On July 14, 2026, Eli Ben-Sasson — co-inventor of STARK proofs and Zcash co-founder — published a statement that sent shivers through Bitcoin's maximalist wing. He argued that Bitcoin's 21 million supply cap is not a cryptographic constant but a governance parameter. His proposal: a 4% annual tail emission, indexed to coin loss, to replace the disappearing block subsidy. The reaction was immediate and predictable. But the underlying question — can Bitcoin survive on transaction fees alone? — deserves a cold, technical disassembly.
Bitcoin's security budget today is composed almost entirely of block subsidies. Transaction fees account for roughly 2% of miner revenue, near levels seen in 2019. Every four years, the subsidy halves. By 2140, it becomes zero. The common retort is that fees will rise as adoption grows. But that assumes a fee market that has not materialized in 15 years of operation. Ben-Sasson's challenge is not new, but his credentials give it weight. He invented STARKs, the foundation for scalable zero-knowledge proofs. He is not a random Twitter commentator.
The Core: Two Competing Visions Ben-Sasson's model is simple: set an annual inflation target of 4% of current supply. This would mint approximately 840,000 BTC per year at current circulating supply — roughly 2,300 BTC per day. The justification is that 4% approximates the annual coin loss rate from lost private keys, rendering net inflation near zero. But this is a dangerous simplification. Loss rates are not empirically stable; they spike during bull runs and decline in bear markets. A fixed inflation rate that does not adapt to actual loss creates positive net inflation.
If it isn’t formally verified, it’s just hope. Ben-Sasson's proposal has no code, no simulation, no formal analysis of the economic equilibrium. It is a philosophical statement dressed in numeric confidence.
Zcash co-founder Zooko Wilcox offered an alternative: a voluntary burn-and-remint mechanism that preserves the 21 million cap. Under this scheme, users voluntarily destroy ZEC to reduce supply, and the network re-mints equivalent coins over a schedule to fund security. Wilcox points to Shielded Labs' preliminary design, which proposes burning 60% of transaction fees — roughly 210 ZEC per year — to create a self-sustaining cycle. The idea is elegant: reduce supply through usage, then re-issue the same amount. But the implementation is non-trivial. Burning requires a secure function call. Reminting requires a governance mechanism to track how much to issue and to whom. If the code is flawed, an attacker can double-issue or prevent the remint entirely. Code is law, but law is interpretive.
Based on my experience auditing Solidity libraries in 2017, I can tell you that mechanisms involving both burn and mint in the same contract are among the most vulnerable to logic errors. The SafeMath overflow bugs I found were trivial compared to the state management required for a burn-and-remint scheme.
Meanwhile, Sean Bowe's formal verification of the Ironwood pool in Zcash is a genuine technical achievement. Using the Tachyon proving system, he mathematically proved that the pool has no hidden vulnerabilities. This is the kind of rigor that should be standard for all cryptographic protocols. But it is orthogonal to the monetary policy debate. Formally verified code does not make bad economics good.
Contrarian Angle: The Real Blind Spot The mainstream narrative frames this as a threat to Bitcoin's scarcity. I argue the opposite: the real risk is that the debate itself exposes Bitcoin's governance fragility. The network's inability to adapt its monetary policy — even in response to a genuine security crisis — is a structural weakness. If transaction fees remain at 2% for another decade, the security budget will fall below a critical threshold. A determined state actor could then 51% attack the chain for a fraction of its current cost. The market currently prices Bitcoin as if this risk does not exist. But it does.
Zcash's internal split between Ben-Sasson and Wilcox demonstrates that even expert teams cannot agree on a credible path. Wilcox's burn-and-remint is more technically sound but adds governance overhead. Ben-Sasson's inflation is simpler but destroys the very narrative that gives Bitcoin its value. The contrarian insight: the safest path may be to do nothing. But doing nothing is not neutral — it is an active bet that fees will rise. If that bet fails, the consequences are catastrophic.
Monero already runs a permanent tail emission of 0.6 XMR per block. Since 2022, the network has operated without collapse. Its inflation is declining asymptotically to zero. The market has not punished it. This suggests that a predictable, small inflation is viable. But Bitcoin's community worships the 21 million cap as an absolute. Any deviation is heresy. This ideological purity may be the very thing that ultimately undermines the network's security.
Takeaway The standard is obsolete before the mint finishes. The 21 million cap is neither sacred nor mathematically necessary. It is a social contract. The question is not whether Bitcoin will adopt a tail emission — it will not — but whether the operational security of the network will be compromised by ideological rigidity. If transaction fees remain at 2% of miner revenue for another decade, the trade-off becomes stark: accept a small, predictable inflation or gamble on a fee market that may never materialize. For now, the market has chosen rigidity. But as Zcash and Monero demonstrate, there are other ways to skin the cryptographic cat. How much security is a fixed cap worth when the network's survival depends on it?