Researchers spent over 15 years carefully analyzing Satoshi's emails, code commit records, and PDF metadata, yet their findings were rarely reported by mainstream media.
Listen to the articleAdd us on Google
Share

Key Takeaways
- Key points:
- An email sent to Malmi in 2010 confirmed that he had received a $3,500 cash donation, which was used to fund Bitcoin's early network infrastructure.
- Researcher Sergio Demian Lerner found through Patoshi analysis that about 1 million bitcoins are linked to an early miner whose bitcoins have not been spent as of 2026.
- At the end of 2010, Satoshi Nakamoto handed over server and media affairs to Gavin Andresen, and subsequently sent his last known email in April 2011.
By reviewing the whitepaper's PDF metadata, source code submission records, private emails, forum archives, and blockchain data, researchers sketched a portrait of Bitcoin creators that far surpassed basic understanding. Here are 25 of the least well-known verified findings, derived from stylistic analysis, developer communication records, and on-chain forensics.
Metadata clues
- Research shows that the PDF files of the Bitcoin white paper were created using OpenOffice.org 2.4. Whether in the October 2008 draft or the official version released in March 2009, the document attributes show the "Creator" section as "Writer" and the "Creator" section as "OpenOffice.org 2.4"—a detail rarely mentioned in mainstream reports.
- For example,
- The draft PDF file from October 2008 exhibited an abnormal time zone deviation. The CreationDate timestamp shows 20081003134958-07'00' (Mountain Standard Time), but October 3, 2008, during daylight saving time, should be -06'00' Mountain Time. Researchers attribute this inconsistency to clock configuration errors, OpenOffice vulnerabilities, or deliberate confusion.
- Later source code submissions adopted British Daylight Saving Time offset values. SVN submissions from late 2009 and 2010 showed +0100 (winter) and +0000 (summer), consistent with British Standard Time, while early US mountain time signals in PDF files sharply contrasted with this.
Code fingerprint
- Reportedly, the original C++ source code adopted Hungarian naming conventions for variable naming, such as using prefixes like psz (string pointer) in files like base58.h. By 2008, this convention had become largely outdated among developers and had shifted to the habits of early Windows C++ programming.
- Early pre-alpha draft versions proposed a block reward of 10,000 BTC instead of 50 BTC. A 2008 draft also kept satoshi to four decimal places (instead of eight) and adopted a different total supply mechanism. All these parameters were changed before the release of the v0.1 public beta.
- The term "blockchain" does not appear in Satoshi Nakamoto's original work. In white papers and early communications, "chain of blocks" or "block chain" were consistently used. This compound word only began to be widely used around 2014 to 2016.
- Satoshi Nakamoto chose JSON-RPC over XML-RPC for the Bitcoin API precisely because the available C++ XML-RPC inventory at the time was due to vulnerabilities or problematic dependencies. He made this clear in a 2010 email to developer Martti Malmi.
- Satoshi mainly uses MinGW as the Windows compiler, reserving Visual C++ only for debugging.
Email and forum behavior
- In May 2009, Satoshi Nakamoto told Marty Marmi that writing was his weakness. His exact words were: "My writing skills aren't high; I'm better at programming." "From the very beginning, he invited Malmi to help write the website copy.
- Satoshi places great importance on search engine optimization (SEO) and personally planned the careful migration of the Bitcoin official website (bitcoin.org) to protect its Google page ranking (PageRank). Sirius's 2010 email revealed that he had developed a multi-step plan aimed at gradually changing the website's IP address and content, thereby preventing search engines from treating it as new.
- Sirius's email also shows that Satoshi Nakamoto coordinated a $3,500 cash donation, which was mailed to Malmi in Finland. Later, he dedicated $1,000 of that money to support Malmi's Bitcoin trading services.
- On August 15, 2010, Satoshi Nakamoto issued a public alert across the internet about a critical vulnerability. He warned on the Bitcoin mailing list: "Do not trust any transactions occurring after 17:05 UTC (block 74638) on August 15, 2010 until the issue is resolved." ”
- In spring 2010, Satoshi Nakamoto was offline for about six weeks without checking emails. He acknowledged this gap in a message from May 2010: "For the past month and a half, I've been busy with other things. I just downloaded emails from early April," he told Malmi.
- Satoshi Nakamoto personally edited the PHP source code for the bitcoin.org SMF forum, configured CSS, installed plugins via SSH, and set DNS records for the forum.bitcoin.org.
- In a January 2011 email, Naka confirmed that the Bitcoin White Paper was published in 2008 rather than 2009, and pointed out that Wikipedia's date records at the time were incorrect.
Identity and anonymity
- Satoshi Nakamoto's birth date recorded in his P2P Foundation profile is April 5, 1975, and his residence is in Japan. For many speculators, April 5 alludes to U.S. Executive Order 6102 of 1933 (which prohibits private possession of gold), so this date is widely interpreted as a deliberate symbol.
- Satoshi Nakamoto uses the DD/MM/YYYY date format in all his communications, a practice more common in the UK and Commonwealth countries rather than the US.
- A manual review of Satoshi Nakamoto's manuscript found 108 American/British spelling discrepancies: 52 in American English, 35 in British English, and 21 obvious spelling errors, contradicting the common claim that he always used British English.
- In about 15 documented cases in Nakamoto, Satoshi Nakamoto consistently uses the word form "cannot." The binary form "can not" does not appear in any known works.
- In Satoshi Nakamoto's writing, the proportion of double line spacing after periods is about 81% to 86%, an early typing habit that has been marked as a unique feature in multiple stylistic analyses.
Project decision-making and handover
- Satoshi Nakamoto deliberately downplayed Bitcoin's anonymity in public information, instructing Malmi to replace "anonymity" with "pseudonym" as a guiding principle. His reasoning was: "Anonymous sounds a bit suspicious." ”
- Satoshi Nakamoto warned that Bitcoin (BTC) should not be referred to as an "investment" in any official materials. In a 2009 email, he asked Malmi to delete the description of Bitcoin as people should "regard as ...... The key points of "an investment" state that this move carries legal risks.
- Before pushing updates to the network, Zhongjiang conducted local stress tests on Bitcoin's code, including a test that "continuously generated a large amount of activity and database access."
- Satoshi Nakamoto chose Gavin Andresen instead of Malmi, trusting him with the main server management and media relations responsibilities. He wrote in December 2010: "It should be Gavin who does it." I trust him; he is responsible, professional, and much stronger than I am in Linux technology. ”
- Researcher Sergio Demian Lerner identified a mining pattern he calls "Patoshi," a unique ExtraNonce fingerprint that runs through early Coinbase transactions starting with Block 1. It is estimated that entities associated with this model mined about 1 million to 1.1 million BTC between 2009 and 2010. As of June 2026, none of these Bitcoins have been transferred.

