Ages: 11–15 · Duration: 120 minutes · Topics: Cryptographic hashing, Merkle trees, Proof of work, Game theory, Bitcoin protocol, Ethereum & smart contracts
"Imagine you and nine friends play a trading-card game. You trade cards at school, but nobody keeps a fair list. Alex says 'I traded my holo-Charizard to Bella,' and Bella says 'No, Alex still owes me.' Who's right? You need a RECORD everyone trusts. You could ask a teacher to keep the list — but what if the teacher is sick? Or unfair? Or hacked?
Today we build a system where nobody is in charge, yet nobody can cheat. The secret? Mathematics."
| Enemy | Example | Real-world analogue |
|---|---|---|
| Forgery | Alex writes "Bella paid me 10 coins" — but she never did | Fake bank transfers |
| Tampering | Charlie changes an old record: "I never owed David" | Cooking the books |
| Double-spending | Eve sends the same digital coin to both Frank and Grace | Copying a file = copying money? |
Every security system needs a way to detect tampering. A cryptographic hash function takes any input — a word, a book, an entire movie — and produces a fixed-size output called a digest (the "digital fingerprint").
| Property | Meaning | Analogy |
|---|---|---|
| Deterministic | Same input → same hash, always | Same person → same fingerprint |
| Fast | Computing the hash is quick | Scanning a fingerprint takes seconds |
| Avalanche effect | Change one bit → ~50 % of output bits flip | Completely different fingerprint |
| One-way | Given a hash, you can't find the input | Can't reconstruct a person from a print |
| Collision-resistant | Nearly impossible to find two inputs with the same hash | No two people share a fingerprint* |
*Fingerprints aren't truly unique, but SHA-256 hashes essentially are: $2^{256} \approx 10^{77}$ possible outputs — roughly the number of atoms in the observable universe.
Real SHA-256 is too complex to compute by hand. Let's invent a toy hash for classroom exploration:
$$H(n) = (31 \times n + 17) \bmod 256$$Only 256 possible outputs — wildly insecure, but it demonstrates the key properties.
| Comparison | Approximate value |
|---|---|
| SHA-256 outputs | $2^{256} \approx 1.16 \times 10^{77}$ |
| Atoms in the observable universe | $\approx 10^{80}$ |
| Grains of sand on Earth | $\approx 10^{19}$ |
| Seconds since the Big Bang | $\approx 4.3 \times 10^{17}$ |
A blockchain literally chains blocks together using hashes. Each block contains: (1) the hash of the previous block, (2) its own data (transactions), and (3) its own hash — computed from all of the above.
What if a block contains 2 000 transactions? Checking one would mean downloading all 2 000. Ralph Merkle (1979) invented a better way: a binary tree of hashes. Each leaf is the hash of a transaction; each internal node is the hash of its two children. The root summarises ALL transactions in 32 bytes.
To prove transaction C is in the block, you only need Hash(D), Hash(AB), and the Root — that's $\lceil \log_2 n \rceil$ hashes instead of $n$.
In the Postcard Paradox lecture (#9), we saw public-key cryptography. Bitcoin uses ECDSA (Elliptic Curve Digital Signature Algorithm) on the curve $y^2 = x^3 + 7 \pmod{p}$ (secp256k1).
In a network where some participants may be dishonest, how do honest participants agree on a single truth? — Lamport, Shostak & Pease, 1982
Satoshi Nakamoto's brilliant insight: make cheating expensive.
To add a block, you must find a nonce such that:
$$\text{SHA-256}(\text{block data} \mathbin\Vert \text{nonce}) < \text{target}$$In practice, this means the hash must start with a certain number of zeros. The more zeros required, the harder the puzzle.
With $k$ leading hex zeros required:
$$P(\text{success}) = \frac{1}{16^k} \qquad E[\text{attempts}] = 16^k$$| Leading zeros $k$ | Expected attempts | Time @ 10 B hashes/s |
|---|---|---|
| 1 | 16 | Instant |
| 4 | 65 536 | Instant |
| 8 | $4.3 \times 10^{9}$ | 0.4 seconds |
| 16 | $1.8 \times 10^{19}$ | ~58 years |
Using the toy hash $H(n) = (31n+17) \bmod 256$:
Collision hunt: $H(0) = 17$ and $H(256) = (31 \times 256 + 17) \bmod 256 = 7953 \bmod 256 = 17$. So $H(0) = H(256)$! By the pigeonhole principle, among any 257 inputs at least two must collide (only 256 possible outputs). This is why we need SHA-256 with its $2^{256}$ outputs.
Mining follows a geometric distribution. With target of $k$ leading hex zeros:
$$P(\text{hit}) = p = \frac{1}{16^k} \qquad E[\text{trials}] = \frac{1}{p} = 16^k \qquad \sigma \approx 16^k$$The standard deviation is approximately equal to the mean — so actual mining times vary wildly. Sometimes 30 seconds, sometimes 40 minutes, even if the average is 10 minutes.
On 31 October 2008, someone calling themselves Satoshi Nakamoto posted a 9-page paper: "Bitcoin: A Peer-to-Peer Electronic Cash System." Nobody knows who Satoshi is. They mined the first block — the Genesis Block — on 3 January 2009, embedding a newspaper headline:
"The Times 03/Jan/2009 Chancellor on brink of second bailout for banks"
A message about trust in financial institutions — hidden in the first block of a system designed to replace that trust with mathematics.
Bitcoin doesn't track balances. It tracks Unspent Transaction Outputs (UTXOs) — like specific bills in a wallet:
Input sum = Output sum + Fee. Miners collect the fee as reward.
Bitcoin's block reward halves every 210 000 blocks (~4 years). Total supply: exactly 21 000 000 BTC.
$$\text{Total} = 210{,}000 \times 50 \times \sum_{k=0}^{\infty} \frac{1}{2^k} = 10{,}500{,}000 \times 2 = 21{,}000{,}000$$Laszlo Hanyecz paid 10 000 BTC for two Papa John's pizzas (~$41 at the time). At Bitcoin's all-time high (~$69 000 in November 2021):
$$10{,}000 \times \$69{,}000 = \$690{,}000{,}000$$$690 million for two pizzas. Every year on 22 May, the crypto community celebrates Bitcoin Pizza Day.
Mt. Gox handled ~70 % of all Bitcoin trades. In February 2014, it lost 850 000 BTC (~$450 M) and filed for bankruptcy. The blockchain itself was never hacked — Mt. Gox was a centralised exchange, exactly the kind of trusted intermediary Bitcoin was built to remove.
Ross Ulbricht ran the Silk Road dark-web marketplace using Bitcoin for payments. The FBI seized 144 000 BTC and Ulbricht was sentenced to life in prison (pardoned in 2025). The lesson: Bitcoin is pseudonymous, not anonymous — every transaction is public.
Vitalik Buterin, a 19-year-old from Toronto, asked: what if the blockchain stored programs? These smart contracts execute automatically:
// Pseudocode: a simple bet
contract Bet {
if (ETH_price > $5000 on Jan 1, 2025) {
send(Alice, prize);
} else {
send(Bob, prize);
}
}No judge, no lawyer, no bank. The code IS the contract.
The DAO raised $150 million in Ethereum. A hacker exploited a smart-contract bug and drained $60 million. The community chose to rewrite history (a hard fork), creating today's Ethereum. The original chain survives as Ethereum Classic.
Ethereum switched from Proof of Work to Proof of Stake, cutting energy use by 99.95 %. Instead of burning electricity, validators stake their ETH as collateral — honest behaviour earns rewards; dishonesty costs your stake ("slashing").
| As of 2025 | Value |
|---|---|
| Total BTC mined | ~19.8 million |
| Remaining to mine | ~1.2 million |
| Estimated lost forever | ~3–4 million |
| Bitcoin energy / month | ~10 TWh (≈ Sweden) |
| Ethereum energy / month (post-Merge) | ~0.01 TWh |
| Fact | Value |
|---|---|
| SHA-256 output | 256 bits = 64 hex chars |
| Possible outputs | $2^{256} \approx 10^{77}$ |
| Bitcoin block time | ~10 minutes |
| Total supply | 21 000 000 BTC (exactly) |
| Halving interval | 210 000 blocks (~4 years) |
| Merkle proof for $n$ txns | $\lceil \log_2 n \rceil$ hashes |
| Genesis Block | 3 January 2009 |
| Most expensive pizza | 10 000 BTC (22 May 2010) |
a3f1 and Block B stores Prev: a3f1, what happens if Block A's data is changed?Prev no longer matches → chain is broken → tampering detected.⛓️ Trust No One, Trust Everyone — Math Circle Lecture #11 — generated for interactive classroom use.