof of their own dishonesty. Anyone can submit that proof to the chain. The validator is ejected and part of their deposit is destroyed. This is slashing, and it's the whole trick. In Bitcoin, misbehaviour costs you the energy you spent and the reward you didn't get. In Ethereum, misbehaviour costs you the collateral you posted to be allowed to behave at all.
The penalty also scales with company. A validator slashed on its own loses a small slice of its stake. If a large share of validators are slashed in the same few weeks, which is exactly what a coordinated attack looks like, each of them loses proportionally more. If a third of all stake misbehaves together, it loses nearly everything.
The Exact Version
Ethereum's consensus is two mechanisms bolted together, usually called Gasper. The first, LMD-GHOST, is the fork choice: at any moment, a node follows the branch carrying the greatest weight of validators' most recent votes. That plays the role Bitcoin's most-work rule plays, with stake standing in for hashes.
The second, Casper FFG, adds something Bitcoin never had: finality. Every 32 slots (an epoch, 6.4 minutes) there's a checkpoint. When validators holding two-thirds of the stake vote for a checkpoint it becomes justified, and when the next one is justified on top of it the first becomes finalised. That means it can't be reverted without at least a third of all stake provably signing conflicting votes. Finality arrives in about two epochs:
That's slightly longer than one Bitcoin block, and in a different category from Bitcoin's six-confirmation convention. Bitcoin's settlement is probabilistic: each block buries a payment deeper, and none buries it absolutely. Ethereum's is a commitment with a price tag attached. Reverting a finalised block means burning at least a third of everything staked. By the end of June 2026 that was more than 43 million ETH, so:
The correlation penalty is what makes that figure real. Simplified, the amount a slashed validator loses scales with how much else was slashed around the same time:
where
There's a third mechanism for the opposite failure. If more than a third of validators simply go offline, finality stalls, and the protocol starts draining the absent validators' balances, the inactivity leak, until the ones still online hold two-thirds again and the chain can finalise without them.
What It Costs to Rewrite History, Again
Set that next to Bitcoin and the comparison is more interesting than the slogans on either side.
Near the tip of the chain, Ethereum is arguably the more expensive ledger to attack. Rewriting a finalised Ethereum block means burning around fourteen million ETH, irreversibly and on the record. Rewriting six Bitcoin blocks means out-hashing the network for an hour, which is enormously expensive and leaves the attacker owning the hardware afterwards.
Deep history runs the other way. In Bitcoin, every block in the past is defended by every block built on top of it, so history grows more expensive to rewrite the older it gets. In Ethereum, a validator's stake only threatens them while it's still staked. Once validators have withdrawn, their old keys can sign anything, an alternative history branching from years ago, and there's nothing left to slash. This is the long-range attack, and the protocol can't defend against it on its own. The defence is weak subjectivity: a node joining the network for the first time, or returning after a few months away, has to start from a recent checkpoint it got from somewhere it trusts. In practice that's a friend, a block explorer, or the default baked into its client software.
That's a keeper. A small one, mostly honest, and rarely tested. But a Bitcoin node can start from the genesis block with no help from anyone and arrive at the true chain by checking the work. An Ethereum node has to be told where to start. Bitcoin's history costs more to forge the older it gets. Ethereum's costs most at the tip, and further back it depends on somebody telling you which tip is real.
The second difference is where the cost comes from. Energy is bought from outside the system: anyone with a power contract and a pallet of machines can start mining, and the network's security is paid for with something the network doesn't produce. Stake can only be bought from people who already hold ETH, and the yield it earns is paid in ETH, to people who already hold ETH. The security budget circulates among the existing holders. Holders who stake compound; holders who don't are diluted by the issuance that pays them. It's the mint again, flowing first to whoever is already closest to it.
How I Actually Did It
Everything above describes how staking is meant to work. Most of it doesn't work that way. By mid-2026, Lido, a single liquid staking protocol, held about a fifth of all staked ETH, and much of the rest sat with exchanges, custodians and, since March, staked ETH funds. Only a small share is staked by the people who own it, running validators of their own.
I was part of that majority. I staked through Binance in July 2022, two months before the Merge, back when Binance still served UK residents. I never generated a validator key, never chose an operator, never ran a node. I moved ETH into a product page, clicked a button, and watched a number tick upwards. Somewhere behind that page Binance ran the validators, held the keys, and took its cut of the yield. I was trusting a keeper to do the job the protocol had been designed to make keeperless.
And I'd staked into a lock nobody could yet put an end date on. Before the Merge, staked ETH couldn't be withdrawn at all, and the Merge itself didn't change that; withdrawals waited on a later upgrade with no fixed date. What Binance gave me in its place was a receipt, a token called BETH standing in for ETH I could no longer touch, and the receipt I could trade. So I did, for months. In April 2023, the month withdrawals finally opened, I sold it on the market, because by then I needed the money, and the market paid less than the ETH it stood for.
Look at what I was holding in between. The ETH sat in a deposit contract, locked. The thing in my account was Binance's promise to hand it back, made liquid and traded by people who never saw the asset behind it, worth an ETH only as far as the market trusted Binance and guessed how long the lock would last. It's Emma's IOU from The Debt Beneath the Debt in a new wrapper. Lido's stETH does the same job for a fifth of all staked ETH.
That's the cost of stake that rarely gets written down. Proof of work spends energy, which is gone the moment it's spent. Proof of stake keeps your capital and charges you in access instead, and the market's answer to that charge is to put a keeper back in the middle. I never got my ETH back. What I held was a promise, and what I sold was the promise, for a little less than the thing it promised.
Scaling Outward
Every node on Ethereum runs every transaction, which is what makes it trustworthy, and also what makes it small. A block every 12 seconds with a fixed gas budget, shared between everyone on Earth who wants to use it, fills up quickly, and when it does the base fee climbs until most people are priced out. During the busiest stretches of 2021, a single swap on an exchange contract could cost more than a hundred dollars.
The answer Ethereum settled on was to stop trying to fit everything on the main chain. A rollup is a separate chain that executes transactions on its own, bundles thousands of them together, and posts a compressed record of the batch back to Ethereum. Users get cheap transactions on the rollup and inherit, in principle, the security of the chain underneath. There are two ways to convince Ethereum that a batch is honest. An optimistic rollup assumes the batch is valid and gives anyone a window, usually a week, to prove otherwise with a fraud proof. A zero-knowledge rollup attaches a cryptographic validity proof to every batch, a short mathematical certificate that the computation was done correctly, which Ethereum checks directly.
Bitcoin tried something similar first. The Lightning Network, proposed in 2015 and live since 2018, lets two people lock bitcoin into a shared channel and pay each other off-chain as often as they like, settling on Bitcoin only when the channel closes, with payments able to hop across chains of channels to reach people you've never opened one with. Its great strength is that it never hands your coins to a custodian: you can always close the channel and walk away with real bitcoin. In practice it has struggled. You need liquidity on the right side of a channel before you can receive, channels need managing, and a dispute can lock funds for days. In May 2026 the public network held under 5,000 BTC, a rounding error next to the supply. Rollups attack the same problem with a different trade.
The Dencun upgrade in March 2024 gave rollups a cheap, temporary data space on Ethereum called blobs, and their fees dropped to fractions of a cent. It worked. Most of Ethereum's activity now happens on rollups, and that's also why the burn collapsed: the transactions that used to pay base fees on the main chain now pay a rollup operator instead.
Look at who runs a rollup. Almost all of them rely on a single sequencer, a server operated by the company that built the rollup, which receives transactions, puts them in order and posts the batches. It decides what goes in and when. If it goes down, the rollup stops. If it refuses your transaction, your options depend entirely on whether the rollup built an escape route to the main chain and how well it works. Many rollups can also be upgraded, their rules changed, by a small group holding the right keys. Ethereum took the keeper out of the base layer, and the most popular way of using it puts one back on top.
Ethereum's developers have noticed. The next upgrade, Glamsterdam, due later this year, is the first in a while to focus on making the main chain itself carry more, with a target of more than tripling the block gas limit after it activates. Whether the activity comes back from the rollups is another question.
Who Orders the Transactions
In the Bitcoin post I said a 51% attacker could choose the order of valid transactions and nothing more. On Ethereum, choosing the order is worth a great deal on its own, every block, without any attack at all.
Pending transactions sit in a public waiting room before they're included, just as in Bitcoin, and anyone can read them. Suppose you send a large purchase to an exchange contract that prices tokens by a formula. Someone watching the waiting room sees it, buys the same token just before you, lets your purchase push the price up, and sells straight after. You pay more, they pocket the difference, and every step was a valid transaction. That's a sandwich, one of a family of strategies grouped under the name MEV, maximal extractable value: the profit available to whoever controls which transactions go into a block and in what order. It's the problem from The Benchmark Must Bleed in a new form. There, a price could be moved by whoever controlled the quotes. Here, it can be moved by whoever controls the queue.
Extracting MEV well takes specialist software and a lot of capital, and most validators have neither, so the job has been handed off. Since the Merge, almost every validator runs software that outsources the building of its blocks: specialised builders assemble the most profitable block they can, bid for the right to have it proposed, and the validator signs whichever bid is highest, through intermediaries called relays. Around 90% of validators run it. Building concentrated fast. Research covering September 2023 to August 2025 found three builders consistently producing roughly 90% of Ethereum's blocks, and by mid-2026 a single builder was producing around half of them.
That concentration has already been used. When the US Treasury sanctioned the Tornado Cash contracts in August 2022, builders and relays that followed US sanctions began leaving those transactions out, and for a while most of Ethereum's blocks were being built that way. It has eased since, and by September 2026 around a quarter of the blocks built through relays still passed through ones that filter. The validators, thousands of them, never decided to censor anything. A handful of builders and relays decided for them.
Bitcoin has its own version of this in its mining pools, a weakness I left for another day in the last post. Ethereum's is more profitable, more concentrated and more openly acknowledged, and its roadmap includes moves to build the separation into the protocol itself and to let validators force transactions into blocks regardless of what the builders want. Until those ship, the queue has a keeper, and the keeper is whoever bids highest.
What Gets Built on It
Once a chain can run programs, the most popular program turns out to be a token: a contract that keeps its own ledger of who holds how much of something, with a standard interface (ERC-20, settled in Ethereum's first year) so that every wallet and exchange can handle every token the same way. Almost everything people actually do on Ethereum is built from that one idea, and four uses of it matter for where this blog is heading.
The first is the stablecoin. A company holds dollars, or short-term US government debt, in ordinary bank and custody accounts, and issues one token on Ethereum for every dollar it holds. By April 2026 there were about $180 billion of stablecoins on Ethereum, around 60% of all the stablecoins in existence. They're the most used thing on the chain, by a distance. They're also exactly what they look like: a dollar IOU from a company, recorded on a ledger with no keeper, and the company keeps a freeze function in the contract. Issuers have used it on request from law enforcement many times. The most popular asset on the keeperless ledger is a keeper's promise with a freeze button attached.
The second is wrapped bitcoin. Bitcoin can't run Ethereum's programs, so a custodian holds real bitcoin and issues a token on Ethereum for each coin it holds: WBTC, held by BitGo since 2019, and Coinbase's cbBTC since 2024. When WBTC's custody arrangements were restructured in 2024 to include a firm linked to Justin Sun, several large Ethereum applications began reducing their exposure to it, which tells you where the risk was always sitting. Structurally it's my BETH again: a receipt for an asset that can't move, issued by a keeper, and worth the asset only as far as the market trusts the keeper.
The third is tokenised real-world assets: government bonds, money-market funds, shares, property. BlackRock launched a tokenised Treasury fund on Ethereum in 2024, and the idea of putting ownership itself on a ledger is one I sketched for land titles in Land on the Ledger. The token moves on Ethereum. The thing it represents sits with a custodian, under a legal system, the same as before.
The fourth is the newest, and the one I suspect will matter most. Ordinary Ethereum accounts are controlled by a single key, which makes them blunt: whoever has the key can do anything, and nobody else can do anything. Account abstraction, introduced as a standard in 2023 and built into ordinary accounts by the Pectra upgrade in May 2025, lets an account carry its own code. An account can have spending limits, recovery arrangements, someone else paying its fees, and permissions that let a piece of software spend within limits the owner sets. That last one is the plumbing for software that pays for things by itself. In April 2026 an open standard for exactly that, x402, letting AI agents pay for services automatically in stablecoins, gained the backing of Google, OpenAI and Circle under the Linux Foundation.
Put the four side by side and a pattern shows. Ethereum removed the keeper from the agreement, and then the most valuable things placed inside its agreements turned out to be claims on keepers outside it: dollars in a bank, bitcoin in a vault, bonds with a custodian. The vending machine works perfectly. Most of what it dispenses is an IOU.
What Will Have to Change
The Bitcoin post ended its technical half on two threats with very different shapes: a break in the hash function, which would force the hardest upgrade Bitcoin could attempt, and a quantum computer able to derive private keys, which would put every exposed public key at risk. Ethereum faces both, from a very different position.
On the signatures, Ethereum is more exposed. It uses the same elliptic curve, so a machine running Shor's algorithm breaks it the same way, and the account model I described earlier makes key exposure the default. Every account that has ever sent a transaction has its public key on the ledger, and accounts are reused for years by design. A 2026 study put the share of all ETH sitting behind exposed keys at somewhere between 50% and 65%, most defensibly 55–60%, building on an earlier scan by Deloitte that found over 65%. For Bitcoin the comparable figure is around 30%. Ethereum's exposure also runs deeper than user accounts. Validators sign their votes with a different scheme, BLS, and the commitments that make blobs work use another, KZG, and both rest on mathematics a large quantum computer would break.
On the response, Ethereum is better placed, and it isn't close. Account abstraction means an account can, in principle, switch to a new signature scheme without moving its funds anywhere. The Ethereum Foundation set up a dedicated post-quantum team in January 2026, and the Lean Ethereum roadmap published that summer sets out a sequence of upgrades replacing BLS, KZG and eventually user signatures with hash-based schemes, targeting full post-quantum protection by 2029. Vitalik Buterin has also published an emergency plan for the worst case: if a quantum attack were detected, roll the chain back to before it, block transactions from ordinary key-controlled accounts, and let owners recover their funds by proving they know the seed phrase behind the key. Read that again with BIP-361 in mind. It's a freeze, and a rollback, written down in advance.
More generally, Ethereum changes all the time. The Merge in 2022, withdrawals in 2023, blobs in 2024, account abstraction in 2025, a data-availability overhaul last December, and Glamsterdam due before the end of this year. Bitcoin's hardest problem is that changing anything is close to impossible, which is also its defence. Ethereum's is that it can change almost anything, which is how it adds features, fixes mistakes and prepares for quantum computers years ahead of need, and also what makes it the more governed of the two.
Who governs it? There's no vote and no board. Changes are argued out in public, on developer calls and research forums, by a few hundred core developers spread across a handful of independent teams writing the client software, with the Ethereum Foundation funding much of the research and coordinating the schedule. A change happens when the clients ship it and the people running nodes and validators install it. Most of the time this works well, and openly. It's still a small number of people who can move the ruler, and in 2016 they showed what happens when a large enough majority wants it moved.
One more concentration belongs here, because it's the kind that only matters until it suddenly does. Roughly half of the network's execution clients run the same software, Geth. A serious bug in it, of the kind every large codebase eventually has, would at minimum stall finality across the network until it was fixed. Bitcoin's monoculture is in its hardware, and arguably in its code as well, since nearly every Bitcoin node runs the same client. Ethereum has spent years trying to avoid the second kind, and it's still at about half.
A Second Proof of Concept
Bitcoin proved that a ledger can run without a keeper. Ethereum proved that agreements can too: escrows, exchanges, loans and funds that hold real value and pay out by their own rules, running for over a decade on a network nobody owns. Before 2015 nobody had shown that at scale. It also showed, more quickly and more clearly than Bitcoin did, how fast keepers come back through the doors that utility opens.
They came back as a community that rewrote history when the code produced an outcome it didn't like. As a monetary policy that has been changed at least four times by the people who run it. As a security model that, past a few months, needs someone to tell a new node where the chain is. As staking pools and exchanges holding most of the stake on behalf of people like me, and receipts traded at a discount while the real thing sat locked. As sequencers that can pause a rollup, builders that decide what goes into a block, and relays that decided, for a while, which sanctioned transactions the chain would carry. As stablecoin issuers with freeze buttons and custodians holding the bitcoin behind the wrapped tokens. And as a small group of developers who can, between them, change almost anything.
None of that undoes what it showed. Prototypes are judged on whether the principle works, and this one does. Bitcoin's flaws were the specification for whatever comes next, and Ethereum's are a long, detailed addition to the same document. Over the next three posts I'll put the two together: first a plain account of everything both get wrong and why we need them anyway, then a world built from improved versions of both, and finally what I think should replace them.
Every ledger before Bitcoin asked you to trust the keeper, and Bitcoin asks you to check the cost. Ethereum asks you to check the code, which anyone can read and which runs exactly as written. A vending machine never needed a shopkeeper. It still needs whoever holds the key to the back.