This is the in-depth follow up to this brief article:
This long article explains technical and economic details to explain both why NFTs are bad, why they don’t work (they don’t do what they claim to do), and explains the hype surrounding them.
NFT Artist & Cryptobro Blocker (for Twitter)
If you want to remove NFT artists and cryptobros from your timeline, I have created an app to do that. You can find it here:
PDF version of this article (LaTeX)
This article is available as a pretty PDF if you would prefer to read it that way. You can download it from Dropbox here.
This article was last updated on December 21, 2021.
The PDF version is currently slightly out of date; it was last updated on November 20, 2021.
Table of Contents
· Abstract
∘ What are NFTs?
· A summary of why cryptocurrencies and NFTs are scams
· An explanation of blockchains
∘ Blockchain consensus systems: how user voting power is decided
∘ Proof of Work (Bitcoin, Ethereum, Dogecoin and others)
∘ Proof of Stake (some smaller cryptocurrencies)
∘ Delegated Proof of Stake
∘ The underlying fatal flaws of all these consensus systems
∘ 51% attacks
∘ False sense of security in PoS and DPoS
∘ PoS: Why slashing is useless
∘ DPoS: ‘Democratic’, in all the wrong ways
∘ Proof of Work: Tragedy of the Commons
∘ Recovering from blockchain takeovers
· Byzantine Fault Tolerance, and its weaknesses in decentralised blockchains
∘ Why decentralised blockchains can’t scale
∘ Why alternative consensus ‘algorithms’ are not feasible
∘ Blockchain conclusions
· The basics of cybersecurity, and why only the ‘weakest link’ in a security system matters
∘ Malware
∘ Phishing
∘ Distributed Denial-of-Service (DDoS)
∘ Man-in-the-Middle Attacks (MotM)
∘ Credential Stuffing & Password Spraying
∘ Users are the weakest link 99.9% of the time
· Why don’t NFTs work?
∘ NFTs are not ‘unmodifiable’
∘ It isn’t physically possible to prove ownership of an item
· Environmental impact of NFTs
∘ NFTs and crypto are forcing other businesses out of renewable energy
∘ The misleading narrative of “other things that pollute as much as NFTs/crypto do”
· Why the hype for NFTs?
∘ Greater fool theory and tax evasion
∘ NFTs as bets on the price of cryptocurrency
∘ Outright crime
· Why cryptocurrencies don’t work
∘ Impossible to regulate transactions
∘ Default rates
∘ Chargebacks: adult content, and all other kinds of purchases
· Appendix A: Art stolen and minted as NFTs
Abstract
This article explains in detail what NFTs are and why they don’t work.
The first and most important proposition is this: no system can ever prove ownership of anything. That statement does not depend on the time period or the technology — it physically isn’t possible. Anyone who claims to have invented a system that achieves this is therefore lying; this article explains the economic motives behind those who make such claims, and explains the inherent and fatal flaws in the system that is NFTs and cryptocurrencies.
What are NFTs?
NFTs (non-fungible tokens) are intended to be unique digital identifiers; a kind of “uncompromisable digital record”. They are not in fact anything like this, but this is what they claim to be.
As such, the main uses for them so far has been to make digital art “scarce” — by making one copy the ‘original copy’, allowing it to be sold like a traditional artwork would be at a far higher price than a normal digital image could be sold for. (The price of high-price traditional art is also a scam, but more on that later).
In order for NFTs to work, they must be on a ‘blockchain’. Blockchains and how they work (and don’t work) are explained after the summary below.
A summary of why cryptocurrencies and NFTs are scams
These points are explained in further detail in the rest of the article; this list is here for a brief at-a-glance view.
- NFTs don’t prove ownership — ordinary legal contracts are just as good, and in fact better since they are heavily regulated and can be taken to courts for a central resolution when problems arise
- Blockchains (which NFTs rely on) are in the best case no more secure than ‘normal’ relational database storage systems, and in most cases are less secure
- Cryptocurrencies have no innate value and are only useful as a pyramid scheme, something big crypto influencers are knowingly using to profit from those who don’t realise it
- Both cryptocurrencies and NFTs cause high environmental damage, and there are no viable systems to deal with this problem due to security considerations
An explanation of blockchains
Before we get into why NFTs don’t work, first we must understand the underlying fatal flaws of blockchains in the context of cryptocurrencies and NFTs.
Blockchains are a very simple concept — imagine a linked list of items, where each item has a note that points to the location of the next item.
Blockchains are a more advanced form of linked list, that use cryptography to try and prevent tampering with the list’s contents. Below I will go into detail about how they function (and why they don’t work for the purposes of crypto or NFTs).
As you can see, the blockchain concept is a linked list of blocks, containing information about the previous and next blocks as well. The nonce is a unique random value used to identify a block and prevent replay attacks, and is also part of the ‘mining’ process. Tx_Root is the hash of the block’s data, while Prev_Hash and Next_Hash are the hashes of the previous and next blocks (a cryptographic hash in simple terms is a unique identifier for given input data — computed by a one-way cryptographic hash function).
The blockchain is thus a relatively simple concept. In practice, there are two kinds of ways they can be set up:
- Centralised blockchains (only a central authority, or some group of central authorities, can write new information into the blockchain or modify it)
- Decentralised blockchains (no central authority — any user can write onto the blockchain or modify it, so in effect the users as a whole are the central authority).
Cryptocurrencies — and the NFTs reliant on them — all use decentralised blockchains; as a result we will focus exclusively on those.
Blockchain consensus systems: how user voting power is decided
In order to validate new blocks on a blockchain where the users are the authority, you have to be able to reach consensus on who should write that block and whether the block is valid. This means in a sense that the blockchain needs to solve the well-known Byzantine Generals problem, an ever-present issue when it comes to distributed systems, and one which we will examine a little bit further later on.
This problem involves a group of entities reaching agreement on a particular action, even if one or more of the entities gives conflicting information (deliberately or unknowingly). The above diagram shows two examples of this; in both cases it is impossible for Lieutenant 1 to know who is the traitor (in both examples, they get the same orders, but in each one the traitor is different).
There are a few different ‘consensus systems’ with which decentralised blockchains attempt to solve this problem — namely Proof of Work, Proof of Stake and Delegated Proof of Stake are probably the most well known. They also need to protect the blockchain from attacks — ensuring that nobody can gain enough control to abuse the system.
I am referring to these as consensus ‘systems’, as technically speaking they are not consensus ‘algorithms’, which is a slightly different topic; almost all blockchains use the same simple consensus algorithms involving majority vote and weighted random selection of the next user to write to the blockchain. While other consensus algorithms such as Avalanche do exist, they are not improvements and never can be. (Avalanche is actually even less secure than other systems, but that is covered later.)
Each of these consensus systems works by choosing the user who will write the next block at random, with the random chance for each user weighted proportionally according to how ‘mining power’ that user has:
- Proof of work: a user’s mining power is determined by how much ‘work’ they have done (this ‘work’ is explained in the Proof of Work section below).
- Proof of stake: a user’s mining power is determined by how much currency they ‘stake’ (in practice, this is generally equivalent to how much currency they own)
- Delegated proof of stake: Same as above, except a user’s mining power is not used to determine writing or validating blocks directly, but is used to vote for the ‘delegates’ who will write and validate blocks on behalf of all users.
The users of the blockchain as a whole then vote on whether that block is valid.
Proof of Work (Bitcoin, Ethereum, Dogecoin and others)
Proof of work as a concept is simple: the person to write the next ‘block’ of transactions is chosen at random, proportionally according to the amount of ‘work’ they have done. The chosen miner is then rewarded with new coins or some existing coins for that work (all others get none; it’s more of a lottery than a guaranteed return).
The work itself is redundant and arbitrary, but is done to create a protection mechanism, as in order to subvert the blockchain and thus the cryptocurrency you’d need to hold 51% of the available working power, which would be very difficult to acquire.
This has in fact happened many times on smaller cryptocurrencies, and could perfectly well happen on a larger one like Bitcoin or Ethereum in theory, but would require gargantuan computing resources in practice (possible, but *extremely* difficult). As a result, Proof of Work is seen as the most ‘secure’, and this is why despite endless talk none of the major cryptocurrencies have moved off of PoW.
Proof of Stake (some smaller cryptocurrencies)
Proof of stake works in a similar-ish way to PoW, with one major difference: instead of choosing the miner who will write the next block randomly proportional to how much ‘work’ they did, they are chosen randomly proportional to how many coins they hold.
This comes with the obvious benefit that you no longer need to expend countries worth of electricity doing redundant calculations to decide the next writer to the blockchain; however, it also comes with the problem that now those who have enough money can just sit on it forever to gain more and more money (and more and more control over the blockchain as well).
It’s also astronomically easier to buy out a small or medium PoS currency than it is to acquire the necessary hardware to control a PoW blockchain, as real-world currency is much more readily available and liquid. Plenty of billionaires and corporations have a ton of cash lying around, but few or none have millions of idle RTX 3090s lying around in their basement ready to take over some PoW cryptocurrency.
Delegated Proof of Stake
Delegated Proof of Stake is very similar to PoS, but with one major change: instead of the next miner to write a block being chosen randomly according to how many coins they have, their coins are used to randomly decide (again, proportional according to how many coins they have) who the ‘delegates’ are. These ‘delegates’ then decide by majority vote on the next block.
For all practical purposes this is really a very small difference from PoS, in terms of how easy it is to abuse.
The underlying fatal flaws of all these consensus systems
The (alleged) purpose of Bitcoin and other cryptocurrencies is to make the financial system “fairer”, by ensuring that banks and governments do not control the currency or exert undue influence/corruption, etc. In order to explain why cryptocurrency — and consensus systems of any kind — do not solve this problem, we will look at some of their weaknesses.
51% attacks
A 51% attack (much like a hostile takeover in business) involves controlling more than half of the blockchain’s mining power. For each consensus system this would mean:
- Proof of work: controlling ≥51% of the hardware used to mine
- Proof of stake: controlling ≥51% of the currency
- Delegated proof of stake: controlling ≥51% of the currency, allowing you to fill the group of delegates with your subordinates
This is the reason why proof of work is considered the most secure for a cryptocurrency or other decentralised blockchain use: firstly, controlling 51% of the total currency in a PoS system is a lot easier than controlling 51% of total mining power in a PoW system (imagine how much hardware you would need to do that for a larger cryptocurrency like Bitcoin).
Secondly, if someone acquires 51% power in a PoW system, it’s possible for others to buy more hardware to reduce that 51% share. In a PoS system, if someone gets 51% of the currency, unless they sell it the currency is at their mercy forever.
It’s worth noting that a 51% attack is significantly more likely in PoW systems as time goes on — more on that later.
False sense of security in PoS and DPoS
To quote Investopedia:
Proof of Stake (POS) is seen as less risky in terms of the potential for miners to attack the network, as it structures compensation in a way that makes an attack less advantageous for the miner.
This is, at best, an exceptionally naive view. An attacker holding 51% of the currency may not have an incentive to ‘attack’ the network, but they have a massive incentive to monopolise it; much like in real life situations, you don’t get your 51% controlling stake and then hold everything to ransom in one big dramatic moment.
An attacker with 51% power could invalidate all new transactions for other users, and could for example slowly start limiting the transactions of other users or companies using the currency (targeted or otherwise) unless they paid a certain amount to the 51% owner. Once a currency is embedded enough in the economy, it will not be a feasible option for people to simply abandon their money and start over (and you won’t be able to sell it in such a situation). Like all such situations, an attacker would use a form of salami tactics, slowly taking a bigger and bigger cut from other people’s money via transactions whilst doing it slowly enough to stop them from moving away from the platform. Even in the event that the cryptocurrency later dies, the attacker will easily end up with more real-world currency than they started with.
PoS: Why slashing is useless
Slashing refers to a process used in some PoS cryptocurrencies, that penalises those who perform malicious actions or give incorrect validations on the blockchain when acting as validators. The idea behind this is to disincentivise attempts at takeovers or other malicious activity; however, it is useless in practice, because it requires assuming that the malicious validators are foolish and disorganised.
To understand why, compare this to a military coup d’état. Slashing is equivalent to punishing those responsible for the coup if it fails, but that’s where the problem lies: if it fails. If it succeeds, the new government won’t be punished, and those who resisted its rise to power almost certainly will be.
Any competent malicious actor — or competent military leader — knows not to make any move until they have sufficient power to succeed, and slashing only functions so long as the malicious actor doesn’t have a majority (as once they do, their ‘malicious action’, such as a fraudulent transaction block, is deemed valid due to majority vote).
DPoS: ‘Democratic’, in all the wrong ways
DPoS is frequently cited as being more “democratic” than PoS, as owners of the currency vote for delegates to represent them. However, this is true for all the wrong reasons.
Imagine a democracy where instead of each person having one vote on who represents them in Congress/parliament/etc, each person had one vote per dollar in their bank account. That is exactly what DPoS does; the more money you have, the more votes you have on who validates blocks in the blockchain. I hope the problem with that needs no further explanation.
Proof of Work: Tragedy of the Commons
One of the primary problems with existing PoW cryptocurrencies is their reward structure for miners. There are two ways in which miners are rewarded for validating transactions on the blockchain:
- New coins
- Transaction fees
The transaction fees paid by users are currently massively subsidised by giving miners new coins. This article from 2017 gives us some figures: at that time, a miner could expect to receive ~12.5BTC in new coins, and ~0.1–0.5 BTC in transaction fees paid by users; in other words, almost all the real ‘cost’ of performing transactions is being offset by just giving miners new coins.
These coins will eventually stop being minted (Bitcoin has a hard limit), or will become less and less valuable in terms of reward for mining effort as to be not worth mining for. This is because the number of coins rewarded for mining will gradually dwindle as the supply dries up, the amount of computing power required for mining increases by design as the coin supply decreases, and thus the cost of mining will outstrip the value of the coins. There will therefore be a transition from miners being rewarded in new coins, to miners being rewarded by transaction fees from users, and eventually it will be transaction fees alone.
The resulting problem is the tragedy of the commons: as the currency gets closer to having no more new coins to mint, miners will no longer find it worth the effort to mine, as it won’t be worth enough in coin rewards. Users will then have to pay higher transaction fees to miners to offset this; since users will be keen to get the lowest transaction fees possible, there will be gargantuan pressure on miners to achieve the lowest mining costs they can.
That means that most mining operations that aren’t gigantic and using cheap energy only available in some geographic locations would run at a loss — and nobody is going to mine for a loss. Thus, you would end up with a handful of very large miners, who could easily band together to raise prices and form a cartel, or subvert the blockchain for their own gain if they so chose.
One could argue this has happened in real-world systems (Visa and Mastercard completely dominate the card sector , with 60% and 30% of the market respectively — it’s not cost effective to be a small provider, so it’s almost inevitable that a few big players will come to dominate such a field). However, the consequences are totally different — the domination of Visa has not resulted in exorbitant prices for transactions since normal financial systems are several orders of magnitude more efficient than cryptocurrency blockchains by design.
Also, unlike cryptominers, Visa and Mastercard are regulated by laws and cannot abuse their dominant position as easily as a large cryptominer can. If Visa or Mastercard began trying to force huge fees on merchants, they’d face fights from very large companies with significant influence — cryptominers would only face fights from individual users, who are not organised and can present much less of a united or influential front against a cryptominer who abuses their position.
If you want a real-world example of this in action, look at the current fight between Amazon and Visa. Amazon is one of few companies big enough to try and fight Visa on its own, but it isn’t doing it out of a genuine belief that Visa charges too much — it just knows it can throw its weight around for its own gain. What is clearly visible, however, is that Visa and Mastercard aren’t invincible; they still have to provide a competitive service due to the ability of large companies to push back on them. Large cryptominers will have no such opposition, and will thus have an easy time taking advantage of their position.
A similar tragedy of the commons exists in PoS and DPoS; the richest users would have no incentive to spend their money, as their money gives them control over the currency and gives them the opportunity to earn more money in transaction fees.
Recovering from blockchain takeovers
There are only two ways a blockchain can recover from being hit by a 51% attack in practice. The first is only applicable to Proof of Work: because total mining power is based on hardware (a continually changing resource) and not coins, new hardware can be added outside of the current mining pool, reducing the 51% miner’s total share.
The second method is by a hard fork. Effectively, this means the developers of the cryptocurrency hard-code changes to the blockchain protocol and/or specific blocks into the entire blockchain, which allows them to write a user’s coins out of existence or invalidate a user’s transactions without having to have consensus from a majority.
This presents two absolutely huge, massive problems. First of all, if you are going to champion the idea of a “currency that can’t be rigged by central authorities and isn’t under the control of one”, the idea of a group of unelected developers deciding without any vote or input what should be written out of the currency, or what rules should be changed, should be a horrifying one. This is the reason why most such forks end up with two currencies emerging; one set of users disagree with the new changes and maintain the old version. This has happened with Ethereum (forked into Ethereum Classic after Ethereum was compromised by security vulnerabilities in The DAO), Bitcoin (several hard forks), and other cryptocurrencies.
Secondly, hard forks work on the assumption that you actually know who the malicious actor is. For example, let’s say 55% of mining power on a given cryptocurrency seems to be consistently voting one way or trying to be fraudulent to take over the currency. How do you know it’s true, and not simply the accusations of other users who would like to see those users taken out of the system?
You can’t know; it’s impossible. Let’s look at another example: the current politics of the US. You can compare this to a kind of attempted-hard-fork in progress; Donald Trump, Mitch McConnell and other Republicans have been contesting that the US election wasn’t fairly won and would like to see democracy gone in all but name. In simple terms, if he can get 51% of “mining power” — in this case, electoral states — to side with him, he can get the developers who decide democracy to change the rules, as he tried to do once before. Whether or not any of their claims are ‘true’ doesn’t have any bearing on this; all he has to do is convince enough people.
In exactly the same way, blockchain hard forks are just as dangerous: you don’t actually need a majority group of users to be taking over the blockchain to eliminate them. You just have to convince everybody that they are, so the developers will choose to patch them out. The inherent danger in this is far higher than in real-world currencies, primarily because most blockchain users have no idea how blockchain works, and as such a charismatic leader could easily convince many of them that X or Y user is fraudulent even with no evidence.
This of course is a vulnerability of real-world currencies, but far more indirectly and thus far less dangerously.
Byzantine Fault Tolerance, and its weaknesses in decentralised blockchains
In distributed systems, Byzantine fault tolerance is related to the Byzantine Generals Problem, and is a measurement of a system’s ability to resist arbitrary ‘byzantine’ failure by one or more components. Byzantine failure means failure that is not necessarily predictable, and where you don’t necessarily have enough information to know that failure has occurred: a component might stop working, it might continue to give correct results sometimes and wrong results other times, it might give random results all over the place, or it might just keep giving bad results all the time.
To give a simple example of how Byzantine fault tolerance works:
Suppose you have an aeroplane, and on that aeroplane are ten linked identical sensors that measure the plane’s altitude and orientation that ensure the pilot is flying safely. This system has a level of byzantine fault tolerance; if one of the sensors malfunctions and gives wrong readings, the other nine sensors will still be giving correct readings, and the system can continue running as normal (as the nine correct readings will take precedence over the one faulty reading). If, however, six of the sensors malfunction at the same time, in the same manner — the pilot will not realise it, because it will seem as if those six sensors are the “majority that are correct” and the four remaining sensors are wrong.
Of course, the chances of six sensors failing at the same time in exactly the same manner, giving the same false readings, are incredibly low. This brings me to the point of this section: generally, Byzantine fault tolerance is primarily useful when failure can be attributed to mechanical or hardware/software errors, and does not have a motive.
Consider the aeroplane again. What motive does the sensor have to malfunction? None. As a result, we can be relatively sure that its failure would be down to one of three main causes:
- Software failure
- Hardware failure
- Human interference (e.g. a soldier tampering with sensors on an enemy warplane)
Byzantine fault tolerance is excellent at protecting against the first two possibilities in many systems. It is much weaker against the last possibility, because the human who sabotages the plane has a motive for the sensors to fail in a specific way which will breach the maximum fault tolerance of the system. Provided the human or humans can tamper with enough of the system, the fault tolerance breaks.
This is the primary problem with claiming that blockchains are “secure” for cryptocurrency. While consensus mechanisms such as PoW are excellent at protecting against a machine that malfunctions due to a bug, it is weak at protecting against the real danger: humans causing a large section of the system to malfunction in a specific manner for a particular motive. A rich human wishing to subvert a decentralised blockchain network has a massive incentive to do so, and the resources to achieve it.
Why decentralised blockchains can’t scale
Proponents of cryptocurrencies, while acknowledging they are currently extremely inefficient and slow (both in energy per transaction and the number of transactions they can handle in a given timeframe), continually talk about how new improvements will fix all that. Spoiler: they won’t. How do I know this?
First of all, as previously explained, PoS and DPoS currencies aren’t viable for security reasons (the explanations here all apply to them as well, they’re just even less secure). This leaves only PoW, in which the redundant work is the only security mechanism; you cannot reduce that without also reducing the blockchain’s security, meaning you must consume massive amounts of energy and processing time. Even if, somehow, that energy was all 100% renewable — the knock-on effect of that is that other industries would all end up using more non-renewables, as the consumption of renewable energy by cryptocurrencies would raise prices and reduce the amount of it available for other uses.
Secondly, the only techniques you can ever use to improve the speed or transaction throughput of a blockchain — by definition — must reduce security, because the only way you can achieve this is by making less than 100% of the blockchain’s nodes (or users) do the work of validating transactions. Sharding is a common example; it’s not a new technology, it’s not some special blockchain solution as it is often claimed to be. It’s just another name for horizontally partitioning a database.
All this does is split your database into multiple databases; it’s called “horizontal” because you are splitting each complete row of data amongst several databases (as compared to vertical partitioning, where you split the columns instead).
For centralised databases, which is most applications, this is of great benefit: splitting your databases like this can improve efficiency, and can bring other benefits as well which are a bit complicated to explain here. However, it should also be clear that once you have split the database, each “shard” now contains only a part of the total information. Since the database is centralised anyway, there are no security concerns with sharding a centralised database unless you are careless in managing your servers.
For a decentralised blockchain however, used in crypto, this causes a massive security vulnerability: each ‘shard’ is its own little blockchain, just as in the database example each shard is its own little database. This makes it easier to take over one shard — you no longer need a 51% attack on the whole network, just a 51% attack on the nodes in one shard, which is far easier to achieve.
The only realistic ways to address this involve attempting to randomly assign each user, or ‘node’, to shards periodically — effectively making it difficult for users to predict when they could have enough control of a shard to take it over. This, however, assumes malicious users won’t work together to find that opportunity — and it will appear, since the algorithm that performs the assignments has no knowledge of which users are working together.
As such, sharding is not a solution at all. It looks like one until you examine it, and then it falls apart instantly.
Why alternative consensus ‘algorithms’ are not feasible
A few blockchains, such as the previously mentioned Avalanche, use different algorithms to decide consensus. Before I explain why Avalanche isn’t secure, a simple fact: it’s not possible to make a ‘more secure’ decentralised consensus algorithm than majority vote. I will explain why Avalanche doesn’t work as one example of this.
It should be clearly obvious to anyone that if you have a system where something is decided by a group of unconnected users, there is no realistic way in which you can stop a malicious majority hijacking that system. You can change to an extent where the vulnerabilities lie, or trade security for speed (as with Sharding above) but that’s about it.
Avalanche relies on the snowball algorithm. Here is their own description of how it works, in simple terms:
To understand why this is an extremely weak concept, let’s look at political gerrymandering (deliberately dividing up a democratic election into districts that favour one party).
As we can see from the image on the right, it is possible to divide up the voters such that the party with only 40% of the vote wins the election.
The snowball algorithm is vulnerable to exactly the same problem: for each round of the algorithm, you split users into random subsets. If the first round happens to end up in the manner of the right-most image above, a large number of users will end up “taking the preference of the majority” even though it’s not truly the majority preference. Then, in the second round, because more people are now voting with the incorrect majority preference, it’s more likely they will dominate each subset.
This means that even a relatively small minority could cause a malicious transaction to be approved — simply by being lucky. Imagine going to your bank, and they tell you that every now and then lots of peoples’ money gets stolen based on nothing but luck; I for one wouldn’t call that a system to be trusted.
Avalanche themselves know this, because it’s written in their own document (presumably the reason it contains so much self-praising propaganda about radical innovation):
To explain what this means: as shown above in the first excerpt from the article, the Snowball algorithm goes through several rounds in which each user asks a random subset of other users what their ‘preference’ is.
As the sample size increases (the number of users in the ‘random subset’ being asked), you have better assurance that their preference is a correct representation of the overall preference of the network and that a few malicious actors were not able to subvert the quorum for that sample, making the network more secure. However, it also makes the network less able to tolerate byzantine failure, because a larger sample size means there are fewer available unique subsets overall (and as such, a malicious subset is more likely to be present in each user’s random sampling). It also means a malicious user reporting dodgy quorum results can have a greater effect, as explained below.
The Snowball consensus algorithm, unlike the regular ‘majority vote’ algorithm, relies partially on each user giving an honest record of what the random subsets they asked actually said. For example: suppose you sample a subset of 20 users if they prefer pizza or barbecue, and 18 of them say pizza. Nothing at all is stopping a malicious user from reporting that those 18 users said barbecue; if several malicious users do this, they can either subvert the system or cause it to be unable to reach consensus. Unlike in majority vote situations, where this doesn’t work unless you have over 50% of the vote, you can do this here with far less than 50% — though it will only work some of the time, as the malicious users are not in control of who is given which random subsets to sample.
In order to make the chance of this acceptably low — even for non-financial purposes — you would need to make the sample size (and the quorum size as a percentage of the sample size) so high as to make the algorithm slow and incredibly intolerant of byzantine failure, rendering it completely useless. Additionally, because of its low tolerance to byzantine failure compared to other consensus algorithms (even when not using a large quorum size), Avalanche has a vulnerability other blockchains don’t really have — denial of service attacks.
Usually, “denial of service” attacks refer to flooding a website with requests, overloading its servers and stopping it from being able to serve genuine users. In this case, because Byzantine fault tolerance is so low in a secure Snowball consensus algorithm, an entity with a low share of mining power — e.g. 20% or so — can bring the system to a halt. There would be very big incentives to do this for an entity that e.g. wanted to delay transactions it didn’t like, had bought short stock options on the currency and intended to capitalise on them by creating a sense of network disruption temporarily, or a variety of other purposes that would benefit the entity and cause problems for all other users.
As such, Avalanche provides inconsistent security — depending entirely on the random subsets, a malicious actor or actors can undermine the system on a random basis.
Blockchain conclusions
The overall conclusions of all of the above flaws is clear: they all point to similar scenarios, in which rich entities or those with control of large amounts of hardware would effectively control the currency to their advantage sooner or later. While it is of course not possible to say that real-world currencies don’t have this problem, cryptocurrencies don’t in any way improve upon them in this regard, as it’s not a problem a currency can solve in itself. Unlike cryptocurrencies, however, it’s possible to solve this problem with real-world currencies by enacting suitable laws (the reasons for why this hasn’t happened already are complex, but largely boil down to those with vested interests resisting such laws.)
This is the reason Bitcoin, Ethereum, Dogecoin and others have not moved from PoW; the idea that PoS or DPoS are actually workable solutions is laughable at present, both for security reasons and the fact that much of the hype around cryptocurrencies is their supposed lack of control by rich or powerful entities, which PoS and DPoS are extremely vulnerable to.
I for one would be wary of attempts by rich investors (notably Elon Musk) to hype up PoS cryptocurrencies: as most PoS currencies currently have very low market caps, it would be easy for them to hype up the currency until it gains steam, then buy enough of it to gain control and make a very nice profit by effectively ‘owning’ that currency and profiting off of transaction fees and so forth.
Due to these vulnerabilities, NFTs can’t be seen as “uncompromisable or unmodifiable”: if the blockchain is compromised, the NFT can be altered, deleted or anything else.
The basics of cybersecurity, and why only the ‘weakest link’ in a security system matters
One of the main problems with blockchains, other than everything explained above, is the fallacy of believing that they are ‘secure’ in and of themselves. In all computer security, the only relevant factor is how easy it is to compromise the least secure part of a system. If you can do that, you now have access to the rest of the system, rendering the rest of the security useless.
This concept isn’t exclusive to technology. For example, medieval castles had this problem: if your enemy can tunnel under the castle walls, or get an insider to lower the drawbridge, then the rest of your castle’s defences are now useless and the attackers can flood into the castle with ease. As such, much effort was put into figuring out how best to counter those attacks. Indeed, the category of computer viruses known as Trojan horses are so named because they work very much like the Trojan horse of Greek mythology, which was used to deceptively sneak a small group of Greek soldiers into the city of Troy and open its gates — allowing the main Greek army to enter Troy unhindered.
This issue is relevant to blockchains because users all use other applications to actually do anything with a blockchain; NFT users use a site like withFND or OpenSea, crypto ‘investors’ use Coinbase or Binance, etc. The weakest link is then no longer the blockchain itself, but rather looks something like this:
If you can compromise a user, by getting them to reveal their password or in any other way, you can now bypass all the other security mechanisms: they no longer matter. For example, if you owned an NFT on withFND that uses the Ethereum blockchain, someone who can compromise your user credentials can log in, transfer your NFTs to their own account, and that’s that. Encryption, blockchains — none of that can help you then.
Because of this fact, cybersecurity attacks always target the weakest link in the system. Most of the time this is users; that is why phishing and social engineering attacks are the most common, as can be seen from this article. Let’s go through the types of attack mentioned.
Malware
Quoted from the above article:
“Malware is typically downloaded unwittingly by clicking a malicious link or by tricking a user into thinking they’re downloading something legitimate when they’re not.”
In other words, it relies on users being careless or uninformed. The weak link here is users.
A good example would be the WannaCry ransomware attack in 2017, which caused huge damage to the UK National Health Service. The entire service network was infected because a member of staff downloaded an email attachment they hadn’t checked. It doesn’t matter how good your security is if someone gives malicious code administrator privileges unwittingly.
Phishing
Again, quoting from the above article:
“Phishing attacks attempt to steal information from users or trick them into downloading malware by sending malicious emails or text messages (SMS) that look like real requests but are, in fact, a Scam.”
Again, the weak link is users.
Distributed Denial-of-Service (DDoS)
This isn’t relevant for this article, as DDoS focuses on bringing a website down (making it unable to serve legitimate requests from users by flooding it with illegitimate traffic), as opposed to actually compromising its security.
Man-in-the-Middle Attacks (MotM)
Quoting again from the above article:
“Man-in-the-middle (MitM) attacks are when bad actors spy on or intercept communication between you and your users or employees.
For example, fake WiFi networks are easy to deploy in public places like coffee shops where remote employees often work. People often connect to these networks without realizing it, allowing bad actors to spy on them while they use the network.”
Once again, the weak link is users.
Credential Stuffing & Password Spraying
These are very similar types of attack. Credential stuffing is where, having compromised one website’s user credentials, you try them again on another website (hoping that the user was using the same credentials across multiple websites). Since many users do, that’s often a successful strategy.
Password spraying is attempting to log in using common passwords like “12345”, “password”, and could be said to include dictionary attacks.
Yet again, the weak link is users being careless with password management. Do you see the pattern here?
Users are the weakest link 99.9% of the time
This is important to state, because when it comes to “amazing new security innovations”, they basically don’t exist because of the fact that users remain the weakest link on the chain.
The real security innovations are making users themselves more secure. Two factor authentication and the rise of good password managers are examples of this. OAuth is also an excellent example of improving security, by letting users only allow specific access to their account for a third party, instead of giving them the actual credentials.
A notable (yet rare) counter-example to users being the weakest link in modern cybersecurity would be the compromise of iOS by Pegasus this year. Due to a huge security vulnerability in the code for Apple’s iMessage software, Pegasus was able to make a zero-click exploit to compromise the security of any iPhone, that required no carelessness on the part of the user.
The conclusion here is that blockchain doesn’t make anything “more secure” in and of itself. If someone can steal your user credentials, make you click a dodgy link you didn’t think was dodgy or hack the website, they can transfer all your supposedly “unbreakably secure NFTs or crypto” to their own account. The blockchain adds no extra security because you need to improve the weaker security links before it will matter.
Why don’t NFTs work?
The primary reason they don’t work is that they are trying to solve an unsolvable problem: proof of ownership. Before explaining anything else, we must first establish what it means for an NFT to “work”. This means the following:
1. It must be unmodifiable by any means (the second condition requires this in any case)
2. It must categorically prove ownership of an item
The first condition isn’t achieved because the technology isn’t capable of it (as it’s decentralised), and the second condition isn’t achieved because it’s physically impossible with any technology.
NFTs are not ‘unmodifiable’
In order to understand why this isn’t true, we must examine the blockchain again, and learn about cryptography.
A reminder of the types of blockchain:
- Centralised blockchains (only a central authority, or some group of central authorities, can write new information into the blockchain or modify it)
- Decentralised blockchains (no central authority — any user can write onto the blockchain or modify it, so in effect the users as a whole are the central authority).
All NFTs are reliant on decentralised blockchains to work, usually those of cryptocurrencies such as Bitcoin or Ethereum. As explained previously, compromising the blockchain results in the compromising of the NFTs themselves, making the idea that they “cannot possibly be altered in any way” a nonsensical one.
I’d also note here that it’s not physically possible for any technology to prove beyond doubt that something has not been tampered with, because it requires a guarantee that both parties in the transaction are genuine, which isn’t possible without a central authority.
To understand this, let’s look at how all modern secure websites function. That you are on an encrypted HTTPS connection doesn’t prove you are connected to the website you think you are. What happens is that the servers for the website you’re connecting to — let’s imagine, say, Amazon.com — will have a security certificate. This certificate is provided by a Certificate Authority, who verify that Amazon’s servers are in fact genuine. Your browser checks this certificate to verify you are connected to Amazon and not something else; if you can subvert or compromise the certificate authority, you can make the user think they have connected to a genuine website when they have not (this has happened many times before, with massive consequences).
In other words, you must trust that the certifying authority is legitimate and not compromised. No amount of super-awesome-unbreakable technology would help achieve this. (Decentralised solutions — such as cryptocurrency blockchains — are even less secure than this, as you rely on the majority of users not being corrupted or malicious — a very brave assumption at best, as explained in the Blockchain section above).
Because of this, it’s not possible for a decentralised blockchain to be ‘categorically secure’, because it requires assuming that at least 50% of users are acting in good faith / correctly / rationally — a simple glance at any history book of a democratic country will show you how foolish an assumption that is.
It isn’t physically possible to prove ownership of an item
Proving ownership of an item — with any technology, is provably impossible. Even if blockchain had absolutely no weaknesses and could not be compromised in any way, NFTs cannot prove ownership — not now, and not in the future either. Let us take an example to demonstrate this.
Imagine I had a box that nobody could subvert; that if I placed within it a record that person A bought an artwork from person B, the record within that box could never be changed or compromised in any way. That box would solve nothing. It would solve nothing because all the box does is store the record and prove it exists/is not tampered with.
Suppose person B originally stole the artwork and wasn’t the real owner. Does the box have any ability to verify this? No. What if person B never meant to sell the artwork, and was coerced or threatened into selling it? Also no. What if person C makes their own unmodifiable and uncompromisable box, and puts a record inside it that says they bought the artwork instead of person B? How do you know which box is the ‘genuine’ one? Merely having a “completely secure record” does not mean the owner had any right to sell, that the artist approved the sale, or anything else. Of course, it’s not only NFTs that have this problem; legal contracts and other things have this problem too.
Additionally, even if you make an unbreakable, unquestionable technology to provide proof of ownership, it doesn’t mean people have to accept it works (an example of this can be seen in Donald Trump’s politics: the mere fact that vaccines are proven to work, and any other number of facts that are provably true but he doesn’t like, didn’t stop him from being able to convince his supporters that they were all evil lies). Add to that the fact that there is a great conflict of interest for those wishing to subvert proof of ownership for their own gain, and you can quickly see how any “proof of ownership” system is going to be severely limited by consensus.
A real-life example of this problem from the traditional art world is the Salvator Mundi painting (or any old painting, for that matter). It is fiercely debated as to who the real painter is; before it was claimed to be Leonardo da Vinci’s work, it was previously attributed to another artist in his studio, and before that was unknown. The only way we ‘know’ it is legitimate is because experts agree (i.e. have consensus) that it is legitimate. If the artist was alive he could vouch for it, but could he ‘definitively prove to have painted it’? No. He would have to rely on others who would say ‘yes, I saw him paint this’, or point to his past works and show their similarities.
In other words, the only way we can prove anything involves a certain amount of consensus. Again, Donald Trump is an example of this problem: anyone who paid attention to his presidency should see how it is (sadly) possible for even blatant, undeniable evidence of something to be called into question; when it comes to questions of ‘who owns what’, you only own something if other people agree that you own it (formalised, in most countries, by the law).
This problem also applies to legal contracts. The mere fact that a contract exists doesn’t make it true or legally binding; how do you know it wasn’t signed under duress? That the signing parties actually agreed on the terms and read them and understood them, or even that the goods owned by one side were legitimately owned by them? You can’t. In modern times people each keep a copy of the contract, and perhaps an independent third party also does to stop one person modifying theirs and claiming the contract was always different, but even the most amazingly unmodifiable contract could never prove its own validity. That’s one of the reasons courts exist: to settle disputes when two parties disagree, because without a central authority, there can’t be any resolution.
Proof of transaction does not equal proof of validity. Twitter bots going around minting NFTs for artworks without the artist’s permission are a good example. An NFT can’t be trusted on its own terms; you must check with the artist that it was sold by them, just as you would need to do with a legal contract or anything else. This makes it use as a “proof of ownership” completely useless; it does nothing a legal contract can’t do. That’s why commercial companies have never had trouble commissioning artwork and enforcing their rights to it.
There are countless examples of NFTs being minted without the artist’s permission by thieves and scammers, among other kinds of NFT scams: they are explored later in the article, and demonstrate the folly of believing that somehow NFTs are a proof of authenticity or ownership of any kind.
Environmental impact of NFTs
There isn’t any serious debate to be had about the environmental impact of NFTs. While it’s perfectly reasonable to state that current estimations of carbon emissions are just that — estimations with a lot of unknowns —even the low estimates are absolutely gargantuan compared to the quantity and ‘uses’ of NFTs.
First of all: cryptocurrency mining, which at present NFTs are wholly reliant on to function, involves vast amounts of computing power which would not otherwise be expended. This wouldn’t necessarily be a massive environmental problem on its own, but most mining is done with non-renewable energy.
From September 2019 to around January 2021, a huge amount of Bitcoin mining was done in China, with various other countries making up the rest of it. As of November 2021, the biggest country for mining is the US, mostly due to Chinese regulations on cryptocurrency shutting down almost all mining there. The US relies nearly 60% on fossil fuels, barely different from China’s two thirds reliance on coal, making this completely irrelevant news when it comes to the environmental impact of cryptocurrencies.
The University of Cambridge has a useful tool here:
As can be seen, the lower and upper estimates are wildly different, as a result of many factors that go into Bitcoin mining. What is clear, however, is that it is a huge impact no matter which way you look at it.
NFTs and crypto are forcing other businesses out of renewable energy
Due to the limited amount of renewable energy available both now and for the foreseeable future, the environmental damage caused by mining for PoW cryptocurrencies doesn’t depend on whether they use renewables or not; when they use renewables, it simply forces other businesses to use fossil fuels by driving the price of renewables up and making them unviable. This is on top of the massive amount of hardware waste mining produces; huge amounts of computing equipment are used for it with no objective benefit whatsoever.
The argument used by some, that crypto “uses otherwise unused renewable energy” is nonsense. Crypto farms are compromised of large amounts of computer hardware that need cheap cooling and energy prices, so they go to two kinds of places: those with dirt-cheap fossil fuel energy (Venezuela, Kazakhstan, and China until its recent regulatory crackdown), or those with cold climates, many of which already have or had surplus renewable energy in areas (Iceland, Canada, Siberia and others).
This matters because other computer-based services, like data processing for mathematical simulations, render farms, and web server centres have exactly the same requirements as crypto farms: cheap cooling and energy, and they’ve already been moving to countries that offer that. Crypto is forcing them not to enter that space by raising the price of renewables and severely limiting their availability. For example, as this article states, Bitcoin is eating up most of the renewable energy in Iceland due to its exponentially rising energy requirements; the result is higher prices on renewable electricity and lower amounts of renewable electricity being available for use.
The misleading narrative of “other things that pollute as much as NFTs/crypto do”
It’s perfectly true to say that for example, Bitcoin currently uses almost as much as — say — gaming/YouTube, which could be seen as small overall. However, this is completely misleading when put into context:
- NFTs add absolutely no intrinsic value (unlike YouTube and gaming, both of which provide entertainment to billions of people, NFTs are solely artificial in value). Almost every other carbon-emitting sector provides significant utility and value; NFTs do not. In addition to this, YouTube serves far more customers than NFTs do; if they were comparable in size, NFTs would be orders of magnitude higher in carbon emissions.
- Cryptocurrencies account for a small % of global emissions right now, but are one of the only solely artificial things to do so — and will continue to become bigger and bigger in their emissions, as they already have done, because of the nature of the proof-of-work systems on which most cryptocurrencies rely. This can be seen in the University of Cambridge graphs as well.
- As of September 2021, a single Bitcoin transaction uses more electricity (1810 kWh) than one million Visa transactions. According to the US government, a single kWh of electricity costs 13.90 cents, meaning each Bitcoin transaction would cost $251.59 to process. There is no viable way to make this more efficient (techniques like sharding, and alternate consensus mechanisms like proof of stake just make the blockchain much less secure to bring about faster transaction throughput, so that isn’t helpful either).
Of course, as previously stated, this doesn’t erase the fact that cryptocurrencies — and even more so NFTs — represent a small part of the fight against the climate crisis, for now. However, there is no serious defence for them being worth that cost, and they will not remain a “small part” for long, nor do they scale at all.
It’s also notable that this logic can be used by almost anyone to shift the problem onto someone else: farmers, many of whom barely make a living, can at least say that their emissions are a necessity. Transportation has the excuse that environmentally friendly fuels are not yet viable in all situations and that for e.g. electric cars, the infrastructure required to make them work is not yet in place in most of the world. Industries can argue that where their power comes from isn’t their fault, or do the infamous BP “shift the blame to the consumer” method.
NFTs, on the other hand, have no such defences. Yes, they can be used by any artist around the world — but the vast majority of artists who will profit from them are those who are already doing exceptionally well for themselves without NFTs. The argument that it will make it easier for artists in e.g. developing countries to make a living is little more than a smokescreen.
Kim Parker did an excellent and thorough analysis on the above, demonstrating that most artists barely make anything from NFTs:
The argument of “NFTs don’t directly cause emissions” is a misnomer. From a technical standpoint, if you’ve already built e.g.the Ethereum blockchain and made a load of blocks, minting an NFT does not add a carbon footprint of its own. However, you need all those blocks to mint the NFT in the first place.
Take an anology: It’s as if you ran a giant factory that uses electricity from coal power, then claimed that since your factory machines don’t cause carbon emissions themselves, that your factory doesn’t cause emissions. It should be clear how stupid that argument is (and right now, NFTs — along with greater fool investment — are the primary uses of cryptocurrency blockchains, so one can’t claim that NFTs aren’t causing the problem).
Why the hype for NFTs?
There are three reasons: greater fool theory, tax evasion/money laundering, and outright crime. (The first is the main use at the moment).
We will examine each reason below.
Greater fool theory and tax evasion
To understand this, let’s look at the high-price traditional art world.
When seeing a traditional artwork valued at say $100m, the investor doesn’t believe the painting itself is worth anything like that price. They believe its ability to possibly be sold to another investor, who hopes to perform the same greater fool theory scam(or the ability to offset future taxes by fiddling with the valuation in creative ways and donating an artwork at a much higher than true market price, shield assets from the eyes of authorities, or avoiding capital gains tax by selling in certain places), is worth that price. You could do the exact same things with literally any object — find a chunk of rock, and if investors think it’s worth $100m for the purposes listed above (justifying it on some fanciful grounds of e.g. a great historical figure trusted this chunk of rock for their meditation wisdom and got their best ideas from it), you can do the exact same thing. Some articles on this:
New York Times: What the Panama Papers reveal about the art market
Economics Professor Nuriel Roubini, article on CNN, 2015: “The art market is shady”.
Indeed, huge numbers of traditional artworks languish in storage depots in order to avoid being damaged to ensure they retain their investment value (and stay out of the eyes of authorities looking to avoid them being smuggled to tax havens). As Will Gompertz wrote in the above BBC article:
“We all know that art has become a commodity, but I hadn’t realised until I went to the Free Port that it has become a tradable stock that never needs to see the light of day.
Those Picassos might never come out, remaining boxed-up in a cold corner as they shift from one owner’s capital assets balance sheet to another’s.
We can argue all day long about the meaning of art, but surely it isn’t that.” — Will Gompertz
You can also watch this video (it’s relatively long, but explains well the money laundering, tax evasion, and other things that the rare traditional art market enables).
I would also note that by far the most high-profile digital art NFT sale so far — Beeple’s — is not what it claims to be. The buyer was one of Beeple’s business partners with a huge vested interest in the cryptocurrency used for payment (and Beeple themselves is invested in it too). It couldn’t be more shady if it tried.
So far there are very few NFT sales that don’t fall into this bracket, since almost every plausible buyer has a vested interest in the value of the cryptocurrencies themselves.
NFTs as bets on the price of cryptocurrency
The other reason for hype is to bet on cryptocurrency prices: cryptocurrency in itself is a greater fool investment with no intrinsic value; they are worth money only in the hope of selling it to someone else. As a result, NFTs can be seen as a way to speculate on the prices of crypto whilst also trying to profit from ‘artificially scarce’ art trends.
It is easily observed in the NFT art world that there is a very false sense of community; artists who join NFTs suddenly become best friends with other NFT artists they’ve never met or interacted with before, and begin shilling every other NFT artist they can find. This is done to try and create a sense of ‘close-knit community’ to convince buyers that the NFT itself is worth buying, and also to produce mutual advertisement of their own NFTs from other NFt artists. This is also the reason why almost every NFT artist you can find has rebranded their entire identity around it — to create the sense of passion and hype.
A great many artworks being sold as NFTs are objectively trash; I don’t say that to insult the artists, but as an objective statement that their price isn’t worth anything like the actual amount being paid for them. Let’s take a recent (infamous) example.
Some of these were bought for almost $15,000. Normally, art of this quality wouldn’t even sell for $150, let alone anything higher, even if you weren’t buying the rights to it; the only reason it sells for more in NFTs is due to the possibility of greater fool investment and future tax evasion that comes with all ‘unique’ or ‘scarce’ items. (NFTs do not in fact make an item unique or scarce, but they pretend to, and most are either unaware of this or aware and complicit).
Outright crime
NFT and crypto enthusiasts are a fantastically easy target for scammers and criminals, due to a combination of factors.
Firstly, all such enthusiasts fit into two groups: those who don’t realise they are being scammed, and those who realise it but are trying to profit off of the first group (greater fool theory). The vast majority have no technical expertise, making it very easy to perpetuate the claim that NFTs are unbreakable, unmodifiable proofs of ownership when they are not.
Secondly, it is easily demonstrated that the NFT ‘community’, much like the cryptocurrency ‘community’, is far more interested in hype than facts. The first way you can see this is by the accounts of artists who go into NFTs; almost all do a complete 180 with their profiles and online image, turning their entire identity into nothing but NFT shilling.
That usually involves having several NFT and/or cryptocurrency hashtags in their bio, retweeting the works of other NFT artists (often artists whom they’ve never interacted with before in their entire time on social media), and suddenly being public best friends with NFT artists they’ve never met or interacted with before to foster a false sense of ‘positive community’, which makes for beneficial marketing. Often such artists change their main website URL to be a NFT website link and more, something you never see when they go into any other new venture.
The second way you can see this is by cryptocurrency ‘bros’. Never mind statistics or any kind of facts: almost all cryptocurrency influencers point to random memes and other prominent crypto influencers like Elon Musk to justify claiming that crypto is good. You can easily see this yourself in the “X currency to the moon” trends, and how such influencers can trivially cause big swings in the price of cryptocurrencies merely by posting.
There are also no end of bad faith arguments, like “all new innovations get criticised at first”, “all new things have problems early on, blockchain will be fine”, or “disruptive inventions and cultural rebels always get attacked, ignore the haters to the moon #insertmemehere”. They are prime examples of survivorship bias, something frequently seen in blindly optimistic ‘innovators’ and feigned by complicit liars looking to profit from them: listing all the good things that have come out of new innovations, and pretending all the bad ones don’t exist or are totally unrelated.
Were it not for “brave new innovators and technological rebels”, we also wouldn’t have, among many other horrendous things:
- Leaded petrol
- CFCs
- The Agile Manifesto for software development
- The DDT pesticide
- Buildings with Asbestos
- Musician-exploiting record labels
- False anti-vaccine narratives
- Edison’s propaganda war against AC electricity
It would be wiser to recognise that innovations can be bad as well as good. We’d have been far better off without all of the above; some innovations deserve to be criticised, ridiculed, and correctly valued at less than nothing.
All of the above makes for an exceptionally easy group of targets; uninformed customers in any industry do. This has resulted in all manner of NFT scams, ranging from pulling the rug out from under supposedly legitimate NFTs, to selling NFTs of artwork the seller doesn’t own, to NFTs being stolen from NFT websites themselves. (Makes an amusing mockery of the supposed “security” of blockchains).
Here’s a few examples:
On top of this, cryptocurrencies are nothing like as secure as they claim to be:
Of course, in most (but not all) of these examples, the blockchain itself was not compromised — because you don’t need to, and never will. You just compromise the weakest link — a bad code base, or an incompetent human. This is true of all computer security, which is why phishing and other social engineering attacks are much more common and lucrative today than attempts to undermine actual security systems.
Blockchains themselves, as seen with Bitcoin Gold and others, are compromisable — with horrific consequences — but most of the time, the resources required to do that won’t be necessary. Much easier to send someone a dodgy email or fake login site, let them bring down the security themselves, then transfer all their cryptocurrency to your own anonymous wallet and cash out to a real-world currency before they know what’s happened. Of course, this can happen with any technology — but it’s easiest here, because non-technical people will erroneously assume that it must be secure ‘because of blockchain’.
Why cryptocurrencies don’t work
There are quite a lot of reasons why cryptocurrencies don’t work, so I will split them into sections below.
Impossible to regulate transactions
In a truly decentralised cryptocurrency, you can’t regulate any transactions in practice as there is no central authority to arbitrate on it or force a transaction to be reverted. Right now, cryptocurrencies are in fact centralised: they run on decentralised blockchains, but users buy and trade them through centralised websites such as Coinbase or Binance. This means they’re just inefficient versions of real-world currencies, since those companies are still under US regulations and must conform to US financial laws.
In real world currencies, there are chargebacks on credit cards, banks can claw back money from fraudulent transactions via various laws and international agreements, and in any dispute the law can come into force. In cryptocurrency there is nothing by design; if you hand over your money to someone, nobody can get it back. The whole reason we have these protections on real-world money is to ensure fairness for everyone involved, because without them, you end up in a wild west scenario where fraudulent sellers are everywhere. Let’s look at some examples of this.
Default rates
According to S&P, the current default rate (that is, the percentage of people not paying their loans and defaulting on them) for consumers across mortgages and bank cards is 0.39%. This means loans that haven’t been paid for months on end and have been written off entirely — not just ones where a payment was missed.
Payday loans (short-term loans with predatory interest rates), before they were regulated, had interest rates of over 5000% and had a default rate of 14%.
Meanwhile, people are currently using DeFi platforms to take out loans against their NFTs, with a default rate of 20%. Imagine being such an unstable and unregulated market that default rates are higher than on loans with 5000% interest rates.
Chargebacks: adult content, and all other kinds of purchases
As stated previously, the point of chargebacks is that it allows customers to recoup money when fraud has happened. Of course, as sex workers will know, this isn’t always used in good faith: plenty of customers can and do use chargebacks to recoup money from legitimate purchases (and credit card companies will frequently side with the customer if it’s a first chargeback and/or they don’t have a habit of it).
However, chargebacks are a basic consumer right — because without them, it’s all too easy to sell dodgy products, and it also stops stolen cards from being used for purchases. However, they are impossible to implement on blockchains without a centralised authority who has access to users’ crypto wallets — which has horrible implications for many industries, but most of all the real-life pornography industry.
Real-life pornography is — to financial services companies and banks — seen as high risk, alongside some other industries. This is why NSFW sites and subscription platforms have such a difficult time with payment processing (e.g. OnlyFans and its battle with credit card companies, in its quickly-reverted decision to ban explicit content earlier this year); banks generally don’t want to be associated with them, because the high risk implies a high amount of chargebacks.
This isn’t only because of buyer’s remorse or fraudulent chargebacks: anyone who has paid for pornography will have experienced some kind of dodgy selling from adult sites. Two examples from big adult content sites can be seen below:
This risk is also reflected in the fact that unlike Patreon — which doesn’t allow real-life pornography and takes an approx. 10% cut of creator earnings (8% + around 2% payment fees), OnlyFans — the most popular adult content subscription site — takes 20%, and JustForFans takes 30%. This is partially due to higher costs — payment processors will insist on higher fees to cover the higher risks — and also due to exploitation, because OF and JFF know very well that adult content creators have few or no other options available.
Fansly notably takes 20% but “protects creators from chargebacks”. This is, in a sense, possible with real money if you regulate the creators on your platform; it’s not possible, however, with cryptocurrency. Why is this?
In a real-currency system, you can’t “prevent” chargebacks per se: Fansly works by banning any user who initiates one, and then covering the cost of the chargeback to the creator (as the chargeback still happens). This forces Fansly to regulate its creators; if a creator is being hit by high numbers of legitimate chargebacks, Fansly can either give them free money for defrauding their customers (not a wise idea), or ban that creator, and there comes a point at which a sufficiently high chargeback level is going to be legitimate no matter what the creator is doing. In other words — creators who are sufficiently “bad”, or whose work is charged back enough for any reason, will inevitably get kicked from the platform. As such it’s more of a “protection versus typical amounts of chargeback and fraudulent ones” — which is fine, you can’t expect much better than that.
With a cryptocurrency in place, the incentive for fraud is massively increased; chargebacks can’t happen, so a creator is incentivised to create misleading and dodgy products, knowing that customers have no recourse if they complain. The idea that customers will stop spending if a creator shows bad intent is nonsense: as just one example, despite many court cases and regulator complaints, Gwyneth Paltrow’s fraudulent health business is booming, which should show how naive a view that is. The only way to stop this is to have a central authority that can kick a creator off the platform when this happens, which makes cryptocurrency completely redundant (as we are now in the previous situation, just with inefficient cryptocurrency instead of normal money).
NFTs are similar, yet even worse: CumRocket, an NFT marketplace for sex workers to sell NFTs on, explicitly advertises “no chargebacks” as part of its marketing to draw new creators in. This comes with an obvious problem: what happens when a user spends $500 on a limited NFT of e.g. an explicit video, only to find it’s not remotely what was advertised?
The user cannot perform a chargeback, and so the platform doesn’t have to cover the creator’s chargeback costs. As a result, both the seller and the platform have a big incentive to allow fraud: it will make them both money. By contrast, the Fansly system creates a disincentive for Fansly to allow fraudulent creators to remain on the platform, because it will incur chargeback costs it has to compensate for. This is doubly true because unlike a crypto system, in which payment processors who effectively regulate risk don’t exist, a site like OnlyFans or Fansly has to be careful not to let fraudulent creators onto its platform to avoid having its risk rating elevated (and thus its payment processing costs increased).
NFTs are generally for high-price items in this realm; as a result, they will do nothing but encourage high-price fraud, as there is no way to enable chargebacks on them or in any way enforce rules about what they can contain or whether they have to be in any way genuine.
The result of all the above points is that sex workers will be seriously worse off if cryptocurrencies and NFTs are adopted, due to the fact that chargeback isn’t possible on them. The minority of “bad” creators who will use this to their advantage will make it much harder for good creators to operate, as users will be far more reluctant to spend and the reputation of sex work as a whole will be heavily damaged.
Sex workers, understandably, often do not have a good view of chargebacks — but the alternative of not having them is astronomically worse.
Appendix A: Art stolen and minted as NFTs
This appendix contains tweets I have seen of artists complaining of their work being stolen and minted as NFTs.
This is not even close to an exhaustive list, but it should help to illustrate the scale of art theft that is happening via NFTs (and additionally, show how much of a joke it is to consider NFTs a proof of ownership given this fact).
