IOTA (technology)

• 1. Introduction

  ›

  IOTA is a distributed ledger and cryptocurrency built for the Internet of things, and its total token supply sits at a fixed 2,779,530,283,277,761 units. There are no miners on this network, and no transaction fees either. Instead of a blockchain, IOTA arranges transactions along a structure called the Tangle, built as a directed acyclic graph rather than a chain of blocks. That design was meant to enable free microtransactions between sensors, appliances, and machines. Yet a single node called the coordinator, operated by the IOTA Foundation, still holds the whole network together. Why would a system built to remove central authority still depend on one machine? And why have researchers spent years questioning whether IOTA's underlying design can be trusted at all?

• 2. The Tangle

  ›

  Every new transaction on the network must confirm two transactions that were submitted earlier, a rule that replaces mining entirely. Network participants, rather than a specialized class of miners, carry the job of validating each other's transfers. To stop the network from being flooded with spam, every transaction still has to solve a Proof of Work puzzle. It is a small cryptographic problem that costs computational effort to work out.

  A second layer protocol lets IOTA carry data as well as tokens, encrypting and authenticating messages sent across the Tangle. Each message is stored as a zero-value transaction and points to the address of the next one, chaining them into a continuous data stream. Only someone holding the correct decryption key can follow that stream from their point of entry onward. If the stream's owner wants to cut off access, they can publish a new message under a changed key. Anyone reading from that point forward is locked out, while what came before stays viewable to those who already had access. The result is granular control over exactly who can follow a device's data, and when.

  That fine-grained approach to data control was only one part of an ambitious design that a small team first had to turn into working code.

• 3. Founders And The Foundation

  ›

  David Sønstebø, Dominik Schiener, Sergey Ivancheglo, and Serguei Popov created IOTA in 2015, naming it after iota, the smallest letter of the Greek alphabet. Development was funded through an online public crowdsale, where participants bought the IOTA token using other digital currencies. The sale raised approximately 1,300 BTC, worth around US$500,000 at the time, and the full token supply was distributed pro-rata among those early investors. The IOTA network went live in 2016.

  In 2017, early token investors donated 5 percent of the total supply to fund continued development, seeding what would become the IOTA Foundation. The Foundation was chartered the following year as a Stiftung in Berlin, tasked with research, education, and standardisation work around IOTA. It joined the International Association for Trusted Blockchain Applications as a board member. It also became a founding member of both the Trusted IoT Alliance and the Mobility Open Blockchain Initiative.

  Sergey Ivancheglo resigned from the board of directors on the 23rd of June 2019, following a dispute with fellow founder David Sønstebø. On the 10th of December 2020, the Foundation's board and supervisory board announced that they had officially parted ways with Sønstebø as well.

  In November 2023, a separate body called the IOTA Ecosystem DLT Foundation was created in the United Arab Emirates. It was aimed at growing IOTA's technology across the Middle East. It became the first crypto-centric organization approved by regulators of the Abu Dhabi Global Market. Later in 2024, IOTA was certified as a Sharia-compliant company. That same year, the Imperial IOTA Infrastructures Lab, known as the I3-Lab, launched at Imperial College London. The Foundation committed £1 million toward it, with the college providing additional funding for research into circular economy models.

  That later research agenda sat far removed from IOTA's rockier early years, when outside cryptographers were still challenging the network's basic design.

• 4. Security Disclosure And Backlash

  ›

  On the 8th of September 2017, researcher Ethan Heilman of Boston University reported potential security flaws in IOTA's Curl-P-27 hash function. He worked alongside Neha Nerula and colleagues at MIT's Digital Currency Initiative. The Foundation's handling of that disclosure drew heavy criticism. FT Alphaville reported that an IOTA founder pursued legal action against one of the researchers over his role in the report.

  That same coverage described aggressive language directed at a Forbes contributor and other unnamed journalists who covered the disclosure. In response, the Center for Blockchain Technologies at University College London severed its ties with the IOTA Foundation. It cited the legal threats made against the security researchers.

  That kind of criticism over the network's unusual design would eventually push the Foundation to rewrite significant parts of the protocol from scratch.

• 5. Thefts And Coordinator Shutdown

  ›

  In January 2018, thieves drained more than US$10 million worth of IOTA tokens from users who had generated their wallet seeds through a malicious online seed-creator tool. The scam became the largest fraud in IOTA's history, affecting more than 85 victims. In January 2019, UK and German law enforcement arrested a 36-year-old man from Oxford, England, believed to be responsible for the theft.

  On the 26th of November 2019, a hacker exploited a vulnerability in a third-party payment service from MoonPay that was integrated into IOTA's official wallet. The attacker compromised more than 50 IOTA seeds, stealing roughly US$2 million worth of tokens. After reports surfaced that hackers were pulling funds from more user wallets, the IOTA Foundation shut down the coordinator on the 12th of February 2020. Because the coordinator validates every transaction, that decision effectively halted the entire IOTA cryptocurrency.

  Users judged to be at risk were given until the 7th of March 2020 to migrate any potentially compromised seed to a new one. The coordinator came back online on the 10th of March 2020.

  The coordinator carries out its role by issuing zero-value transactions at set intervals called milestones. Any transfer that a milestone directly or indirectly references is treated as valid by every other node on the network. That is exactly why turning the coordinator off had frozen the whole system.

• 6. Rebuilding The Protocol

  ›

  In 2019, the IOTA Foundation announced plans to eventually run the network without a coordinator, splitting the effort into two stages named Chrysalis and Coordicide. Chrysalis, also called IOTA 1.5, went live on the 28th of April 2021. The update dropped earlier, more controversial design choices, including ternary encoding and Winternitz one-time signatures meant to resist quantum computers. In their place, IOTA adopted established technical standards.

  Coordicide, or IOTA 2.0, aims to go further still by removing the coordinator from the consensus process altogether. A testnet for Coordicide was deployed in late 2020, with the Foundation targeting a final release sometime in 2021.

  Removing the coordinator raises a separate problem: how to stop someone from spending the same tokens twice. Bitcoin solves that with Proof of Work, making a rejected block financially painful to produce. IOTA's answer is a voting mechanism called Fast Probabilistic Consensus. Nodes exchange opinions on which of two conflicting transactions is valid, until the network converges on one answer. The threshold that decides a majority is randomized using a Decentralized Random Number Generator, making the vote harder for an attacker to manipulate. Proof of Work still plays a role in IOTA, but only to control the rate of transactions, not to settle disputes between them. As a result, the network's energy use per transaction stays extremely small.

  None of this technical redesign has stopped outside companies from building on IOTA in the meantime.

• 7. Real World Partnerships

  ›

  Jaguar Land Rover, STMicroelectronics, and Bosch have all built proof-of-concepts on IOTA within the automotive and IoT industries. IOTA also appears in smart city testbeds, supporting digital identity systems, waste management, and local trade of energy. Under the Linux Foundation's Project Alvarium, IOTA serves as an immutable storage and validation layer. The privacy-focused search engine Xayn uses IOTA as a trust anchor for its aggregated AI model.

  In 2024, IOTA partnered with Eviden, an Atos Group company, to launch the Eviden Digital Passport Solution. The service tracks the life cycle and carbon footprint of automotive batteries, covering everything from raw materials to manufacturing, usage, and repairs. On the 11th of February 2020, the Eclipse Foundation and the IOTA Foundation jointly launched the Tangle EE Working Group. It was aimed at helping larger organizations build enterprise applications on top of IOTA, under a vendor-neutral governance framework.

  Not every announcement was well received. In 2017, IOTA launched a data marketplace, a pilot letting connected sensors and devices store, sell, or purchase data. The cryptocurrency community criticized the marketplace, with some suggesting that the IOTA Foundation had actively asked publications to invoke Microsoft's name after the announcement. Izabella Kaminska was skeptical of a related Jaguar press release, writing that "our interpretation is that it's very unlikely Jaguar will be bringing a smart-wallet-enabled marketplace any time soon."

  IOTA trades in megaIOTA units, each equal to 1,000,000 IOTA tokens, on exchanges such as Bitfinex under the ticker symbol MIOTA. Like other digital currencies, its market value has both soared and fallen sharply.

  That volatility has done little to settle a deeper question still hanging over the project: whether its core design can be trusted at all.

• 8. Lingering Doubts

  ›

  Polychain Capital founder Olaf Carlson-Wee argued that IOTA's decentralization claim does not hold up in practice. Carlson-Wee said, "IOTA is not decentralized, even though IOTA makes that claim, because it has a central 'coordinator node' that the network needs to operate. If a regulator or a hacker shut down the coordinator node, the network would go down."

  Carlson-Wee's warning played out in what became known as the Trinity attack incident. After a separate vulnerability was discovered in October 2017, the Foundation transferred potentially compromised funds into addresses under its own control. It then set up a process for affected users to apply directly to the Foundation to reclaim them.

  Attackers have also used distraction as a tactic. During the early stages of the seed-generator scam, a DDoS attack on IOTA's network kept administrators busy, leaving the initial thefts undetected for a time. The network has also suffered several outages tied to bugs in the coordinator itself, along with further DDoS attacks unrelated to that scam. In 2020, the Foundation reiterated its ambition to run IOTA without a coordinator eventually. At that point, though, the effort remained in an early stage of development.

  The deeper worry sits in the Internet of things itself. Many of the devices IOTA was built to serve, sensors and simple embedded chips, have only modest computational power. If an attacker ever commanded resources far beyond what those ordinary devices can muster, the Tangle's security model could be pushed past its limits. That is precisely the scenario Coordicide was designed to prevent.