Press "Enter" to skip to content

Analysis: Why Satoshi Nakamoto probably did not touch the bitcoins mined in 2009


Photo: Shutterstock

In block 631058, a transaction was made that spent an February 2009 output, that is, one month after the bitcoin network started to function. This caused a little price fluctuation, not to mention, much speculation about whether Satoshi Nakamoto was responsible for moving these currencies or not.

In this article, I will explain why it was probably not Satoshi and the bit of digital forensics we can use to find out.

What happened

On May 20, 2020, a transaction with the ID cb1440c787d8a46977886405a34da89939e1b04907f567bf182ef27ce53a8d71 was transmitted to the Bitcoin network and included in block 631058. The transaction input was made in block 3654, specifically on February 9, 2009, starting on 9 February 2009 2009. As the Genesis block was created on January 3, 2009, the block that originated the respective bitcoins happened just 37 days after the start of the Bitcoin network.

There weren't many people mining (or even knowing what it was), so speculation is that this output may belong to Satoshi Nakamoto. Since a private key is required to unlock the output, the fact that it has been spent suggests that the person responsible has access to the private key. If this is Satoshi, it suggests that there may be a lot more Bitcoins to dump. Bitcoin's price fell about 5% after the news broke, perhaps based on this speculation.

Bitcoin in 2009

At the time, Bitcoin was known to very few people, especially people on the cypherpunk email list and most were mining because they thought it was an interesting experiment. At that time, there were not many transactions on the network other than transactions from the mined blocks, as people were not sending Bitcoins. A notable exception is in block 170, where Satoshi Nakamoto sent Hal Finney 10 bitcoins.

So, on the one hand, we know that Satoshi Nakamoto has mined block 9, at least, and may have mined more. That said, there were other people mining on the network, including Hal Finney:

Since Bitcoin was so new and there was only one software option, everyone who was running Bitcoin software at the time was mining.

What can we infer

Since everyone was mining and there were few, if any, transactions that were not mining transactions, we can try to gather some information based on the Bitcoin v0.1 code.

In v0.1, there was a specific function in main.cpp that created the proof of work. Obviously, it was very easy at the time, but it still required a lot of CPU power. We can see the code that creates the currency based transaction here.

The main information that we can gather in the base transaction of mined coins, in addition to the output, is something called extra nonce:

You can see in line 2190 that bnExtraNonce is set to 0. In addition, in line 2212, the same variable is incremented in the while loop to generate coins (also known as mining). Finally, also on line 2212, bnExtraNonce is added to the scriptSig of the currency based transaction through the operator “<<“. This is where we can use forensic analysis, as this variable is set to 0 and increments while the program is running. If the program restarts, this will be reset to 0. Therefore, the longer the bitcoin software has been running, the higher this number would be, and furthermore, that number would appear in the scriptSig field of the currency based transaction, which we can examine in the blockchain.

It is here that Sergio Lerner's analysis of the first blocks led to the labeling of certain transactions as being “Patoshi”. The coins on the graph are green if worn and blue if not worn, with the y-axis being the value extra nonce and you can see the big blue wires:

These are suspected to be Satoshi coins, as the extra nonce value increases when a block is extracted. These are also very long running processes that seem to be restarted every week. To be fair, we don't know if these are specifically Satoshi coins, except for something like block # 9, but there is decent forensic evidence given the way the blue wires line up (when one ends, another starts soon after), that these transactions come mining companies have a good case for being from Satoshi.

The block in question

Looking at block 3654 and, specifically, the respective transaction, we can look at scriptSig to find the extra nonce value:

ScriptSig has a 4-byte bit number (0xffff001d, which is the proof of work limit) and then the extra nonce, which is 0xdd01.

This number is in little-endian hexadecimal, which is equivalent to 477 in decimal.
Compare this with the blue dots closest to one of the slopes, blocks immediately before and after that block, which are blocks 3653 and 3655. They have additional nonces of 2367 and 2372, respectively.


It is possible, of course, that Satoshi has run Bitcoin on several computers and that this is from another computer other than the blue wire of blocks 3653 and 3655, but given the light blue pattern of all the coins that have not been spent, it seems likely that this is not the same person.

* This article published by Jimmy Song on Medium and kindly provided by the author. The translation is from Bitcoin Portal.

This source of this article is

Disclaimer - OBN is an informational website which aims to give the latest blockchain related news to the readers. Articles on OBN should not be considered as investment advice. Trading cryptocurrencies is a high-risk investment, every user is advised to consult an expert before making any decisions.