The money page ended on a question: could you keep a record of who owns what that everyone trusts, without putting one bank, company, or government in charge of the ledger? A blockchain is one answer that people actually built. This page builds it up one piece at a time — payment, then the problem with copying, then blocks, then how strangers agree — so that by the end "blockchain" is not a buzzword but a thing you can picture.
Start with a single payment, and forget computers for a second. If you write "pay £10 from me to Sam" on a slip, how does Sam know you wrote it and nobody changed the amount? Normally a bank vouches for you. With no bank, you need to prove it yourself.
The tool for that is a pair of keys. You keep one secret (your private key) and give out the other freely (your public key, which doubles as your address). You sign a payment with the secret key; anyone can then check that signature against your public key. A valid signature proves two things at once: the payment really came from you, and not one character of it was altered after you signed. Nobody learns your secret in the process.
This is exactly how the first decentralised blockchain, Bitcoin, defines ownership. Its design paper, announced on 31 October 2008, describes a coin as "a chain of digital signatures," where each owner passes it on by signing it over to the next, and "a payee can verify the signatures to verify the chain of ownership." So a transaction is just a signed message — this coin moves from this owner to that one — that anyone can check and nobody can forge.
Here is the problem that makes digital money genuinely hard. A physical coin, once handed over, is gone from your pocket. A digital message is just data — you can copy it perfectly. So what stops you signing the same coin over to two different people, and letting both believe they were paid?
A bank solves this the boring way: it keeps the one master ledger, sees both payments, and rejects the second. Take the bank away and this double-spending problem is the whole game — Bitcoin's paper names it as exactly the thing its network exists to solve. The fix can't be "trust me, I only spent it once." Everyone has to agree on which payment happened first.
The answer is one shared record that everybody keeps a copy of, and everybody can read. New transactions are gathered into a block — think of a page in a shared notebook. When a page fills, it is added after the last one, and the order is permanent: a coin spent on an earlier page cannot be spent again on a later one, because anyone can look back and see it is already gone. That kills the double-spend.
What stops someone quietly rewriting an old page? Each block carries a short fingerprint of the block before it — a value computed from that block's exact contents, so any change, however tiny, produces a completely different fingerprint. Because every block points back at the previous one this way, the blocks form a chain (this is the block-chain). Alter anything in an old block and its fingerprint changes, which no longer matches the pointer in the next block, which breaks the one after that, all the way to the present. You cannot edit the past quietly; you would have to rebuild every block since. That tamper-evidence is the point, and it is exactly what the design paper builds: once a block's proof-of-work is done "the block cannot be changed without redoing the work," and because the blocks are chained one after another, "the work to change the block would include redoing all the blocks after it."
One question is left, and it is the clever bit. If everyone keeps the notebook, who writes the next page? If just anyone could, two people would add conflicting pages at once and we would be back to square one. Bitcoin's answer is to make adding a block cost something, through a contest called Proof-of-Work.
It works like a guessing game, and "guessing" is the honest word — this is not solving a clever puzzle. To add a block you attach a throwaway number to it and check the block's fingerprint. You win only if that fingerprint comes out starting with a long enough run of zeros. There is no trick that produces such a number; you cannot reason your way to it. All you can do is try a number, check, try the next, check — billions of times — until one happens to work. The design paper describes this as scanning for a value whose "hash begins with a number of zero bits" — "hash" being the precise name for the fingerprint we have been picturing. The "work" is all those discarded guesses, and whoever guesses a winner first gets to add the block.
The part most explanations drop is what keeps this steady, and it matters: the number of zeros required is not fixed. If blocks are being found too quickly — because more machines joined the hunt — the network raises the bar — in the picture we have been using, it asks for one more leading zero (under the hood it nudges a fine-grained numeric target up or down, not whole zeros; the paper calls it "a moving average targeting an average number of blocks per hour"), which makes a winning guess much rarer and slows things back to the intended pace; if blocks come too slowly, it lowers the bar again. The paper states the rule plainly: "If they're generated too fast, the difficulty increases." This difficulty adjustment is why a blockchain keeps a roughly constant heartbeat no matter how much guessing power shows up.
Two jobs get muddled here, and keeping them apart matters for understanding who actually holds power on a blockchain.
A node validates; it does not create blocks. Most nodes never mine at all — they just enforce the rules and refuse to pass on a cheat. So the popular line that "running a node gives you a miner's power" has it backwards: your node can reject an invalid block no matter how much guessing power made it, but it gets no say in which valid block comes next — that is settled by the mining contest: the design paper puts it that "the majority decision is represented by the longest chain, which has the greatest proof-of-work effort invested in it." Spinning up more nodes does not buy you block-creating power; it just means more independent checkers holding the network to its rules. The security comes from thousands of those stubborn checkers, not from trusting the miners.
Put the pieces together and "blockchain" stops being mysterious: signed payments, gathered into blocks, each block fingerprinting the one before it so the past can't be edited, the next block won by a public guessing contest that paces itself, and every block checked by a crowd of independent nodes. A trustworthy shared ledger, with nobody in charge of it. That is genuinely new.
But look at what it cost. The ledger is public — everyone keeps a copy, so everyone can read it. The Bitcoin project's own privacy guidance puts it bluntly: "anyone can see the balance and all transactions of any address". Every payment, every amount, every address, sitting in the open forever. For a system whose whole job is that nothing can be hidden, that is the feature. For money, it is a problem: you have traded a trusted bank for a permanent, world-readable record of everything you ever paid for.
So the next question writes itself. Can you keep the good part — a shared ledger nobody controls, where no one can cheat — while putting the privacy back? That is the problem Zcash sets out to solve, and it is where we go next.