The verifiable footprint of the original Satoshi

Epistemics

Three tiers of certainty, never blurred.

The evidence

What the chain says — and it lands on Lerner.

Reproduced from a full pull of blocks 0–60,000. The nonce’s low byte is confined to a Patoshi-specific range; the ExtraNonce leaves a machine-like trail. Three independent numbers fall out — and match the canonical 2013 analysis.

Refinement

Removing the chance-passers — and checking the answer against a signal the method never saw.

The nonce test is a necessary condition: ~19.5% of ordinary blocks pass it by luck, so the raw 28,774 over-counts. Two independent estimators strip the luck out — and land one block apart.

Dormancy validation. If the labels are real, confirmed-Patoshi coins should sit unspent while the discarded chance-passers spend at ordinary rates. The classifier reads only block headers — it cannot see spends — so this agreement is corroboration, not circularity.

Spend rate by population. Confirmed-Patoshi is 14× more dormant than background, 6.9× more than the discarded set — ordered exactly as the labels predict. (The residual 6.2% is genuine early Satoshi test-spends, block 9 → Finney among them, plus a little boundary contamination. It isn’t zero, and we don’t pretend it is.)

The cluster did not spend

The usual claim is about balances. This is the same claim measured from the other side — flow.

“~1.1M BTC mined and never moved” is a statement about coins sitting still. It can be turned around: in Bitcoin’s first year, when coins did move, whose were they? Joining the 219 first-year payments to the per-block labels answers it — and the two datasets are independent, because the labels come from nonce and ExtraNonce fields that have nothing to do with keys or addresses.

The question is not ours, and we should say so. Sergio Lerner — who identified the pattern in the first place — asked it directly in 2013, reporting that he saw “only two blocks rewards (100 BTC) that seem to be part of a Satoshi mining pattern being spent”, and quantified it in 2019: “99.9% of all Patoshi blocks are unspent. While only 10% of all non-Patoshi blocks are unspent.” His measurement is per block, across the whole era. The figures below are a different cut — per spent coin, inside the first year’s payments — and they agree with him. Agreement with prior work is a result; pretending the question was new would not be.

If spending had been blind to the label you would expect about 1,367 of those 1,779 spent coins to carry it. 351 do. Coins from the flagged cluster were spent at roughly a quarter of the rate at which the cluster mined — a ~3.9× depletion, and it survives deleting the largest consolidation transactions outright, so it is not an artifact of a few miners sweeping their own wallets.

The correction that made this number honest. Our own label patoshi_confirmed is not “is this a Patoshi block” — it is a high-confidence subset (nonce_lsb_ok AND phi >= CONF), and the phi threshold means it can only ever be set up to about block 24,184, though the era runs to ~54,458. Compare against the whole chain and every later block counts as “not Patoshi” by construction, manufacturing an effect from nothing. Our first run did exactly that and reported a stronger number than the data supports. The figures above are restricted to the label’s valid range with the base rate computed over that same range.

Which way the remaining error points. The label has false positives — blocks flagged that were not the cluster’s. Those make the cluster look like it spent more than it did, so they push this result towards the null. The true depletion is if anything stronger than 3.9×, not weaker. And none of this identifies a person: a cluster label is a statistical fingerprint, not a signature.

Two things that follow, and are worth stating plainly

1. “Old dormant coins” is not one risk class — the script type decides. An early coinbase of this era pays a bare public key (P2PK): the key itself is the output script, so it has been on the chain, in the open, since the day the block was mined. A pay-to-public-key-hash output (P2PKH) publishes only HASH160(pubkey); the public key does not appear until the output is spent.

This matters for any argument about elliptic-curve cryptography being broken. Such an attack needs the public key — it does not invert SHA-256 or RIPEMD-160. So a long-dormant P2PKH balance that has never been spent from has published no key to attack, while a 2009 P2PK coinbase has published one for over a decade. Two balances of the same age can sit in completely different exposure classes, and an argument that treats age as the variable has picked the wrong one.

One precision, because script type is a proxy rather than the thing itself. The variable that actually decides this is public-key exposure state. Script type sets the default — P2PK exposed from creation, P2PKH concealed until spent — but two things move an output out of its default class. Address reuse: once any output paying that key has been spent, the key is public and every remaining output under it is exposed. And a public key is not chain-local: the same key controls the same address on every fork that inherited the UTXO set, so a spend on Bitcoin Cash, Bitcoin Gold or Bitcoin SV publishes the key while the Bitcoin output sits untouched.

⚠️ So “never spent on Bitcoin” is not the same claim as “never exposed”, and only the first of those is answerable from Bitcoin alone. Anyone reasoning about a specific dormant balance has to check the forks too — and can only ever report the chains actually checked.

Prior art, because none of the above is ours. The distinction stated here — that quantum exposure is decided by script type and public-key exposure rather than by how long a balance has sat still — was published before we wrote any of it, and before the July 2025 movement that made it topical. Milton and Shikhelman, Bitcoin and Quantum Computing: Current Status and Future Directions, Chaincode Labs, May 2025 sets out the same taxonomy and the long-range / short-range attack distinction it rests on. Later, clearer statements of the P2PK-versus-P2PKH split appear from Project Eleven (July 2025) and Chainalysis.

★ And one formulation is better than ours, so it is worth borrowing rather than restating. Coin Metrics observes that a Taproot output embeds a tweaked public key directly — so Bitcoin’s newest script type is exposed at rest while a 2011 P2PKH is not. That disposes of the age argument in a single sentence, running down the timeline rather than up it, and needs no reasoning about 2009 at all.

We record this because the rule we apply to everyone else applies here: precedence belongs to whoever published, and a page that states a known result without citing it is claiming something it has not earned. What this site adds is the measured case and the fork-exposure caveat above — not the distinction itself.

2. Inbound transactions say nothing about a holder. Anyone can pay any address, and well-known addresses attract a steady rain of dust and OP_RETURN messages from strangers. Those appear in the address’s transaction history exactly like anything else. An inbound payment is written by the sender, not the recipient — it carries no signature from the key that controls the coins, and it establishes nothing about who does. Only a spend demonstrates key control, and even a spend demonstrates control rather than identity.

Both points are mechanical, checkable against any block explorer, and make no claim about any particular address, holder or dispute.

The judge

Is this coin Satoshi’s?

A Patoshi coin is a coinbase output, so a spend consumes it directly — resolve any “old wallet just moved” event back to its coinbase block and get a verdict. Every case below is the tool’s real output.

This is exactly what shows the 2025–26 250-BTC and 2,000-BTC awakenings were not Satoshi — and what would flag it instantly, unambiguously, if the real cluster ever stirred.

Did they ever put a document on the chain?

They knew exactly how. They wrote out the transaction themselves. They never did it.

This gets asked constantly about the whitepaper, and it is answerable the same way everything else here is — by reading every byte and saying what is not in them. Had Satoshi committed a hash of any document to the chain, it would be the strongest dating evidence that document could ever have: a timestamp its author made, which nobody can backdate. So the absence is worth establishing rather than assuming.

They described the method, in public, on 9 December 2010

On bitcointalk, discussing whether the chain should carry non-payment data:

“Timestamp hashes are still already possible:
txin: 0.01  •  txout: 0.00 <appid, hash> OP_CHECKSIG  •  fee: 0.01
… I like Hal Finney's idea for user-friendly timestamping. Convert the hash of a file to a bitcoin address and send 0.01 to it.”

Finney had proposed that four days earlier, adding — and Satoshi endorsed the method while letting the caveat stand — that it was “arguably not a good use of the Bitcoin distributed database”. So this is not a question of capability or of knowledge. Block 0's own coinbase carries 77 bytes of text, so the field was never too small. It was a choice.

Every channel, scanned

All known whitepaper versions, in both byte orders, under MD5, SHA-1, SHA-256, double-SHA-256 and HASH160 — seventeen distinct byte-strings.

Calibration, because these two hits get retold badly. A payment to a hash-derived address dates possession of a file. It does not attribute anything: anyone can timestamp anyone's document, and Satoshi had been gone nearly three years when the earlier one was made. Embedding is not signing, and neither is timestamping. The same applies to the 2013 transaction that embedded the entire paper in block 230009 — a third party's act, four years after publication.

Why they declined is not a mystery either. They versioned, announced and hashed their code; they linked the paper, revised it at least twice, and never once announced a revision — measured across every surviving corpus of their writing. In their own release announcement the software download comes first and the paper is a footnote they call “the design paper”. The code was the artifact. The paper explained it. You do not commit your documentation to an immutable ledger, least of all while still editing it.

The off-chain record

The chain is not the only place a third party wrote down a timestamp.

Satoshi left a trail on servers they did not run. Those records are worth exactly what recorded them, so each line below is graded the same way the on-chain evidence is — and each is reproducible from a public URL, by anyone, without taking our word for any of it.

Read the anchor column alone and the arc runs 28 months — and not one line of it identifies a person. Every anchored fact is about an artifact or an account. That is not a gap in the research; it is the state of the record.

Three things the record does not support

Stated because they circulate widely, and because a page that only lists what it can prove is more useful when it also lists what it cannot.

Fees, 2009

Eight blocks in Bitcoin’s entire first year collected a transaction fee. The total paid across all of 2009 was 2.87 BTC.

Out of roughly 32,000 blocks. Fees were optional and almost nobody set one, so the whole of the first year’s fee record fits in a table this size. Satoshi described the design to a correspondent in May 2009 — “including a fee is completely optional, more of a donation to nodes for helping out” — and this is what that policy looked like in practice. Every other 2009 block paid exactly 50.00.

One of these eight rows has a name attached to it, and it is the only such row we have. Block 14047 is the +50.10 a private miner wrote to Satoshi about in May 2009 — see the off-chain record for the derivation and its limits. The other seven are unattributed and we make no claim about them.

The first fees were paid on 3 February 2009, and they were a test. Block 2817’s 2.01 is not one fee but three, in the same block — 1.00, 1.00 and 0.01 — and all three transactions have the same address on every input and every output: 1AbHNFdKJeVL8FRZyRZoiTzG9VCmzLrtvm sending to itself, three times, each time moving 1 BTC and paying 1 BTC to do it. The three chain together, each spending the previous one’s change. Someone was trying the software out. The largest single fee of 2009 was therefore 1.00 BTC, on a 1.00 BTC payment — a 50% fee, and evidently not a considered one.

Five of the remaining seven are large consolidations — 101, 111, 121 and 168 inputs, one miner sweeping months of 50 BTC coinbases into a single address. But size alone does not explain them: a 320-input transaction in December 2009 paid nothing, and so did ones with 81, 77 and 74 inputs. Whatever set these fees, it was not a rule the chain applied uniformly. We record the pattern and stop there.

A trap worth naming. Several published early-chain datasets — including an earlier file of our own — carry a coinbase_value column in which every row holds the identical 5000000000. It was assumed at acquisition and never read from the chain. Search such a file for fee-bearing blocks and it returns zero, and the conclusion that invites — no early block ever collected a fee — is false. A column that is really a constant is the kind of error that survives being copied. This table is read from the chain.

The whole first year is 219 payments. For most of 2009 the chain is a near-unbroken run of coinbase-only blocks, so every payment anyone made can be listed exhaustively. By month: 32, 37, 21, 17, 18, 8, 5, 6, 11, 13, 15, 36. The mid-year trough is real; so is the December surge. That exhaustiveness is what makes early claims checkable: when an account says N coins moved on date D, you no longer weigh it against a vast chain — you look at the handful of transactions that existed that week and see whether one fits. Often none does. The list itself is published here as a CSV — block, time, txid, inputs, outputs, amounts, fee — so you do not have to run anything to use it. Read the ordering caveat in the header before pairing addresses with amounts: the amount column is index-ordered and the address columns are not, so identify by elimination (an address appearing on the inputs is taking change) rather than by position.

Prior art, and a correction to what this page used to say. An earlier version of this section claimed the 2009 payment list was unpublished. That was wrong. Bitcointalk user TheArchaeologist enumerated “all the transactions performed in 2009” in topic 5044418 on 5 October 2018, and the exact figure of 219 non-coinbase transactions appears in the BTC Core Developers’ closing submissions in COPA v Wright and again at paragraph 716 of the judgment (2024). Earlier still, user molecular published a Bitcoin-Abe analysis on 15 August 2011 reporting 1,624,252.87 BTC (2.87 BTC fees) — topic 37333. That 2011 post also had the fee total right when we had it wrong. What remains ours is the reproducible query and the cross-checked CSV, not the discovery.

The timeline

Every dated event we can stand behind, in one place — with the ones we cannot verify shown alongside them.

Three views over one file: Satoshi, Bitcoin, and combined. Each row carries an evidence grade and, where one exists, the command that regenerates it. Rows marked NOT HELD are events we can date and source but whose artifact we do not possess — the 11 November 2008 whitepaper, the lost pre-release builds. A timeline showing only what was found looks complete when it is not, and this one states its own coverage in numbers.

The line

No genesis-era or Patoshi key has ever produced a verifying signature. Only that would turn attributable into proven. The ≈1.13M BTC staying silent for fifteen years is itself the strongest statement: the keys don’t speak — and no impostor can make them.