In short
Nine pages, posted to a cryptography mailing list on the last day of October 2008 under a name nobody has been able to attach to a person. It opens on a complaint, not an invention. Commerce on the internet had come to rely almost entirely on banks and card companies standing between buyer and seller, and the arrangement had a cost that everyone had learned to live with: because any payment could be reversed, nobody could treat one as final. Merchants had to be wary of customers and ask them for more than they needed to know. A percentage of fraud was accepted as unavoidable. Small casual payments were not worth the cost of policing. Cash had none of these problems in person, but no way existed to hand someone cash over a wire without a trusted party in the middle.
The paper proposes the way. A coin becomes a chain of signatures, each owner signing it over to the next. The one thing signatures cannot prove is that the previous owner did not also sign the same coin over to somebody else, so the network keeps a single public history of the order in which payments arrived, and it agrees on that history by work: computers race to find a number that makes a block of transactions hash to a value beginning with enough zeros, and the longest chain of such blocks is the record. Changing the past would mean redoing all the work after it, faster than everyone else combined. The rest of the paper is the plumbing, and then a calculation of exactly how long a shopkeeper has to wait before a payment cannot be taken back.
The thesis
"What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party." — §1, Introduction
The mint
The first idea in the paper is one it inherited. A coin can be a chain of digital signatures: each owner hands it on by signing a hash of the last transaction together with the next owner's public key, and anyone receiving the coin can walk the chain back and check every signature. The trouble is what signatures cannot show. Nothing in the chain proves that an earlier owner did not sign the same coin to two people. The usual fix was a mint, a central authority every coin goes back to after each use, which issues a fresh coin and so knows it was only spent once. The paper's objection to the mint is not that it is inefficient but that it is a bank by another name.
"The problem with this solution is that the fate of the entire money system depends on the company running the mint, with every transaction having to go through them, just like a bank." — §2, Transactions
The way around it is stated in one sentence that turns out to carry the whole design. The only way to confirm that a transaction is absent is to be aware of all of them. So every payment has to be announced to everybody, and the participants need a way of agreeing on a single history of the order in which they arrived. A payee needs proof that, at the time of the payment, the majority of the network agreed it was the first one they had seen. Everything after this is a method for producing that proof without anyone in charge.
The newspaper
The method begins with something older than the internet. A timestamp server takes a hash of a set of documents and publishes it somewhere public and hard to alter later, and the paper's examples are a newspaper and a Usenet post. Whatever went into the hash must have existed when it was printed. Chain the timestamps, so that each one includes the one before it, and every new one reinforces all the earlier ones.
To run that without a newspaper the paper borrows Adam Back's Hashcash. Take the block, add a counter, hash it, and keep changing the counter until the result begins with the required number of zero bits. There is no shortcut; the only way to find such a number is to try. That produces the asymmetry the whole system rests on.
"The average work required is exponential in the number of zero bits required and can be verified by executing a single hash." — §4, Proof-of-Work
Once the work is done the block cannot be changed without doing it again, and as later blocks are chained on, changing an old one means redoing every block after it. The work also answers a question the paper raises and drops in a paragraph: how to hold a vote among strangers. One address, one vote could be bought by anyone able to rent addresses. Work cannot be. The majority is whichever chain has the most work in it, and if honest machines hold most of the computing power, their chain grows fastest and an attacker falls behind. A moving average keeps the puzzle at a target rate of blocks per hour as machines get faster, which is the paper's only concession to the future.
Six steps and a gold mine
The network itself takes six lines to describe. New transactions are broadcast to all nodes. Each node gathers them into a block. Each works to find a proof for its block. Whoever finds one broadcasts it. The others accept it only if every transaction in it is valid and unspent. They signal acceptance by starting on the next block with the accepted one's hash inside it. When two blocks arrive at once the network splits briefly, each side working on the one it heard first while keeping the other in reserve, and the tie is broken by whichever branch grows next. Messages can be lost. A node that misses a block asks for it when the next one arrives and shows the gap. The paper's own word for this is that the network is robust in its unstructured simplicity.
Then it explains why anyone would bother. The first transaction in each block creates new coins and gives them to whoever found the block, and this is where the paper reaches for its one comparison with the physical world.
"The steady addition of a constant of amount of new coins is analogous to gold miners expending resources to add gold to circulation. In our case, it is CPU time and electricity that is expended." — §6, Incentive
Fees do the rest, and once a predetermined number of coins have entered circulation the reward can be fees alone, which the paper calls being completely inflation free. The incentive is also its argument for honesty. A greedy attacker who managed to gather more computing power than everyone else would face a choice between using it to steal back his own payments and using it to mine, and the paper's bet is that he ought to find it more profitable to play by the rules that favour him with more new coins than everyone else combined than to undermine the system and the validity of his own wealth.
Eighty bytes
The paper is short partly because it refuses to worry about things it can compute. Will the record grow too large? Spent transactions can be pruned once buried deep enough, with the transactions in a block hashed into a tree so that only the root need be kept. A block header with nothing in it is about eighty bytes; at one block every ten minutes that is 4.2 megabytes a year, against the two gigabytes of memory a computer shipped with in 2008 and the 1.2 gigabytes a year that Moore's law was adding. Storage, it concludes, should not be a problem even if every header has to be kept in memory.
Must everyone run the whole thing? No. A user can keep only the block headers, ask the network for the branch of the tree that links a payment to its block, and see that the network accepted it and has built on it since. That is weaker than checking for yourself, and the paper says so: the simplified method can be fooled for as long as an attacker can overpower the network, and businesses receiving frequent payments will probably still want to run their own nodes. What about privacy, when every payment is announced to everyone? Keep the keys anonymous and use a fresh pair for each transaction. The public can see that someone sent an amount to someone, as a stock exchange publishes the time and size of every trade without the names. The paper admits the seam in its own proposal: a payment that draws on several inputs reveals that they belonged to one owner, and if that owner's key is ever tied to a name, the linking runs backwards.
The gambler
The last section does the sum. Suppose a seller ships goods and the buyer, who is also secretly a miner, tries to build a rival chain in which the payment goes back to himself. The paper first says what such an attacker cannot do, which is the more important half.
"Even if this is accomplished, it does not throw the system open to arbitrary changes, such as creating value out of thin air or taking money that never belonged to the attacker." — §11, Calculations
He can only try to reverse one of his own recent payments. The race between his chain and the honest one is a random walk, and the chance of his ever catching up from a given deficit is the old problem of a gambler with unlimited credit trying to get back to even against a house edge. With the odds against him, if he does not make a lucky lunge early, his chances become vanishingly small as he falls further behind. The seller's defence is patience: wait until the payment is buried under some number of blocks. The paper then runs the numbers, which is the one place a reader can check it against itself.
Against an attacker holding a tenth of the network, five blocks cuts the odds below one in a thousand. Against a third, twenty-four. Against forty-five percent, three hundred and forty, and at half the curve goes vertical, because at half there is no house edge. The security is not a wall. It is a probability that a patient seller can drive as low as he likes, and a cost the attacker has to keep paying for every minute he tries.
Through the Orenda lens
The paper never uses the word money in the sense we mean it. It is about cash, and about the one thing cash does that no online payment did: settle. Its enemy is not inflation or the central bank but the trusted third party, the mint every coin must be returned to, and the cost it names is the merchant hassling the customer and the small transaction that is not worth making. Read it as an engineering paper about finality and it is complete. Read it looking for a theory of what makes the coin worth anything and you will find one sentence, the gold miners, and it is an analogy rather than an argument.
That sentence is still the hinge of everything we believe about it. Gold is money because getting more of it costs something that cannot be faked, and the paper builds a digital thing with the same property, on purpose, out of electricity. Every other kind of digital record can be copied for nothing, which is why every earlier attempt at digital cash needed someone in charge. Here the cost is the credibility. In my own words, from the book:
"This is the part that took me the longest to understand, and it's the part I find most beautiful. Every other form of digital trust requires trusting someone. Bitcoin replaces that trust with physics. Energy is the bridge between the digital world and the physical world. It's what gives a digital record weight. Substance. Cost."
A farm understands this without being told. Nothing on the place is worth anything that did not cost something to make: a fence line is a week of driving posts, a herd is years of not selling the heifers, topsoil is decades of keeping the ground covered. Anyone can walk the boundary and see the work. What the paper built is a ledger with that quality, where the record of who owns what is anchored to work anyone can verify with a single hash, and where the only way to rewrite it is to outwork everyone who ever contributed. That is a different thing from a promise, and it is the difference between holding a receipt for your savings and holding your savings.
Two honest limits. Rothbard asks, of any money, what it was before it was money, and the paper does not answer him; it describes how the first coins are handed out, not why anyone wanted the first one. The answer came from people, over years, and it is not on these nine pages. And the paper's security rests on one assumption it states plainly and cannot enforce, that most of the computing power stays honest. It gives the attacker a reason to prefer mining to theft and leaves it there. Seventeen years of the reason holding is evidence, not proof, and we should say so.
What's happened since
The network started on 3 January 2009 and the paper's author took part in it for about two years, then stopped, and has not been identified since. Almost every number in the paper turned into a fact. A predetermined number of coins became twenty-one million, with the block reward halving every 210,000 blocks; it was fifty coins when the paper was written and fell to 3.125 in April 2024, so the completely inflation free phase it describes is still more than a century off. The ten minutes held. The disk-space arithmetic held so well that the argument, when it came, was about the opposite constraint: between 2015 and 2017 the network fought over whether to make blocks bigger, and chose not to, which kept a full node cheap enough to run at home and pushed small payments onto layers built above the chain. One CPU, one vote lasted about a year; mining moved to purpose-built machines and then to pools and industrial halls, so the "nodes" of section five split into two jobs, the machines that find blocks and the far larger number that check them. The simplified verification of section eight is most phone wallets. The privacy section's warning about linked keys became an industry, with firms selling exactly that analysis to exchanges and governments. El Salvador made the coin legal tender on 7 September 2021, the United States approved exchange-traded funds holding it on 11 January 2024, and on 6 March 2025 the American government ordered a strategic reserve of it, which is not a development the paper's opening paragraph would have predicted. The fair criticisms are the ones its own text points to: it assumes an honest majority and offers only an incentive to keep it, it assumes fees will one day pay for security and nobody has yet tested that, and it treats the merchant's problem as reversibility when most of what a merchant does with a payment today still runs through a trusted third party on top of the chain. Read it for the mint paragraph and the gambler's table. It is nine pages, and the middle of it is a calculation you can run yourself.