Who Wrote Bitcoin? — Code Stylometry Analysis

Satoshi Nakamoto's Coding DNA

Based on analysis of Bitcoin v0.1.0 (January 2009) — main.cpp, net.cpp, ui.cpp, serialize.h, bignum.h

Language C++ (10 .cpp files, 0 .c files)

Comments // line comments exclusively (295 instances, zero /* */ block comments)

Class naming CamelCase with C prefix — CBlock, CTransaction, CWalletTx, CKey, CAddress

Member/global vars Hungarian notation — fFound, nBestHeight, mapWallet, vWalletUpdated, csMapKeys

Indentation 4 spaces (zero tab lines in entire codebase)

if spacing if (x) — space before paren, no spaces inside

Return style return true; — no parentheses

Brace style Allman (opening brace on next line for functions)

Function decls Return type on same line as function name

Platform Windows-first — 44 Win32/wxMSW refs, 0 Unix refs, wxWidgets GUI

Headers Single monolithic headers.h (precompiled header pattern)

Pointers Raw pointers, NULL (not nullptr), no smart pointers

STL Heavy use — map<>, vector<>, multimap<>, string

Error handling C++ throw, custom error() function, printf

The C class prefix and Hungarian notation (f/n/map/v/cs prefixes) are specifically from Microsoft's MFC/COM programming tradition of the 1990s–2000s. The monolithic headers.h is a Windows precompiled header pattern. These traits collectively point to someone who spent years writing Windows desktop applications in Visual C++.

Trait-by-Trait Analysis

Trait	Satoshi	M. Stokes	V. Falco	Wei Dai	P. Le Roux	J. McCaleb	L. Sassaman	H. Finney	P. Gutmann	A. Back	G. Andresen
Language	C++	C++	C++	C++	C (some .cpp)	C++	C	C	C	C	C++
Comments	// only	// (819 vs 8)	// mostly	// mostly	/* */ primary	// mostly	/* */ only	/* */ only	/* */ only	/* */ only	// mostly
Naming	CamelCase	CamelCase	CamelCase	CamelCase	C style	CamelCase	snake_case	snake_case	snake_case	snake_case	CamelCase
C class prefix	Yes (CBlock)	Yes (CNetwork)	No	No	N/A	No	N/A	N/A	N/A	N/A	Yes (CScheduler)
Hungarian vars	f/n/map/v	m_b/n/p full	m_ prefix	simple	b/sz/n full	m prefix	N/A	N/A	N/A	N/A	Partial (n prefix)
Indentation	4 spaces	tabs	2 spaces	tabs	tabs	tabs	2 spaces	tabs	tabs	tabs	4 spaces
if spacing	if (x)	if ( x )	if (x)	if (x)	mixed	if(x)	if (x)	if (x)	—	if ( x )	if (x)
Return style	return x	return x	return x	return x	return x	return(x)	return x	return x	—	—	Mixed
Brace style	Allman	Allman	Allman	Allman	K&R-ish	K&R	Allman	K&R	—	K&R	Mixed Allman/K&R
Ret type placement	same line	same line	same line	same line	same line	same line	same line	separate	—	same line	same line
Platform	Windows-first	Windows MFC	Windows	Cross+MSVC	Windows	Cross-plat	Unix+Win32	Unix-first	Cross-plat	Unix-first	Unix/Linux
Raw ptrs / NULL	Yes	Yes	Some	No smart	Yes (BOOL)	Some smart	—	—	—	—	Mixed
No namespaces	Yes	Yes	—	—	—	—	—	—	—	—	—

Candidate Scorecard

Rank	Candidate	Score	Era Code	Best Match	Key Gap
1	Michael Stokes	11/12	Shareaza (2002–2017)	ONLY candidate matching C prefix + Hungarian + MFC + P2P protocol design	Tabs not spaces; if ( x ) has extra interior spaces
2	Vincent Falco	9/11	DSPFilters (2009)	Windows P2P developer (BearShare) — exact profile	BearShare source closed; no C prefix in available code
3	Gavin Andresen	8.5/12	scheduler, IBLT (2015)	C prefix (CScheduler) + 4-space indent + line comments	Unix not Windows; mixed brace/return style. Style may reflect Satoshi's influence.
4	Wei Dai	8.5/11	Crypto++ (1995–present)	Most general C++ traits match; sophisticated codebase	Not Windows-first; no C prefix or Hungarian notation
5	Paul Le Roux	5.5/12	E4M/TrueCrypt (1998–2000)	Hungarian notation + Windows. Criminal = anonymity motive	Writes C not C++, block comments, tabs
6	Jed McCaleb	4.5/11	NewCoin (2011)	Writes C++, CamelCase naming	Tabs, return(x), if(x), not Windows-first
6	Len Sassaman	4.5/9	Mixmaster	Allman braces, if (x) spacing	Writes C not C++, block comments
8	Hal Finney	2/10	RPOW (2004)	if (x) spacing, return x style	Writes C, tabs, block comments, separate-line return type
8	Peter Gutmann	~2/12	cryptlib	Writing stylometry #2 match (ULC Legal study)	Writes C, block comments, tabs
10	Adam Back	1/10	hashcash	Same-line return type	Writes C, tabs, block comments, spaces inside parens, snake_case
—	Nick Szabo	N/A	(Java only)	Cannot evaluate — no public C/C++ code
—	Craig Wright	N/A	(none)	Cannot evaluate — 0 public repos

Note on Gavin Andresen (#3): Gavin took over Bitcoin development directly from Satoshi in 2010. His C prefix usage (CScheduler) and n-prefix variables could reflect Satoshi's influence on his coding style rather than shared authorship. He is based in Amherst, MA — US Eastern timezone, which fits Satoshi's posting pattern.

Convergence on a Specific Developer Archetype

Across all 10 candidates, the stylometric analysis has converged on a very specific profile for Satoshi: someone who wrote Windows MFC/ATL C++ peer-to-peer applications in the 2000–2008 era. The C class prefix, Hungarian notation, Allman braces, precompiled headers, and heavy Win32/MFC references are not generic C++ habits — they are the specific fingerprint of a Visual C++ application developer working on desktop software.

The three candidates who best match this profile:

Michael Stokes (Shareaza / Gnutella2) — Windows MFC/ATL C++ P2P client developer, designed the Gnutella2 decentralized protocol. 11/12 trait match. The strongest stylometric match of any candidate.
Vincent Falco (BearShare / Gnutella) — Windows C++ P2P client developer, worked on the Gnutella network. 9/11 trait match. BearShare source is closed, limiting analysis.
Paul Le Roux (E4M / TrueCrypt) — Windows developer with Hungarian notation and cypherpunk ties. 5.5/12 trait match. Writes C not C++, which is a fundamental mismatch, but the Windows development culture is evident.

All three are Windows developers. Two of them — Stokes and Falco — are P2P protocol designers who built decentralized file-sharing networks, the exact same domain as Bitcoin's peer-to-peer protocol. This is a remarkably narrow intersection: Windows MFC C++ developer AND decentralized P2P protocol designer. Very few people in the world fit both criteria simultaneously.

The MFC/COM Signature

Two of Satoshi's most distinctive traits — the C class prefix (CBlock, CTransaction) and Hungarian notation (fFound, nBestHeight, mapWallet) — were previously unmatched by any candidate. These conventions come specifically from Microsoft's MFC (Microsoft Foundation Classes) and COM programming traditions.

Michael Stokes' Shareaza is the first and only codebase to match both traits. Shareaza uses CamelCase with C prefix (CCollectionFile, CNetwork, CBTClient, CDownload, CBuffer, CAlbumFolder) and full Hungarian notation (m_bActive, nLength, nCount, pFile, pPacket, pHost). The Shareaza codebase also uses StdAfx.h (precompiled headers), the same pattern as Satoshi's monolithic headers.h. And Stokes designed a decentralized P2P protocol (Gnutella2), matching Satoshi's domain expertise in peer-to-peer network design.

The remaining gap between Stokes and Satoshi — tabs vs. 4 spaces for indentation, and if ( x ) with extra interior spaces vs. Satoshi's if (x) — is the smallest discrepancy of any candidate. Indentation style is also the trait most easily changed by a developer (via editor settings or project conventions), making it a weaker signal than naming conventions or comment style.

Caveat: There is no known connection between Michael Stokes and the cypherpunk or cryptography community. Being a stylometric match does not confirm identity — it means the code was written by someone with the same development background: a Windows MFC C++ peer-to-peer application developer. Satoshi could be Stokes, someone who worked alongside him, or any developer from the same narrow ecosystem of Windows P2P application builders in the 2000s. Code stylometry identifies the type of developer, not the specific person.

Satoshi Used Commonwealth English — and So Does Stokes

Satoshi's writings contain well-documented Commonwealth English patterns: "colour," "favour," "grey," "defence," "analyse," and the colloquialism "bloody hard." The Bitcoin whitepaper uses "favour." Bitcoin v0.1's UI code uses SetBackgroundColour and GetColour. These spellings are standard in the UK, Australia, New Zealand, and Canada.

Michael Stokes resides in Australia (confirmed on the Shareaza Wiki). Australian English uses British spellings as standard — "colour," "favour," "analyse," "defence." The word "bloody" is quintessentially Australian slang.

Shareaza's source code confirms Stokes writes in British/Australian English:

Word	British (Stokes)	American	Ratio
colour vs color	302	61	83% British
initialise vs initialize	2	48	4% British
serialise vs serialize	0	403	0% British
Total British spellings	354 instances across codebase

The pattern is telling: Stokes defaults to British spelling for words he chose himself (his own function names like CalculateColour(), GetColour(), OnSysColourChange()) but uses American spelling where forced by the Windows API (which uses "Color" in its own type names like COLORREF). This mixed British/American pattern is exactly what Satoshi's writing exhibits — and exactly what you'd expect from an Australian developer working with American APIs.

Satoshi's corpus shows the same mix: "favour" and "colour" (British) alongside "characterized" and "optimize" (American). This is natural for a Commonwealth English speaker immersed in American technology — you spell your own words in your native dialect but absorb American spellings from the tools you use daily.

Key forum evidence still needed: Stokes was active on the Gnutella Developer Forum (GDF), which was hosted on Yahoo Groups (groups.yahoo.com/group/the_gdf/). Yahoo Groups was shut down in 2020, but archives may have been preserved. Stokes' GDF forum posts would allow a direct writing style comparison to Satoshi's bitcointalk.org posts — looking at sentence structure, vocabulary, punctuation habits (double-spacing after periods), and the mixed British/American spelling pattern.

Posting & Commit Timestamp Analysis

Multiple studies have analyzed 742+ timestamps from Satoshi's bitcointalk posts, SourceForge commits, and emails (Oct 2008 – Dec 2010). The findings are consistent:

Sleep window (near-zero activity): ~05:00 – 11:00 UTC
Peak activity: ~14:00 – 23:00 UTC

Period	UTC	London (GMT)	US Eastern (EST)	US Pacific (PST)	Australia AEST (UTC+10)
Sleep	05:00–11:00	5 AM – 11 AM	12 AM – 6 AM	9 PM – 3 AM	3 PM – 9 PM
Peak	14:00–23:00	2 PM – 11 PM	9 AM – 6 PM	6 AM – 3 PM	12 AM – 9 AM

Timezone Assessment

BEST FIT London (GMT) — Sleep 5–11 AM (normal), work 2–11 PM (normal). Plus: Genesis Block quotes The Times of London, British spellings throughout Satoshi's writings.
GOOD FIT US Eastern (EST) — Sleep midnight–6 AM (normal), work 9 AM–6 PM (normal business hours).
POSSIBLE US Pacific (PST) — Sleep 9 PM–3 AM (early to bed), work 6 AM–3 PM (early riser).
RULED OUT Australia AEST (UTC+10) — "Sleeping" 3–9 PM (peak waking hours), "working" midnight–9 AM (all-nighter every day for 14+ months). The Chain Bulletin called this "not even remotely possible unless Satoshi is a vampire."

Update: Michael Stokes was in Australia during the Bitcoin period. Deep research into corporate records, web archives, and public registries has produced a detailed timeline that weakens the Stokes case on the timezone dimension, while his code remains the strongest match of any candidate.

Michael Stokes: Detailed Location History

Corporate filings, web archives, and community records allow us to reconstruct Stokes' location with reasonable confidence. Sources include the Australian Securities & Investments Commission (ASIC), the Australian Business Register (ABR), Wayback Machine snapshots of Mercora's team page, Shareaza Wiki revision history, and a WIPO domain dispute decision.

Date	Event	Location Implied	Source
Nov 2002	Registers Shareaza Pty Ltd (ACN 102 912 667, WA 6014)	Perth, Australia	ASIC / ABR
~2003	Listed as CTO / co-founder, Mercora Inc.	Sunnyvale, CA (or remote?)	MarketScreener, GigaOM
Jun 2004	Open-sources Shareaza 2.0, transfers domain	Unknown	Shareaza Wiki
Nov 2004	Files voluntary deregistration of Shareaza Pty Ltd	Australia (filing)	ASIC doc 020841849
Sep 2005	Title on Mercora team page changes from CTO to "Client Architect"	Unknown	Wayback Machine
Nov 2005	Disappears from Mercora team page entirely	Left Mercora	Wayback Machine
Nov 2005	Shareaza Pty Ltd officially deregistered	Australia	ASIC
Feb 2006	ABN cancelled	Australia	ABR
Late 2005 – Jan 2008	COMPLETELY DARK — no digital trace found anywhere	Unknown	—
Jan 5, 2008	Shareaza Wiki first revision states: "He currently resides in Australia"	Australia	SourceForge wiki rev 1733
Oct 31, 2008	Bitcoin whitepaper published	Stokes appears to be in Australia at this time
Jan 3, 2009	Bitcoin genesis block mined	Stokes appears to be in Australia at this time
Aug 2008	Social.fm (formerly Mercora) shuts down	N/A (Stokes had left years earlier)	Web archives
2010–2014	Confirmed in Australia, employed with side jobs	Australia	Shareaza Wiki (EN + NL)

Was Stokes Ever Physically in the US?

Possibly not. Despite being listed as CTO of a Sunnyvale startup, several clues suggest he may have been remote from Australia the entire time:

He registered Shareaza Pty Ltd in Perth, WA in November 2002 — the same period he was supposedly CTO in Sunnyvale
No H-1B visa records exist for Mercora, Inc. in any searchable database. An Australian working in California requires a work visa.
He was still mid-degree at the University of Western Australia (3 of 5 years completed)
His Australian company filings continued through 2005–2006, suggesting ongoing Australian residency

Assessment

The timeline weakens the Stokes case. The Shareaza Wiki confirms Stokes "currently resides in Australia" as of January 2008 — nine months before the Bitcoin whitepaper. If he was in Australia during 2008–2010, his posting times would need to be midnight–9 AM AEST (the "vampire schedule"), which is not sustainable for 14+ months. No evidence was found placing him outside Australia at any point during 2006–2010.

What the Stokes case tells us. Even if Stokes himself is ruled out by timezone, his code remains the closest stylistic match to Satoshi's (11/12 traits). This means the analysis has successfully identified the type of developer who wrote Bitcoin: a Windows MFC/ATL C++ peer-to-peer application developer with Commonwealth English habits, active in the early 2000s P2P ecosystem. The actual author may be someone else from this same narrow profile — another Windows Gnutella/P2P client developer, or someone who worked alongside Stokes and absorbed the same conventions.

Searching 92,000 Cypherpunk Mailing List Posts

Satoshi announced Bitcoin on the metzdowd.com cryptography mailing list — a cypherpunk-adjacent forum. His whitepaper cites cypherpunk work (Hashcash by Adam Back, b-money by Wei Dai). We searched the complete cypherpunk mailing list archive (92,194 messages, 2000–2016) for every candidate in our analysis.

Candidate	Posts	Assessment
Ray Dillinger	849	Massive presence. #1 in ULC writing stylometry study.
Adam Back	589	Major contributor. Discussed P2P DoS resistance + e-cash.
Len Sassaman	166	Active participant.
Hal Finney	107	Active. First person to receive a Bitcoin transaction.
Ian Grigg	103	Active. Ricardian Contracts inventor.
Wei Dai	70	Moderate. Creator of b-money (cited by Satoshi).
Nick Szabo	36	Occasional. Bit Gold designer.
Gavin Andresen	16	Minor presence.
BearShare (Falco mentioned)	5	Mentioned by others, not posted by Falco himself.
Shareaza (Stokes mentioned)	2	Mentioned in French copyright lawsuit context only.
Michael Stokes	0	Not on the cypherpunk list at all.
Vincent Falco	0	Not on the cypherpunk list at all.
Paul Le Roux	0	Not on the cypherpunk list at all.

The Paradox: Two Communities That Don't Overlap

The code stylometry points to a Windows MFC C++ P2P application developer. The cypherpunk mailing list analysis points to a Unix-oriented cryptography researcher. These two communities barely intersect:

The three candidates who best match the code (Stokes 11/12, Falco 9/11, Le Roux 5.5/12) have zero presence on the cypherpunk mailing list.
The candidates with the strongest cypherpunk presence (Back 589, Dillinger 849, Sassaman 166, Finney 107) score poorly on code style (1-4.5 out of 12).
Only 306 of 92,194 cypherpunk posts mention MFC, Visual C++, or Win32 programming — and those are discussions about Windows security, not from Windows developers.
Adam Back himself discussed Gnutella P2P protocols AND electronic cash on the list — but his code (pure C, snake_case, tabs) doesn't match Bitcoin at all.

Three Possible Explanations

1. The Lurker

A Windows developer who read the cypherpunk lists without posting. They absorbed the ideas (Hashcash, b-money, distributed systems) and had the programming skills to implement them. Their code style reflects their professional background (Windows MFC), while their knowledge reflects years of silent reading.

2. The Team

A cypherpunk designed the system (choosing the cryptographic primitives, writing the whitepaper) while a Windows developer coded it. The code reflects the coder's style; the whitepaper reflects the designer's knowledge. Satoshi's communications could be either or both.

3. The Dual Identity

A rare individual who was both: a professional Windows C++ developer by day (explaining the MFC conventions, Hungarian notation, wxWidgets) and a cypherpunk enthusiast by night (explaining the cryptographic knowledge, mailing list awareness, British English). Such a person would be hard to find because they'd appear in neither community under both identities.

The search continues. The cypherpunk archive does not contain the GDF (Gnutella Developer Forum) posts, which were hosted on Yahoo Groups and shut down in 2020. The GDF is where Michael Stokes was active and where the P2P development community congregated. If a preserved copy of the GDF archive exists, it could bridge the gap between the P2P and cypherpunk communities — revealing whether any P2P developer also discussed cryptography or digital cash.

Methodology

Source code analyzed:

Project	Author	Source
Bitcoin v0.1.0	Satoshi Nakamoto (Jan 2009)	github.com/trottier/original-bitcoin
Shareaza	Michael Stokes (2002–2017)	github.com/jason-jxc/Shareaza
DSPFilters	Vincent Falco (2009)	github.com/vinniefalco/DSPFilters
Crypto++	Wei Dai (1995–present)	github.com/weidai11/cryptopp
E4M / TrueCrypt	Paul Le Roux (1998–2000)	github.com/FreeApophis/TrueCrypt
NewCoin	Jed McCaleb (Oct 2011)	github.com/XRPLF/rippled first commit
Mixmaster	Len Sassaman et al.	github.com/crooks/mixmaster
RPOW	Hal Finney (2004)	github.com/NakamotoInstitute/RPOW
cryptlib	Peter Gutmann	github.com/cryptlib/cryptlib
hashcash	Adam Back (~2002–2005)	github.com/hashcash-org/hashcash
scheduler	Gavin Andresen (2015)	github.com/gavinandresen/scheduler
IBLT_Cplusplus	Gavin Andresen	github.com/gavinandresen/IBLT_Cplusplus

Analysis performed by comparing coding conventions across 12 stylometric traits: language choice, comment style, naming conventions, class prefix patterns, variable naming conventions, indentation, control flow spacing, return statement style, brace placement, function declaration format, platform orientation, and pointer/memory management patterns.

Shareaza corpus: 527 .cpp files, 675 .h files. E4M/TrueCrypt corpus: Mount.c, Dlgcode.c (derived from E4M 2.02a). cryptlib corpus: .c files with 159 block comment instances and 0 line comment instances.

Of the additional candidates investigated (Ray Dillinger, Phil Wilson/Scronty, Ian Grigg, Dustin Trammell, Mike Hearn, Martti Malmi, David Chaum), only Gavin Andresen had substantial public C++ code suitable for comparison. The others write in C, Java, Ruby, Assembly, TypeScript, or have no public code.

Generated April 2026. Code stylometry is one analytical lens — it can rule candidates out but cannot definitively confirm identity. Writing style can be deliberately altered.