Fidelity Bond

A fidelity bond is a mechanism in which Bitcoin value is deliberately sacrificed or locked up to make a cryptographic identity expensive to obtain, in a way that can be proven to third parties. The sacrifice is what gives the identity weight: anyone can verify on-chain that real value was committed, so creating many fake identities becomes prohibitively costly. Fidelity bonds are best known from JoinMarket, where they protect the CoinJoin marketplace from Sybil attacks, and the construction is standardized in BIP-46. The idea is older than the implementation — making identity costly through provable sacrifice was discussed in Bitcoin's early years — but CoinJoin markets gave it a concrete job.

How the sacrifice is made

The standard construction sends coins to a time-locked address using the OP_CHECKLOCKTIMEVERIFY opcode, so the funds cannot move until a chosen future date. Nothing is burned permanently; what is sacrificed is the time-value of the locked money — the owner gives up liquidity and opportunity for the duration. Bond value scales superlinearly with the sacrifice: a longer lock on a larger amount produces a disproportionately more valuable bond, which deliberately rewards a single committed identity over many small ones. The bond owner advertises the locked output and proves ownership with signatures, all without surrendering control of the coins; when the timelock expires, the coins are simply spendable again and the bond can be renewed.

Sybil resistance in practice

The attack fidelity bonds counter is the Sybil attack on a CoinJoin market: if one adversary can cheaply run most of the liquidity-provider identities in a transaction, the privacy evaporates — the anonymity set looks large but is mostly one watcher. In JoinMarket, takers preferentially select makers weighted by bond value, so to reliably occupy most maker slots an attacker must post bonds competitive with the honest market — meaning an enormous amount of Bitcoin locked for long periods, orders of magnitude more capital than a naive identity-flooding attack would cost. Published analyses put a high-confidence Sybil attack in the range of tens of thousands of BTC locked for months. The attack is not impossible, just visibly expensive, and the required stake sits on-chain where anyone can audit the market's total bonded weight.

Trade-offs and honest limits

Bonds concentrate influence with capital: takers who weight bonds heavily are choosing well-capitalized makers, which trades one risk (cheap Sybils) for another (a wealthy adversary or a small oligopoly of large makers). There is also a privacy wrinkle for the maker — the bond is a persistent public identity linked to locked coins, so maker wallets must be kept rigorously separate from personal funds. And time-locked coins are genuinely illiquid: a maker cannot respond to an emergency by spending the bond. These are accepted costs for a system whose whole point is making honest participation cheaper than deception.

The sovereignty pattern

Fidelity bonds illustrate a recurring theme: using Bitcoin's own scarcity to bootstrap trust without a central registrar. No accounts, no KYC gatekeeper, no reputation database anyone can seize or edit — just provable, expiring commitments recorded on the most auditable ledger there is. It is the same instinct that drives proof-of-work itself: make influence cost something real. They complement other trust-minimized constructs such as the Bitcoin federation model, and they matter to anyone relying on equal-output CoinJoin privacy: the strength of your anonymity set rests on the market's Sybil resistance, and bonds are what make that resistance measurable. As with proof-of-work itself, the elegance is that the deterrent is not a rule enforced by anyone — it is a cost structure, visible to all, that makes the attack a bad trade.