Origins
Satoshi, the whitepaper and the 2008 financial crisis. It began with distrust of intermediaries: as the financial system exposed one risk after another, the cypherpunks kept asking whether money could exist without any center at all. In late 2008, at the height of the crisis, someone using the name "Satoshi Nakamoto" answered with a nine-page paper. Sixty-four days later came the genesis block.
The whitepaper itself (9-page PDF) · the genesis block’s raw data with the Times headline · original documents behind five of the works Satoshi cited.
Bitcoin did not appear out of nowhere. It is the culmination of thirty years of cryptography and digital-cash attempts, born of a crisis of trust — and its founder ultimately vanished while the system kept running.
The Problem & the Moment
why it happened thenHow the Old World Kept Accounts
Before Bitcoin, how much money you had was decided by a bookkeeper (a bank) — it says you have 100, so you have 100. You had to trust it not to err, cheat, or collapse.
Without that bookkeeper, why would everyone agree on one ledger? That is the question Bitcoin set out to answer.
The 2008 Financial Crisis Wall
Lehman Brothers collapsed, governments bailed out banks at enormous scale, depositors queued at branch doors — in the autumn of 2008 people discovered that the trusted intermediary was itself the risk. The whitepaper was mailed to a cryptography list that autumn; sixty-four days later the genesis block carved that day’s headline about bank bailouts into itself. That sequence is widely cited as evidence of a link between Bitcoin and the crisis; Satoshi left no statement of what the inscription was meant to signify.
- Lehman Brothers files for bankruptcyThe crisis escalates sharply.
- Emergency Economic Stabilization Act signedAuthorizes a large-scale bank bailout.
- Whitepaper releasedSent to a cryptography mailing list.
- Genesis blockCarries that day's headline.
The Byzantine Generals Problem
Several armies surround a city. The generals can communicate only by messenger — and messengers may be delayed, may vanish, and some generals may themselves be traitors. How do they agree on a single moment to attack? In 1982 Lamport and colleagues formalized the question: can a distributed system reach consensus when participants are free to behave arbitrarily badly? In Bitcoin, the generals are bookkeeping computers around the world that do not know one another, and what they must agree on is which ledger counts. Satoshi said plainly that this was the problem Bitcoin set out to solve.
In closed systems with a fixed, known membership, several fault-tolerant solutions followed — the original paper itself shows the problem is solvable as long as more than two-thirds are loyal, and PBFT (Castro and Liskov, 1999) made it practical. What remained open was the permissionless case: reaching agreement when participants may join and leave at will and identities cannot be registered. Hall II, The Trust Machine, shows the answer Satoshi gave: not voting, but computation.
Intellectual Lineage
where Bitcoin’s parts came from- CRYPTOGRAPHY
- Diffie–HellmanKeys & signatures
- MerkleMerkle trees
- ChaumBlind signatures
- TIMESTAMPS & CHAINS
- Haber–StornettaTimestamp chain
- Bit GoldChained proof-of-work
- WORK & DIGITAL CASH
- HashcashProof-of-work
- b-moneyLedger & minting
- RPOWTransferable tokens
- 2008BitcoinAssembled into a self-running machine
Foundations of Public-Key Cryptography
The public-key paradigm on which a Bitcoin address and signature rest was laid down in two papers, of 1976 and 1980. They let strangers communicate securely — and prove "I really did sign this" — without ever sharing a secret in advance. The specific algorithms come from elsewhere: signatures use elliptic-curve cryptography proposed from 1985 onward (ECDSA over secp256k1), and addresses also rely on SHA-256 and RIPEMD-160.
New Directions in Cryptography
Diffie and Hellman introduced public/private keys and digital signatures — the paper that opened public-key cryptography. Every Bitcoin address descends from it.
Protocols for Public Key Cryptosystems [7]
Merkle set out public-key distribution protocols and the Merkle tree, which folds the hashes of vast amounts of data — fingerprints that change completely if a single character changes — layer by layer into one root hash; check that one value and any alteration shows up. Whitepaper reference [7].
Timestamping & Hash Chains
The "blockchain" structure itself was not Satoshi’s invention. As early as 1991, two researchers proposed chaining document hashes through time so that any alteration would reveal itself. The whitepaper cites their work three times — the most direct ancestor there is.
Block 0 Valid
— — — —3e35c521Block 1 Valid
3e35c521605283e9Block 2 Valid
605283e9c2b1b709Block 3 Valid
c2b1b7094d845b33How to Time-Stamp a Digital Document [3]
Haber and Stornetta linked document hashes into a chain so that nothing, once written, could be quietly changed. The authors are cited three times in the whitepaper ([3][4][5]) — the direct ancestor of the blockchain’s chained structure.
Design of a Secure Timestamping Service with Minimal Trust Requirements [2]
Massias and colleagues examined how to reduce the trust a timestamping service requires to an absolute minimum — whitepaper reference [2].
The Cypherpunk Movement
In 1992 a mailing list called cypherpunks was founded. Its members held that privacy must be defended with cryptography rather than with law — and sixteen years later, Bitcoin’s whitepaper was sent to a related list frequented by the same circle.
The Crypto Anarchist Manifesto
Tim May foresaw that cryptography would make anonymous transactions and contracts possible, fundamentally altering the shape of states and markets — written two decades before Bitcoin.
A Cypherpunk's Manifesto
Eric Hughes set down the cypherpunk creed: "Privacy is necessary for an open society in the electronic age." Privacy is not secrecy, but the power to choose what you reveal.
cypherpunks mailing list
Where the movement actually happened. Many early attempts at digital cash — Hashcash, b-money — were first published on this list. Archive indexes are in the Library.
Both manifestos are exhibited as historical documents, presented for their place in the history of cryptographic thought. The political positions they advance are the authors' own; the museum does not evaluate them.
Digital Cash Precursors
Every part of Bitcoin had been built by someone before. Of the five below, two (b-money and Hashcash) appear among the whitepaper’s eight references, marked on the cards. Satoshi’s contribution was not inventing the parts, but assembling them into a machine that could run itself.
Blind Signatures for Untraceable Payments
Chaum’s blind signatures let a bank vouch for a coin without seeing it — verifiable and anonymous at once. He went on to found DigiCash, the spiritual ancestor of modern electronic cash.
Hashcash [6]
Back required senders to burn a small, uncheatable amount of computation before sending mail, as an anti-spam measure. Bitcoin borrowed this hash-based proof-of-work almost wholesale. Whitepaper reference [6].
b-money [1]
Wei Dai imagined every participant holding a copy of the ledger, minting money by solving computational puzzles, and collectively enforcing contracts. It is the first work Satoshi cited.
Bit Gold
Szabo (conceived 1998, published on his blog 2005) proposed using computational puzzles to produce "unforgeable costliness", then chaining, timestamping and publicly registering the results — conceptually the closest precursor to Bitcoin.
Reusable Proofs of Work (RPOW)
Finney built reusable, transferable work tokens on top of Hashcash — an early experiment in whether digital scarcity could circulate. Over four years later, he received the first Bitcoin transaction in history.
Why Centralized E-Cash Failed
Digital cash had been made to work before Bitcoin: DigiCash and e-gold both ran and circulated. They ended by different routes. DigiCash went bankrupt after its commercial partnerships and funding fell through; e-gold pleaded guilty to criminal charges in 2008 and suspended transfers in 2009. Both had a single point of failure: when the company failed or was shut down, its users' money went with it.
DigiCash
Chaum’s company held the most advanced anonymous payment technology of its day, yet went bankrupt after its commercial and banking partnerships faltered. However good the technology, once the company is gone, so is the money.
e-gold
A gold-backed digital currency with millions of accounts, which suspended transfers in 2009 after pleading guilty to criminal charges in 2008. Where there is a center, there is a single point that can be taken out.
Szabo put the lesson in a single line: “Trusted third parties are security holes.”
Genesis & Release
how Bitcoin actually landedRegistration of bitcoin.org
The first footprint, earlier than the whitepaper email. On August 18, 2008, the domain bitcoin.org was registered, 74 days before the paper was made public.
Whitepaper Wall
Bitcoin: A Peer-to-Peer Electronic Cash System
Section guide
Brief summaries of the abstract and 12 sections, not the full text. Open the PDFs hosted on bitcoin.org for the complete document.
Abstract
A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution.
1. Introduction
Commerce relies on financial institutions as trusted third parties, inheriting the costs and fraud of the trust model. What is needed is an electronic payment system based on cryptographic proof instead of trust.
2. Transactions
We define an electronic coin as a chain of digital signatures. Each owner transfers the coin by signing a hash of the previous transaction and the next owner's public key.
3. Timestamp Server
A timestamp server takes a hash of a block of items and widely publishes it. Each timestamp includes the previous one, forming a chain.
4. Proof-of-Work
We scan for a nonce until the block's hash has the required leading zero bits. One-CPU-one-vote; the longest chain represents the majority decision and is computationally impractical to alter.
5. Network
New transactions are broadcast to all nodes; each works on finding a proof-of-work for its block, broadcasting it when found. Nodes accept valid blocks and extend the chain.
6. Incentive
The first transaction in a block creates a new coin owned by the block's creator, distributing coins into circulation. Once issuance ends, miners are rewarded by transaction fees.
7. Reclaiming Disk Space
Once a transaction is buried under enough blocks, spent data can be discarded to save space using a Merkle tree, keeping only the root.
8. Simplified Payment Verification
Payments can be verified without running a full node — keep block headers of the longest chain and obtain the Merkle branch linking the transaction to its block.
9. Combining and Splitting Value
Transactions contain multiple inputs and outputs, allowing value to be split and combined.
10. Privacy
Privacy is maintained by keeping public keys anonymous: the public can see transactions, but not who is behind them.
11. Calculations
Even with substantial hashpower, an attacker's probability of catching up and rewriting the chain drops exponentially as honest blocks are added.
12. Conclusion
We have proposed a system for electronic transactions without relying on trust, secured by proof-of-work as long as honest nodes control a majority of CPU power.
The Whitepaper Announcement Email
On October 31, 2008 (UTC), an email titled "Bitcoin P2P e-cash paper" went out to the metzdowd cryptography mailing list. It opened: "I’ve been working on a new electronic cash system that’s fully peer-to-peer, with no trusted third party." Only a handful replied, most of them skeptical.
Genesis Block
On January 3, 2009, the first block of Bitcoin’s ledger was created. Satoshi wrote into it that day’s headline from The Times: “Chancellor on brink of second bailout for banks”.
Bitcoin v0.1 Software Release
On January 8–9, 2009, Satoshi released the first Bitcoin client, on the cryptography mailing list and on SourceForge. Every line of the whitepaper’s design was now code you could download and run — the protocol was no longer a paper but a network in operation.
The First Transaction
January 12, 2009, block 170: Satoshi sent 10 BTC to Hal Finney. This was the first genuine peer-to-peer transfer in Bitcoin’s history — the proof-of-concept moment. Earlier blocks contained only mining rewards; from here on, the system began doing the thing it was designed to do.
Running bitcoin
Two words, one post, an iconic moment. On a day when almost nobody knew Bitcoin existed, Hal Finney became — by his own recollection — the first person besides Satoshi to run the software. He would go on to receive the first transaction, and died in 2014. The post is still there.
The Founder & the Disappearance
who he was, and what happened after he leftWho is Satoshi
Satoshi Nakamoto’s real identity remains unverified. Set out below are the attributions most often raised in public discussion. For each, the museum exhibits side by side the reasons it is raised, the known counter-evidence or the person’s own response, and its current status. The museum exhibits evidence; it does not judge.
Hal Finney
Nick Szabo
Craig Wright
To date no attribution has been supported by verifiable evidence. The account using the name “Satoshi Nakamoto” made its last public post in December 2010, with its last known private contact in April 2011 (a one-line denial on P2P Foundation in 2014 is of uncertain authenticity); the full archive of its public statements is held in the Library. The museum makes no finding on identity and endorses no attribution.
The Cost of a Misidentification
In 2014 a living engineer with no connection to the matter was named by the press as Satoshi Nakamoto. He is not an attribution; he is the consequence of one.
The press attribution
Newsweek ran a cover story naming Dorian Prentice Satoshi Nakamoto, an engineer in California, as the creator of Bitcoin, resting mainly on his name, where he lived and his career. After publication, reporters gathered outside his home.
The denial
Dorian Nakamoto publicly denied any connection to Bitcoin, saying he had first heard of it some three weeks earlier, when a Newsweek reporter contacted his son. The day after the story, Satoshi’s old account on the P2P Foundation forum posted a denial that the two were the same person; but the account was reported compromised in September 2014, so whether the post came from the original holder cannot be confirmed.
Satoshi Withdraws
In December 2010 Satoshi made a last public post; over the second half of 2010 he had handed control of the code repository and the network alert key to Gavin Andresen, and after a last few private emails in April 2011 he vanished completely. By a statistical inference of Sergio Lerner’s, drawn from the extraNonce patterns of early blocks (the Patoshi pattern), roughly a million early-mined bitcoins have never moved; the inference rests on on-chain analysis and has never been confirmed by him. What he left behind is a network with no owner.
After the founder withdrew, the network kept producing blocks. Before he left, the value-overflow bug of August 2010 (CVE-2010-5139, block 74638) was fixed by Satoshi himself, who shipped 0.3.10 within hours; after he left, the chain split of March 2013 (see BIP 50) was resolved by developers and major pools coordinating a rollback to 0.7. Both times recently recorded blocks were discarded, but the ledger ended up consistent. That history is the field record of what “decentralization” means in practice.
Key Facts
- Whitepaper published 2008-10-31 — 9 pages, by Satoshi Nakamoto.
- Genesis block 2009-01-03, embedding that day's Times headline.
- The genesis reward was 50 BTC — and can never be spent.
- Cypherpunk forerunners: Chaum, Back, Dai, Szabo, Finney.