Nakamoto or Not? 2009-Mined BTC, Craig Wright, the Patoshi Pattern and Bitcoin’s Mysterious Creator

okx learn
OKX Learn

Reverence for its anonymous creator, Satoshi Nakamoto, is at the heart of Bitcoin’s (BTC) cult-like following. Despite the increased involvement of traditional finance and institutional players in the crypto space, core community members continue to uphold Nakamoto’s vision of a decentralized, trustless electronic transaction system, which he detailed in the original Bitcoin white paper.

At the current price of just under $9,000 per Bitcoin, Nakamoto’s estimated BTC holdings are valued north of $9 billion. The fact that he evidently hasn’t spent any of it in the over 11 years since Bitcoin’s creation only cements his perception in the community as a true revolutionary, devoid of materialistic ambitions.

The mystery around Nakamoto is further intensified by his disappearance from the scene since his last confirmed correspondence in April 2011. But what if the fabled creator were to reemerge one day and take ownership of his Bitcoin holdings? 

A BTC transaction on May 20, 2020, originating from a wallet dormant since 2009, sparked concerns around this scenario when it was broadcasted by Twitter user Whale Alert.

Whale Alert May 20
Tweet from user Whale Alert broadcasting the May 20 transaction. Source: Twitter

Bitcoin’s price dropped as the announcement fueled speculations around Nakamoto’s return. Given his alleged massive BTC holdings, market participants feared that Nakamoto could theoretically tank the market and destroy Bitcoin’s entire value, which stands at a total of $170 billion at press time. 

Just a few days later, on May 25, another episode occurred that involved Bitcoin mined in 2009. An anonymous person posted a message  — cryptographically signed using addresses containing 2009-mined BTC — whose clear goal was to undermine the authenticity of probably the most well-known person who actively claims to be the real Nakamoto, Craig Wright.

While the May 20 transaction clearly left the market shaken, both episodes brought back the enduring mystery surrounding Bitcoin’s creator to the forefront of discussion. Industry experts for the most part claimed that neither case involved Bitcoin mined by Nakamoto himself. 

OKX Insights breaks down the background necessary to understand what actually happened, the major players and dynamics involved and the controversies surrounding some of the first Bitcoin ever created. 

Bitcoin’s early days and Satoshi’s stash

At the time of its inception, Bitcoin was not nearly as popular as it is today. The earliest people aware of its existence are believed to be members of The Cryptography Mailing List — an email list “devoted to cryptographic technology and its political impact,” whose membership numbers are unknown.

Those on the list received emails from Nakamoto throughout November 2008, prior to him releasing Bitcoin v0.1 in January 2009.
The Bitcoin network officially came into existence on Jan. 3, 2009, when Satoshi Nakamoto mined the first block, known as the genesis block, with this message: “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks”.

genesis block times cover
Cover of The Times issue referenced in Bitcoin’s genesis block. Source:

With the need for auditors or “miners” built into the network, it is believed that Nakamoto continued to mine Bitcoin blocks in the early days to support the system. Bitcoin’s block subsidy or reward — the incentive for miners to maintain the network — started at 50 BTC per mined block. According to Bitcoin’s code, this incentive is halved after every 210,000 blocks (roughly every four years) — the most recent “halving” occurring this month.

As Nakamoto mined new blocks, he continued to accumulate this block reward with every coinbase transaction — the first transaction recorded in each block and the one that sends the miner their block reward — receiving 50 BTC in a new wallet address each time.

The reason researchers were alerted by the May 20 transaction was that it originated from a wallet that had received a 50 BTC block reward from mining on Feb. 9, 2009, just a month after the Bitcoin network’s launch.
The 50 BTC were sent in two transactions on May 20 — 40 BTC and just under 10 BTC. While the exact destination of the BTC sent on May 20 is unknown, Chainalysis reports that “It does look like some of the money ended up at Coinbase.”

may 20 transaction
The generation date for the 50 BTC moved on May 20, 2020. Source:

Looking at the wallet shown above, the coinbase transaction’s presence means it belongs to a miner, and the date indicates that they were active on the Bitcoin network within a month of its launch. Both these conditions indicate, albeit not conclusively, that the owner of this wallet could theoretically be Nakamoto himself, presumed to be one of the few miners on the network at that time. 

However, the exact number of blocks that Nakamoto mined, and the amount of BTC he received remains unknown, making for an interesting study as researchers dig into the earliest known transactions and addresses on the blockchain.

Identifying Satoshi with the Patoshi pattern

Blockchain researcher Sergio Demian Lerner claimed in a post on Bitcoin-focused forum Bitcointalk in April 2013 that he had been able to estimate the amount of BTC held by Nakamoto at that time. He stated it was over 1 million BTC — about $100 million then. 

To explain how he got to this conclusion, Lerner followed up on his findings several days later with a more detailed post on his own blog, revealing “a new block chain analysis technique,” which he again revisited most recently in 2019.

In his analysis of the earliest mined Bitcoin blocks, Lerner identified a pattern — which he later dubbed “Patoshi” — that he claimed indicated which specific blocks had been mined by Nakamoto. The BTC moved on May 20, 2020, as many crypto analysts pointed out, did not fall into this pattern.

But how does the Patoshi pattern actually work? Lerner claimed, as per his analysis, that Nakamoto exclusively mined Bitcoin blocks on the network between Jan. 3, 2009 and Jan. 25, 2010, and amassed more than 1 million Bitcoins in the process.

The researcher based his assumptions on a study of the network’s hashrate at the time and the difficulty of mining, which increases as more miners join the network. 

According to Lerner, his study of the original Bitcoin client v0.1 revealed three privacy-related flaws, which helped identify all the blocks mined by a single miner.

Lerner focused on identifiable strings within the early blocks, most notably the ExtraNonce field, and published a chart highlighting the blocks he found to have a common origin, or a single miner, whom he decided to call Patoshi.

While Lerner’s research has been intensely debated since 2013, his analysis is generally believed to be sound, even if not 100 percent accurate. While members of the crypto community generally believe that the Patoshi blocks clearly point to the existence of an early active miner responsible for mining a large chunk of BTC, the conclusion for some is that this early miner, Patoshi, “may or may not have been Satoshi.” 

Lerner, however, is more firm in his conclusions. In his analyses since 2013, he demonstrates that the single miner responsible for mining all the blocks in the Patoshi pattern is in fact Bitcoin’s creator, concluding:

“There is evidence that links the Patoshi patterns to Satoshi, based on public information sources and the blockchain, of course. But I would prefer to stop here. Leave Patoshi alone once for all. I have too many things to build for Bitcoin, like RSK.”

As critics of Lerner’s findings noted, there were other miners active on the network at the time, alongside Nakamoto. At least one of these original miners has identified themselves since, the late Harold (better known as Hal) Thomas Finney.  In March 2013, a month before Lerner posted his first findings, Finney posted about his early mining activity on Bitcointalk:

“When Satoshi announced the first release of the software, I grabbed it right away. I think I was the first person besides Satoshi to run bitcoin. I mined block 70-something, and I was the recipient of the first bitcoin transaction, when Satoshi sent ten coins to me as a test.”

It is notable that the pattern of Nakamoto receiving 50 BTC as a block reward and then sending 10 BTC to Finney — the first known BTC transaction — was echoed in the May 20, 2020 transactions, where a original 50 BTC reward split into the two transactions of 40 BTC and 10 BTC.

May 20 BTC weren’t from Patoshi 

The BTC moved on May 20 were mined in block 3654. Taking a look at this block within Lerner’s analysis, we see that it is not one of the Patoshi blocks. For most crypto analysts and commentators, this effectively proves that the bitcoins do not in fact belong to Nakamoto.

patoshi pattern
Block 3654 shown on a chart identifying Patoshi block (blue). Source: Satoshiblocks

In comments to OKX Insights on May 22, Nic Carter, general partner at Castle Island Ventures and co-founder of Coinmetrics, shared his thoughts about the Patoshi pattern and the likelihood of Nakamoto being behind the May 20 transactions. 

“Most bitcoin experts conclude that Sergio’s [Lerner] model has some merit, although the precise number of blocks it is able to assign to the single large early miner is under debate,” Carter stated about the Patoshi pattern, adding:

“[T]he pattern is very compelling and I see no reason to doubt the crux of the analysis – there was a large single early miner running custom software which started mining at inception and mined through 2009.”

Carter went on to cite the fact that none of the outputs mined in the Patoshi pattern have been spent (beyond one or two test transactions). This differentiates Patoshi from other miners operating in the same time period, who have occasionally spent their rewards, as shown in data shared by Coinmetrics engineer Antoine Le Calvez.

While Carter relied on Lerner’s findings to conclude that the May 20 transactions were from a non-Satoshi miner, Blockstream CEO Adam Back tweeted a different argument to come to the same conclusion. Back wrote that the Patoshi research was “pretty much guessing,” but argued that if Satoshi himself were to sell his coins, he would likely start with his most recently mined ones — the most anonymous of the lot.

Responding to the original Whale Alert tweet on May 20, both cypherpunk and Bitcoin proponent, Jameson Lopp, and former lead maintainer of Monero (XMR), Riccardo Spagni, also cited the Patoshi pattern and criticized the tweet for claiming the coins were sent from a “possible Satoshi owned wallet.” 

Lopp further pointed out that the language of Whale Alert’s tweet had led to unnecessary panic in the markets as “[w]e all know what ‘possible Satoshi owned wallet’ is code for – that 1M coins could be coming into circulation.”

Self-proclaimed Satoshi Craig Wright and his list of addresses

While many notable figures have been considered as candidates to be the true Nakamoto, there have been a few self-proclaimed ones — the most prominent being Australian computer scientist, Craig Steven Wright.

The May 20, 2020 transactions, however, were a blow to Wright’s claim to be Nakamoto, previously discussed at length by Lopp in an op-ed last year. 

Since February 2018, Wright has been embroiled in a longstanding legal battle with the estate of his alleged former partner, Dave Kleiman, a computer forensics expert who died in 2013

Kleiman’s brother Ira, in control of Dave’s estate, claims that Dave and Wright were involved in Bitcoin from the very beginning of its existence and mined 1.1 million bitcoins together — arguing that Dave never got access to his half of the coins. 

During the proceedings for Kleiman v. Wright, Wright was required to submit a list of Bitcoin addresses he owned that held BTC he had mined before 2013. 

The address that the 50 BTC was sent from on May 20, 2020 was one of the more than 16,000 addresses Wright has submitted to the court.

However, Wright has long maintained that he does not have access to the private keys for the addresses he submitted, since, as he claims, they were sliced and distributed among various people for added security. 

The fact that the May 20 coins were moved from one of those same addresses means either that Wright does in fact have access to the keys or — what most observers argue — he does not actually own all of  the addresses he claimed in court are his. Either way would mean he had lied in court. 

Was the May 20 transaction simply an early Bitcoin miner — not Nakamoto — finally spending his block reward, or was it linked to the Kleiman v. Wright case? 

Commenting on the transaction’s link to the ongoing case, Carter told OKX Insights over the weekend that he thinks that the May 20 transaction might have been made explicitly to undermine Wright’s claims:

“it’s possible that this transaction was made to invalidate certain claims that CSW [Wright] made in court — namely that he controlled the address in question, and that he didn’t have access to it at present. This transaction invalidates that and complicates his case.”

As Carter explains, the person who sent 50 BTC on May 20 necessarily has control over the private keys to that address. This fact expressly invalidates Wright’s claim in court documents that the address belongs to him, but he doesn’t have access to the private keys at the moment.

Another early miner calls Wright out

Just yesterday, May 25, more activity involving bitcoins mined in 2009 emerged that explicitly undermines Wright’s claims. An anonymous entity released a file with 145 Bitcoin addresses, all of which — like the May 20 address — hold Bitcoin mined in 2009 and are listed among the 16,000+ addresses that Wright claimed in court are his.

Given how each of the 145 addresses holds 50 BTC, at current prices, this entity has proven control of over $60 million worth in Bitcoins alone (not accounting for the forks since then).

It’s impossible to tell if the miner who sent 50 BTC on May 20 is the same one who sent the 145 addresses yesterday. However, unlike with the May 20 transaction, this time the early miner was clearly driven to discredit Wright’s claims.

Using Bitcoin’s built-in signing and verification feature, which allows address owners to prove their ownership anonymously, the miner left a clear message, which can be verified against all 145 addresses provided:

“Craig Steven Wright is a liar and a fraud. He doesn’t have the keys used to sign this message.

The Lightning Network is a significant achievement. However, we need to continue work on improving on-chain capacity.

Unfortunately, the solution is not to just change a constant in the code or to allow powerful participants to force out others.

We are all Satoshi”

Anyone can verify the authenticity of the message by matching it against a Bitcoin address and signature (shared in the file released by the anonymous entity), as shown in the screenshot below.

BTC Signature verification
Bitcoin address, message and signature verification tool. Source:

Speaking to the verifiability and origins of the anonymous message, Carter told OKX Insights in separate comments yesterday:

“The address, message & signature data is all that was needed to know that the message was authentically signed by the privkey [private key] (I verified a couple on electrum). I believe it was a text file dropped on the 4chan /biz forum originally.

But it doesn’t exactly matter where it originated since all we need is the signatures and the text content.”

What this means is that, at the very least, the 145 addresses in this newly released list clearly do not belong to Wright.

Carter continued in a statement to OKX Insights: 

“I thought the original old address that moved might have been motivated by the court case and I was expecting to see them sign an OP_RETURN indicating that they weren’t owned by CSW [Wright], it’s interesting to see another set of addresses do this (albeit in a different way). The fact that Craig has finally committed to a set of addresses he claims to own is probably why this individual chose to act now.”

Carter also pointed out that the 145 addresses are, like the May 20 address, not part of the Patoshi pattern, “so [it’s] just another non-Satoshi early miner.” Lopp and others on Twitter were also quick to point out the addresses likely do not belong to Bitcoin’s creator, with Lopp posting on Monday:

“More 2009-era bitcoin miner ‘activity’ as someone provides even more cryptographic proof that Craig Wright is a fraud. Once again, these blocks do not match the ‘Patoshi Pattern.’”

Just a day before, on May 24, Lerner himself had posted on Twitter that he’d, conveniently, added functionality for checking whether or not any given block was mined by Patoshi.

The language and essence of the May 25 message, and most specifically its sign off “We are all Satoshi,” echo that of a 2015 email from the address satoshi[at] The 2015 message read simply “I am not Craig Wright. We are all Satoshi.” 

Though the email address was later revealed to be forged to look like Nakamoto’s, the text’s sentiment, echoed in yesterday’s message, does express something akin to Nakamoto’s own opinion — that the identity of what’s thought to be the individual person behind Bitcoin really isn’t what is important. 

Satoshi remains in the shadows

While the May 20 and May 25 episodes prompted interesting discussions, both most notably served to highlight the enduring fascination and mystery surrounding Bitcoin’s creator.

Is Nakamoto “a young man of Japanese ancestry who was very smart and sincere,” as once described by Hal Finney? Someone from the UK, due to the The Times reference in the Bitcoin genesis block? Or is he one of the numerous candidates routinely considered by the media? We may never know.

What we do know, however, from Nakamoto’s last confirmed correspondence — with former Bitcoin developer Gavin Andresen — is that the creator of Bitcoin wanted people to focus on the project itself, instead of his identity:

“I wish you wouldn’t keep talking about me as a mysterious shadowy figure, the press just turns that into a pirate currency angle. Maybe instead make it about the open source project and give more credit to your dev contributors; it helps motivate them.” 

OKX Insights presents market analyses, in-depth features and curated news from crypto professionals.

Follow OKX Insights on Twitter and Telegram.