Skip to content

Types of Cryptocurrencies

💡
Before you start

Python 3 and a terminal, nothing more. macOS and Linux include Python; on Windows install it from python.org with “Add python.exe to PATH” ticked. Check with python3 --version. No libraries, no accounts, no internet.

The categories in this article are not marketing labels — each one is a different set of rules, and the rules are arithmetic you can run. Over the next twenty minutes you will derive Bitcoin’s famous supply limit rather than being told it, watch inflation dilute a holding, test a stablecoin’s backing, and find out what your wallet is really showing you when it displays a token or an NFT.

Not All Cryptocurrencies Are the Same

There are thousands of cryptocurrencies, but they are not all created equal. They differ in purpose, technology, security model, and risk profile. Understanding these differences is critical for making informed security decisions about which assets you interact with and how you protect them.

Bitcoin (BTC)

Bitcoin was the first cryptocurrency, launched in 2009. It is designed primarily as a decentralized digital currency and store of value.

  • Consensus: Proof of Work (the most battle-tested blockchain)
  • Supply: Hard-capped at 21 million coins — no more can ever be created
  • Security track record: The Bitcoin network itself has never been successfully hacked. Losses have come from exchange hacks, user error, and lost private keys
  • Privacy: Pseudonymous, not anonymous. All transactions are publicly visible on the blockchain and can be traced with analysis tools

Ethereum (ETH) and Smart Contracts

Ethereum extends blockchain beyond simple transfers by supporting smart contracts — self-executing programs that run on the blockchain.

  • Consensus: Proof of Stake (since September 2022)
  • Smart contracts: Enable decentralized applications (dApps), DeFi protocols, NFTs, and more
  • Security implications: Smart contract bugs can lead to massive fund losses. Unlike traditional software bugs, exploited smart contracts often cannot be patched because the code is immutable on-chain
  • Gas fees: Every operation on Ethereum costs "gas," which can spike during high demand
⚠️
Smart contracts can contain bugs

Billions of dollars have been lost to smart contract exploits. A contract being "on the blockchain" does not mean it is safe or audited. Always research whether a contract has been professionally audited before interacting with it.

Stablecoins

Stablecoins are cryptocurrencies designed to maintain a stable value, typically pegged 1:1 to a fiat currency like the US dollar.

Fiat-backed (e.g., USDC, USDT) Each token is supposedly backed by real dollars held in reserve. Trust depends on the issuer's transparency and audit quality. USDT (Tether) has faced repeated questions about the adequacy of its reserves.
Crypto-backed (e.g., DAI) Backed by cryptocurrency collateral locked in smart contracts, typically over-collateralized. More transparent but vulnerable to smart contract risk and collateral price crashes.
Algorithmic Use algorithms to maintain the peg without direct collateral. These have a history of catastrophic failures — in May 2022 TerraUSD (UST) depegged from the US dollar and the price of it and its sister tokens plummeted to close to zero, according to the SEC's fraud complaint against Terraform Labs (SEC press release 2023-32, accessed 4 September 2026).

Privacy Coins

Privacy coins are designed to make transactions untraceable, unlike Bitcoin where all transactions are publicly visible.

  • Monero (XMR) — uses ring signatures, stealth addresses, and RingCT to hide sender, receiver, and amount by default
  • Zcash (ZEC) — uses zero-knowledge proofs (zk-SNARKs) to enable private transactions, but privacy is optional, not default
💡
Privacy is a spectrum

Privacy coins are legitimate tools for financial privacy, but they are increasingly delisted from regulated exchanges due to compliance concerns. Consider the legal landscape in your jurisdiction before using them.

Tokens vs Coins

This distinction matters for security:

  • Coins (BTC, ETH, XMR) run on their own blockchain. Their security depends on the blockchain's consensus mechanism.
  • Tokens (USDC, UNI, LINK) run on top of another blockchain, usually Ethereum. Their security depends on both the underlying blockchain AND the token's smart contract code.

Anyone can create a token on Ethereum in minutes with minimal technical skill. This is why the vast majority of scam projects are tokens, not coins.

DeFi Tokens

Decentralized Finance (DeFi) tokens represent participation in protocols that replicate financial services (lending, borrowing, trading) without intermediaries.

  • Governance tokens let holders vote on protocol changes
  • Liquidity provider tokens represent your share of a trading pool
  • Yield farming rewards users with tokens for providing liquidity

DeFi carries compounded risk: smart contract bugs, oracle manipulation, flash loan attacks, and rug pulls. Many DeFi protocols are unaudited or use forked code that may contain hidden vulnerabilities.

NFTs (Non-Fungible Tokens)

NFTs are unique tokens that represent ownership of a specific digital item. From a security perspective:

  • The token is on-chain, but the actual image or media is usually stored off-chain (often on centralized servers or IPFS). If the hosting disappears, the NFT points to nothing.
  • NFT phishing is rampant — fake minting sites, malicious smart contract approvals, and social engineering are common attack vectors
  • Wash trading (buying and selling to yourself) artificially inflates perceived value

Now Derive the Differences Yourself, in Five Steps

“There will only ever be 21 million bitcoin” is repeated constantly and almost never checked. In the next twenty minutes you will compute it from the issuance rule and see the number appear, then run the same kind of arithmetic on an inflationary coin, a stablecoin’s collateral, a token and an NFT — each of which turns out to be a very different kind of thing from the others. Every figure below came from running these files.

1
Derive the 21 million

Go: open a terminal in a folder you can write to, e.g. cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).

Do: save this as supply.py and run python3 supply.py. The whole rule is: 50 coins per block, halving every 210,000 blocks, forever.

reward = 50.0                 # coins per block at the start
BLOCKS_PER_ERA = 210_000      # the halving interval

total, era = 0.0, 0
while reward > 0.00000001:
    total += reward * BLOCKS_PER_ERA
    era += 1
    reward /= 2
    if era <= 4 or era == 33:
        print(f"after era {era:>2}: {total:>14,.0f} coins issued, next reward {reward:g}")

print(f"\ntotal ever issued: {total:,.0f}")

You should see: the famous number falling out of the rule:

after era  1:     10,500,000 coins issued, next reward 25
after era  2:     15,750,000 coins issued, next reward 12.5
after era  3:     18,375,000 coins issued, next reward 6.25
after era  4:     19,687,500 coins issued, next reward 3.125
after era 33:     21,000,000 coins issued, next reward 5.82077e-09

total ever issued: 21,000,000

Look at era 1: half of all the coins that will ever exist were issued in the first period. Nobody decreed “21 million” as a target — it is what a halving schedule adds up to, and it is enforced by every node refusing a block that pays itself more than the rule allows.

If not: if the loop never ends, the halving line is reward / 2 without the assignment — it must be reward /= 2. A total of 42,000,000 means the reward is doubling.

2
Watch inflation move your share without touching your balance

Go: same folder. Most coins are not capped, and that is a design choice rather than a flaw — but it has a consequence worth seeing.

Do: save this as inflation.py and run it. You hold a thousand coins in both worlds and never buy or sell.

capped, inflating = 21_000_000.0, 21_000_000.0
my_coins = 1_000.0

print(f"{'year':>4} {'capped supply':>15} {'your share':>11} | "
      f"{'inflating 5%/yr':>16} {'your share':>11}")
for year in range(0, 21, 5):
    print(f"{year:>4} {capped:>15,.0f} {my_coins / capped:>10.4%} | "
          f"{inflating:>16,.0f} {my_coins / inflating:>10.4%}")
    for _ in range(5):
        inflating *= 1.05

You should see: the same holding meaning steadily less:

year   capped supply  your share |  inflating 5%/yr  your share
   0      21,000,000    0.0048% |       21,000,000    0.0048%
   5      21,000,000    0.0048% |       26,801,913    0.0037%
  10      21,000,000    0.0048% |       34,206,787    0.0029%
  15      21,000,000    0.0048% |       43,657,492    0.0023%
  20      21,000,000    0.0048% |       55,719,252    0.0018%

After twenty years the balance is identical and the ownership share has fallen by more than half. That is the honest way to compare a capped coin with an inflationary one — and it is also why “staking rewards” paid in new coins are not straightforwardly income: if everyone stakes, everyone’s share stays where it started.

If not: if both columns stay identical, the inner loop is not running — the five multiplications must happen inside the year loop, after the print.

3
Test whether a stablecoin is actually backed

Go: same folder. A stablecoin is a promise to redeem one token for one dollar. The question is always what stands behind the promise.

Do: save this as peg.py and run it.

issued = 1_000_000.0            # stablecoins in circulation, each meant to be worth 1 dollar

for name, collateral in (("fully backed in cash", 1_020_000.0),
                         ("backed by volatile assets", 1_500_000.0),
                         ("after those assets fall 40%", 900_000.0)):
    print(f"{name:28s} collateral {collateral:>11,.0f}  "
          f"ratio {collateral / issued:>6.1%}  "
          f"{'each coin is covered' if collateral >= issued else 'NOT every coin can be redeemed'}")

You should see: a comfortable-looking 150% becoming 90% after one bad week:

fully backed in cash         collateral   1,020,000  ratio 102.0%  each coin is covered
backed by volatile assets    collateral   1,500,000  ratio 150.0%  each coin is covered
after those assets fall 40%  collateral     900,000  ratio  90.0%  NOT every coin can be redeemed

Both of the first two lines are “fully backed”, and they are not the same thing at all: cash cannot fall 40%. The practical questions for any stablecoin are what the collateral is, who has audited it, and whether you can redeem directly or only sell on a market — and if a stablecoin is backed by its own project’s token, the collateral falls at exactly the moment redemptions arrive.

If not: ValueError: Invalid format specifier means the :>6.1% was mistyped. The conditional inside the f-string needs its own quotes to differ from the ones wrapping the string.

4
Find out what a token balance really is

Go: same folder. Your wallet shows coins and tokens in one list, which hides an important difference.

Do: save this as token.py and run it.

class Chain:
    """The chain knows about ONE native coin, and about contracts."""
    def __init__(self):
        self.native = {"alice": 10.0, "bob": 2.0}       # the coin itself
        self.contracts = {}

class TokenContract:
    """A token is a table INSIDE a contract, not a thing the chain knows about."""
    def __init__(self, name, owner):
        self.name, self.owner = name, owner
        self.balances = {"alice": 500.0}

chain = Chain()
chain.contracts["0xTOKEN"] = TokenContract("MyToken", owner="dev")

print("alice's coins (the chain itself) :", chain.native["alice"])
print("alice's MyToken (a contract row) :", chain.contracts["0xTOKEN"].balances["alice"])
print()
print("if the contract disappears, so does every MyToken balance:")
del chain.contracts["0xTOKEN"]
print("  alice's coins   :", chain.native["alice"])
print("  alice's MyToken :", "the contract no longer exists")

You should see: two balances that look alike in a wallet and are not:

alice's coins (the chain itself) : 10.0
alice's MyToken (a contract row) : 500.0

if the contract disappears, so does every MyToken balance:
  alice's coins   : 10.0
  alice's MyToken : the contract no longer exists

That is the coin-versus-token distinction, made concrete. A coin is what the network itself accounts for; a token is a row in somebody’s program running on that network, and it inherits every power that program’s author kept. The blockchain will faithfully protect your token balance from everyone except the contract that defines it.

If not: KeyError: '0xTOKEN' on the line before the deletion means the contract was registered under a different name — the two strings must match.

5
Look at what an NFT actually contains

Go: same folder. People say the artwork is “on the blockchain”. Print the record and see.

Do: save this as nft.py and run it.

nft = {"token_id": 4171, "owner": "alice",
       "metadata_uri": "https://some-startup.example/api/nft/4171.json"}

print("what the blockchain actually stores:")
for key, value in nft.items():
    print(f"  {key:14s}: {value}")
print()
print("where the picture lives: at that URL, on somebody's web server")
print("if that server goes away, the chain still says alice owns token 4171,")
print("and nothing on the chain can tell you what it looked like")

You should see: three fields, none of which is an image:

what the blockchain actually stores:
  token_id      : 4171
  owner         : alice
  metadata_uri  : https://some-startup.example/api/nft/4171.json

where the picture lives: at that URL, on somebody's web server
if that server goes away, the chain still says alice owns token 4171,
and nothing on the chain can tell you what it looked like

The chain guarantees ownership of a number, permanently and provably. What that number points at is an ordinary web address, subject to expiring domains, shut-down startups and edited files. Some projects store the image on content-addressed storage, where the address is a hash of the file so it cannot be swapped — that is a meaningful difference and worth checking before buying. The question to ask of any NFT is not “is it on the blockchain” but “what exactly is, and who controls the rest?”

If not: if the dictionary prints on one line, the loop was replaced by a single print(nft) — the point is to see the fields separately.

🎉
Check yourself before moving on

Without scrolling up: someone offers you a “coin” with a fixed supply of one billion, held in a wallet you already use, on a well-known blockchain. Which of steps 1 to 5 tells you the most important question to ask, and what is it? Answer: step 4. Almost certainly this is a token — a table inside a contract on that blockchain — not a coin the network accounts for, and the security of the well-known blockchain says nothing about the contract’s rules. The question is who controls that contract and what powers it kept: whether the supply can be increased, whether transfers can be blocked, and whether anyone can change those answers later. “Fixed supply” is a property of the code, and code with an owner can be changed.

Now do it without the page: change supply.py so the halving happens every 105,000 blocks instead of 210,000, and predict the total before you run it. Then work out why the answer is what it is. You will have understood something most holders never do: the cap is set by the ratio in the schedule, not by anybody choosing a number.

Summary

  • Bitcoin is the most established cryptocurrency with the strongest security track record
  • Ethereum enables smart contracts, which add functionality but also add smart contract risk
  • Stablecoins vary dramatically in risk depending on their backing mechanism
  • Privacy coins offer financial privacy but face regulatory challenges
  • Tokens inherit risk from both the host blockchain and their own smart contract code
  • DeFi and NFTs introduce additional layers of complexity and risk
🎉
You can now distinguish between cryptocurrency types!

Understanding these categories will help you assess the security risks of any crypto asset you encounter.