On October 31, 2008, an unknown author posted nine pages to a mailing list. This is the whole thing, section by section, in plain English — plus every paper it cites, and how much of Bitcoin flows from each. Read the original alongside; it's shorter than most terms of service.
☕ 12-minute read
The one big idea
Shorter than an iPhone terms-of-service update. Three words it famously never contains: “blockchain,” “cryptocurrency,” and “21 million” — the supply cap lived in the code, not the paper.
Part I
A purely peer-to-peer version of electronic cash, where the network timestamps transactions into a chain of proof-of-work that can't be changed without redoing all the work. Every big idea in Bitcoin is already here, compressed into nine lines.
Online commerce leans entirely on banks and payment processors, and it works — but reversible payments mean fraud, mediation, and costs that make small casual payments impossible. Satoshi's diagnosis ends with the paper's thesis: an electronic payment system based on cryptographic proof instead of trust.
A coin is defined as a chain of digital signatures: each owner signs it over to the next. The catch is double-spending — how does the receiver know the coin wasn't already spent? The only fix, Satoshi argues, is for everyone to know about every transaction and agree on a single history.
Take a batch of items, hash them, and publish the hash; include each timestamp's predecessor in the next one, and you get a chain where changing anything old breaks everything after it. This is the whitepaper's structural heart — and it's borrowed almost wholesale from two researchers you'll meet in the references below.
To decide who timestamps next without a trusted party, use Hashcash-style computational lotteries. The longest chain represents the most invested work, and honest majority hash power keeps outrunning any attacker. Difficulty self-adjusts to keep the pace steady.
Broadcast transactions; nodes collect them into a block; find the proof-of-work; broadcast the block; other nodes accept it by building on top of it. Nodes vote with their CPU. Missed a block? The chain fills you in when you reconnect. That's it — the entire operating manual fits in half a page.
The first transaction in each block mints new coins for whoever found it — paying volunteers to secure the network, and distributing coins with no central issuer, in one move. Later, fees take over. And the game theory kicker: anyone powerful enough to attack the network would earn more by using that power honestly.
Old transactions can be pruned using Merkle trees, keeping the chain's integrity while discarding spent details. Satoshi even estimates the storage math on 2008 hardware and concludes it's manageable — a charming time capsule of a designer worrying about megabytes.
You don't need the full chain to verify a payment — just the block headers and a Merkle path. Satoshi is describing the phone wallet, a year before smartphones could run one, while honestly noting the tradeoff: full verification is stronger. The node debate, pre-argued.
Transactions have multiple inputs and outputs, so coins can be combined and split like bills and change. This unglamorous section defines the UTXO model that still confuses every newcomer's wallet balance today.
The traditional model hides transactions behind institutions; Bitcoin inverts it — all transactions are public, but identities aren't attached. Use a fresh key per transaction, Satoshi advises, and note the limits. The most misunderstood section: Bitcoin was never designed to be anonymous, and its author said so on page six.
Using gambler's-ruin probability, Satoshi computes an attacker's odds of rewriting history: they drop exponentially with each confirmation. The famous tables in this section are why “wait six confirmations” became folk wisdom. The citation for this math is a 1957 probability textbook — the paper's most delightful reference.
One paragraph: we've proposed electronic transactions without trust, the network is simple and robust, nodes work with little coordination and vote with CPU power. No grand claims, no roadmap, no token sale. The paper ends the way it began — like an engineering memo that happened to reinvent money.
Part II
The bibliography is a confession of sources — and reading it dissolves the myth of the lone genius. Satoshi cited exactly eight works. Grouped and graded by how much of Bitcoin flows from each:
The first citation, and the philosophical anchor: Wei Dai's unbuilt proposal for anonymous, distributed electronic cash where every participant keeps the ledger and enforces the rules. It had gaps — no working consensus mechanism — but the destination was fully described a decade early.
The vision. Bitcoin's founding concept — money created and enforced by an anonymous collective instead of an institution — is b-money's premise made real. Dai sketched it; Satoshi engineered it, cited it first, and emailed Dai before publishing.
Three of the eight citations — the most-cited authors in the whitepaper — for one idea: chain documents together with hashes so history can't be quietly rewritten. The best part: their system has been running since 1995 by publishing a weekly hash in the classified ads of The New York Times. The blockchain is older than Google, and it lives in a newspaper.
The skeleton. The chained-hash structure everyone now calls “blockchain” is Haber & Stornetta's 1991 invention, nearly verbatim — Satoshi cited them three separate times, more than anyone else. Sections 3 and 7 of the whitepaper are their work with a lottery attached.
A Belgian research-group paper on lowering how much trust a timestamping service requires — exactly the direction Bitcoin would take to its logical conclusion: minimal trust became no trust.
A supporting beam. Refinements to the same timestamping idea — evidence Satoshi had surveyed the whole field, not just the famous papers.
Adam Back's anti-spam scheme: force senders to burn a little computation per email. It failed at fixing email and succeeded at something bigger — proving that computational work can be a currency of credibility. Satoshi's twist was attaching it to money and letting difficulty self-adjust.
The engine. Bitcoin's proof-of-work is Hashcash, repurposed — Section 4 says so by name. Back built the piston; Satoshi built the car around it.
Ralph Merkle — a founding father of public-key cryptography — invented the tree structure that bears his name in this paper. Every block header ever mined contains a Merkle root; your phone wallet works because of a data structure from 1980.
The filing system. Merkle trees let Bitcoin summarize thousands of transactions in one fingerprint — enabling pruning (Section 7) and light wallets (Section 8). Quiet, structural, everywhere.
The whitepaper's most charming citation: a classic university probability textbook, older than the internet, used for the gambler's-ruin math in Section 11. The security of a trillion-dollar network rests partly on homework math from 1957 — which is exactly the point. Bitcoin didn't invent new magic; it assembled old, boring, battle-tested truths.
The safety math. One section's worth of flow — but it's the section that lets everyone sleep: the proof that attackers fall exponentially behind.