Python 3 and a terminal, nothing more. macOS and Linux include Python;
on Windows install it from python.org with “Add python.exe to
PATH” ticked. Check with python3 --version. No libraries, no
accounts, no internet.
The categories in this article are not marketing labels — each one is a different set of rules, and the rules are arithmetic you can run. Over the next twenty minutes you will derive Bitcoin’s famous supply limit rather than being told it, watch inflation dilute a holding, test a stablecoin’s backing, and find out what your wallet is really showing you when it displays a token or an NFT.
Not All Cryptocurrencies Are the Same
There are thousands of cryptocurrencies, but they are not all created equal. They differ in purpose, technology, security model, and risk profile. Understanding these differences is critical for making informed security decisions about which assets you interact with and how you protect them.
Bitcoin (BTC)
Bitcoin was the first cryptocurrency, launched in 2009. It is designed primarily as a decentralized digital currency and store of value.
- Consensus: Proof of Work (the most battle-tested blockchain)
- Supply: Hard-capped at 21 million coins — no more can ever be created
- Security track record: The Bitcoin network itself has never been successfully hacked. Losses have come from exchange hacks, user error, and lost private keys
- Privacy: Pseudonymous, not anonymous. All transactions are publicly visible on the blockchain and can be traced with analysis tools
Ethereum (ETH) and Smart Contracts
Ethereum extends blockchain beyond simple transfers by supporting smart contracts — self-executing programs that run on the blockchain.
- Consensus: Proof of Stake (since September 2022)
- Smart contracts: Enable decentralized applications (dApps), DeFi protocols, NFTs, and more
- Security implications: Smart contract bugs can lead to massive fund losses. Unlike traditional software bugs, exploited smart contracts often cannot be patched because the code is immutable on-chain
- Gas fees: Every operation on Ethereum costs "gas," which can spike during high demand
Billions of dollars have been lost to smart contract exploits. A contract being "on the blockchain" does not mean it is safe or audited. Always research whether a contract has been professionally audited before interacting with it.
Stablecoins
Stablecoins are cryptocurrencies designed to maintain a stable value, typically pegged 1:1 to a fiat currency like the US dollar.
Privacy Coins
Privacy coins are designed to make transactions untraceable, unlike Bitcoin where all transactions are publicly visible.
- Monero (XMR) — uses ring signatures, stealth addresses, and RingCT to hide sender, receiver, and amount by default
- Zcash (ZEC) — uses zero-knowledge proofs (zk-SNARKs) to enable private transactions, but privacy is optional, not default
Privacy coins are legitimate tools for financial privacy, but they are increasingly delisted from regulated exchanges due to compliance concerns. Consider the legal landscape in your jurisdiction before using them.
Tokens vs Coins
This distinction matters for security:
- Coins (BTC, ETH, XMR) run on their own blockchain. Their security depends on the blockchain's consensus mechanism.
- Tokens (USDC, UNI, LINK) run on top of another blockchain, usually Ethereum. Their security depends on both the underlying blockchain AND the token's smart contract code.
Anyone can create a token on Ethereum in minutes with minimal technical skill. This is why the vast majority of scam projects are tokens, not coins.
DeFi Tokens
Decentralized Finance (DeFi) tokens represent participation in protocols that replicate financial services (lending, borrowing, trading) without intermediaries.
- Governance tokens let holders vote on protocol changes
- Liquidity provider tokens represent your share of a trading pool
- Yield farming rewards users with tokens for providing liquidity
DeFi carries compounded risk: smart contract bugs, oracle manipulation, flash loan attacks, and rug pulls. Many DeFi protocols are unaudited or use forked code that may contain hidden vulnerabilities.
NFTs (Non-Fungible Tokens)
NFTs are unique tokens that represent ownership of a specific digital item. From a security perspective:
- The token is on-chain, but the actual image or media is usually stored off-chain (often on centralized servers or IPFS). If the hosting disappears, the NFT points to nothing.
- NFT phishing is rampant — fake minting sites, malicious smart contract approvals, and social engineering are common attack vectors
- Wash trading (buying and selling to yourself) artificially inflates perceived value
Now Derive the Differences Yourself, in Five Steps
“There will only ever be 21 million bitcoin” is repeated constantly and almost never checked. In the next twenty minutes you will compute it from the issuance rule and see the number appear, then run the same kind of arithmetic on an inflationary coin, a stablecoin’s collateral, a token and an NFT — each of which turns out to be a very different kind of thing from the others. Every figure below came from running these files.
Go: open a terminal in a folder you can write to, e.g.
cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).
Do: save this as supply.py and run
python3 supply.py. The whole rule is: 50 coins per block, halving every 210,000
blocks, forever.
reward = 50.0 # coins per block at the start
BLOCKS_PER_ERA = 210_000 # the halving interval
total, era = 0.0, 0
while reward > 0.00000001:
total += reward * BLOCKS_PER_ERA
era += 1
reward /= 2
if era <= 4 or era == 33:
print(f"after era {era:>2}: {total:>14,.0f} coins issued, next reward {reward:g}")
print(f"\ntotal ever issued: {total:,.0f}")
You should see: the famous number falling out of the rule:
after era 1: 10,500,000 coins issued, next reward 25
after era 2: 15,750,000 coins issued, next reward 12.5
after era 3: 18,375,000 coins issued, next reward 6.25
after era 4: 19,687,500 coins issued, next reward 3.125
after era 33: 21,000,000 coins issued, next reward 5.82077e-09
total ever issued: 21,000,000
Look at era 1: half of all the coins that will ever exist were issued in the first period. Nobody decreed “21 million” as a target — it is what a halving schedule adds up to, and it is enforced by every node refusing a block that pays itself more than the rule allows.
If not: if the loop never ends, the halving line is reward / 2
without the assignment — it must be reward /= 2. A total of 42,000,000
means the reward is doubling.
Go: same folder. Most coins are not capped, and that is a design choice rather than a flaw — but it has a consequence worth seeing.
Do: save this as inflation.py and run it. You hold a
thousand coins in both worlds and never buy or sell.
capped, inflating = 21_000_000.0, 21_000_000.0
my_coins = 1_000.0
print(f"{'year':>4} {'capped supply':>15} {'your share':>11} | "
f"{'inflating 5%/yr':>16} {'your share':>11}")
for year in range(0, 21, 5):
print(f"{year:>4} {capped:>15,.0f} {my_coins / capped:>10.4%} | "
f"{inflating:>16,.0f} {my_coins / inflating:>10.4%}")
for _ in range(5):
inflating *= 1.05
You should see: the same holding meaning steadily less:
year capped supply your share | inflating 5%/yr your share
0 21,000,000 0.0048% | 21,000,000 0.0048%
5 21,000,000 0.0048% | 26,801,913 0.0037%
10 21,000,000 0.0048% | 34,206,787 0.0029%
15 21,000,000 0.0048% | 43,657,492 0.0023%
20 21,000,000 0.0048% | 55,719,252 0.0018%
After twenty years the balance is identical and the ownership share has fallen by more than half. That is the honest way to compare a capped coin with an inflationary one — and it is also why “staking rewards” paid in new coins are not straightforwardly income: if everyone stakes, everyone’s share stays where it started.
If not: if both columns stay identical, the inner loop is not running — the five multiplications must happen inside the year loop, after the print.
Go: same folder. A stablecoin is a promise to redeem one token for one dollar. The question is always what stands behind the promise.
Do: save this as peg.py and run it.
issued = 1_000_000.0 # stablecoins in circulation, each meant to be worth 1 dollar
for name, collateral in (("fully backed in cash", 1_020_000.0),
("backed by volatile assets", 1_500_000.0),
("after those assets fall 40%", 900_000.0)):
print(f"{name:28s} collateral {collateral:>11,.0f} "
f"ratio {collateral / issued:>6.1%} "
f"{'each coin is covered' if collateral >= issued else 'NOT every coin can be redeemed'}")
You should see: a comfortable-looking 150% becoming 90% after one bad week:
fully backed in cash collateral 1,020,000 ratio 102.0% each coin is covered
backed by volatile assets collateral 1,500,000 ratio 150.0% each coin is covered
after those assets fall 40% collateral 900,000 ratio 90.0% NOT every coin can be redeemed
Both of the first two lines are “fully backed”, and they are not the same thing at all: cash cannot fall 40%. The practical questions for any stablecoin are what the collateral is, who has audited it, and whether you can redeem directly or only sell on a market — and if a stablecoin is backed by its own project’s token, the collateral falls at exactly the moment redemptions arrive.
If not: ValueError: Invalid format specifier means the
:>6.1% was mistyped. The conditional inside the f-string needs its own quotes
to differ from the ones wrapping the string.
Go: same folder. Your wallet shows coins and tokens in one list, which hides an important difference.
Do: save this as token.py and run it.
class Chain:
"""The chain knows about ONE native coin, and about contracts."""
def __init__(self):
self.native = {"alice": 10.0, "bob": 2.0} # the coin itself
self.contracts = {}
class TokenContract:
"""A token is a table INSIDE a contract, not a thing the chain knows about."""
def __init__(self, name, owner):
self.name, self.owner = name, owner
self.balances = {"alice": 500.0}
chain = Chain()
chain.contracts["0xTOKEN"] = TokenContract("MyToken", owner="dev")
print("alice's coins (the chain itself) :", chain.native["alice"])
print("alice's MyToken (a contract row) :", chain.contracts["0xTOKEN"].balances["alice"])
print()
print("if the contract disappears, so does every MyToken balance:")
del chain.contracts["0xTOKEN"]
print(" alice's coins :", chain.native["alice"])
print(" alice's MyToken :", "the contract no longer exists")
You should see: two balances that look alike in a wallet and are not:
alice's coins (the chain itself) : 10.0
alice's MyToken (a contract row) : 500.0
if the contract disappears, so does every MyToken balance:
alice's coins : 10.0
alice's MyToken : the contract no longer exists
That is the coin-versus-token distinction, made concrete. A coin is what the network itself accounts for; a token is a row in somebody’s program running on that network, and it inherits every power that program’s author kept. The blockchain will faithfully protect your token balance from everyone except the contract that defines it.
If not: KeyError: '0xTOKEN' on the line before the deletion
means the contract was registered under a different name — the two strings must
match.
Go: same folder. People say the artwork is “on the blockchain”. Print the record and see.
Do: save this as nft.py and run it.
nft = {"token_id": 4171, "owner": "alice",
"metadata_uri": "https://some-startup.example/api/nft/4171.json"}
print("what the blockchain actually stores:")
for key, value in nft.items():
print(f" {key:14s}: {value}")
print()
print("where the picture lives: at that URL, on somebody's web server")
print("if that server goes away, the chain still says alice owns token 4171,")
print("and nothing on the chain can tell you what it looked like")
You should see: three fields, none of which is an image:
what the blockchain actually stores:
token_id : 4171
owner : alice
metadata_uri : https://some-startup.example/api/nft/4171.json
where the picture lives: at that URL, on somebody's web server
if that server goes away, the chain still says alice owns token 4171,
and nothing on the chain can tell you what it looked like
The chain guarantees ownership of a number, permanently and provably. What that number points at is an ordinary web address, subject to expiring domains, shut-down startups and edited files. Some projects store the image on content-addressed storage, where the address is a hash of the file so it cannot be swapped — that is a meaningful difference and worth checking before buying. The question to ask of any NFT is not “is it on the blockchain” but “what exactly is, and who controls the rest?”
If not: if the dictionary prints on one line, the loop was replaced by a
single print(nft) — the point is to see the fields separately.
Without scrolling up: someone offers you a “coin” with a fixed supply of one billion, held in a wallet you already use, on a well-known blockchain. Which of steps 1 to 5 tells you the most important question to ask, and what is it? Answer: step 4. Almost certainly this is a token — a table inside a contract on that blockchain — not a coin the network accounts for, and the security of the well-known blockchain says nothing about the contract’s rules. The question is who controls that contract and what powers it kept: whether the supply can be increased, whether transfers can be blocked, and whether anyone can change those answers later. “Fixed supply” is a property of the code, and code with an owner can be changed.
Now do it without the page: change supply.py so the halving
happens every 105,000 blocks instead of 210,000, and predict the total before you run it.
Then work out why the answer is what it is. You will have understood something most holders
never do: the cap is set by the ratio in the schedule, not by anybody choosing a
number.
Summary
- Bitcoin is the most established cryptocurrency with the strongest security track record
- Ethereum enables smart contracts, which add functionality but also add smart contract risk
- Stablecoins vary dramatically in risk depending on their backing mechanism
- Privacy coins offer financial privacy but face regulatory challenges
- Tokens inherit risk from both the host blockchain and their own smart contract code
- DeFi and NFTs introduce additional layers of complexity and risk
Understanding these categories will help you assess the security risks of any crypto asset you encounter.