Who Wrote Bitcoin? — Code Stylometry Analysis

Even with the timezone and competency objections, Stokes' code remains the closest stylistic match to Satoshi's (11/12 formatting traits). This means the analysis has successfully identified the type of developer who wrote Bitcoin: a Windows MFC/ATL C++ application developer who used the same conventions as Shareaza-era P2P developers — but who was less experienced with network programming than Stokes himself. The actual author may be a more junior developer from the same ecosystem, someone who learned MFC conventions in a Windows shop but built Bitcoin as their first serious networking project.

Detailed Location Timeline

Corporate filings, web archives, and community records allow us to reconstruct Stokes' location with reasonable confidence. Sources include the Australian Securities & Investments Commission (ASIC), the Australian Business Register (ABR), Wayback Machine snapshots of Mercora's team page, Shareaza Wiki revision history, and a WIPO domain dispute decision.

Was Stokes Ever Physically in the US?

Possibly not. Despite being listed as CTO of a Sunnyvale startup, several clues suggest he may have been remote from Australia the entire time:

• He registered Shareaza Pty Ltd in Perth, WA in November 2002 — the same period he was supposedly CTO in Sunnyvale
• No H-1B visa records exist for Mercora, Inc. in any searchable database. An Australian working in California requires a work visa.
• He was still mid-degree at the University of Western Australia (3 of 5 years completed)
• His Australian company filings continued through 2005–2006, suggesting ongoing Australian residency

British/Australian English Match

Michael Stokes resides in Australia (confirmed on the Shareaza Wiki). Australian English uses British spellings as standard — "colour," "favour," "analyse," "defence." The word "bloody" is quintessentially Australian slang.

Shareaza's source code confirms Stokes writes in British/Australian English:

The pattern is telling: Stokes defaults to British spelling for words he chose himself (his own function names like CalculateColour(), GetColour(), OnSysColourChange()) but uses American spelling where forced by the Windows API (which uses "Color" in its own type names like COLORREF). This mixed British/American pattern is exactly what Satoshi's writing exhibits — and exactly what you'd expect from an Australian developer working with American APIs.

Profile

• Canadian software developer based in Windsor, Ontario (later Toronto)
• Created WinMX (2000), Tixati (2009), Fopnu (2017), DarkMX (2021), Super Simple Server (2022)
• KEY: Described before WinMX as “a software developer previously known only for database applications and small ancillary cryptographic programs” (source: WinMX History)
• Solo developer — builds everything alone, 200,000+ lines of C++ in Tixati
• Extreme privacy: no photos, no interviews, no conference appearances, no LinkedIn, no social media

The Timeline

Corporate Records (Canadian Federal Business Registry)

The “Disappeared Off Planet Earth” Quote

Technical Capabilities (Matching Bitcoin Requirements)

• Custom encryption, key exchange, and hashing protocols (WPNP)
• DHT (Distributed Hash Table) implementation in Tixati
• Elliptic-curve signatures and homomorphic hashing (Tixati channels)
• I2P integration (completely rewritten in Tixati v3.34)
• Tor integration (DarkMX)
• All software is pure C++, no .NET or Java dependencies
• Pre-existing cryptographic programming experience (before WinMX, i.e. before 2000)

Online Handles

• KH on forum.tixati.com
• kevinhearn on Patreon
• kevin-hearn on GitHub (only 1 repo — a fork of bittorrent.org specs, no original code)
• No WinMX-era handle found — he never posted on community forums

Code Availability

Accepts Bitcoin donations for Tixati (address: 19u1s1ed8m1fhXrWFmA3BQrYkZ5efZXLYH)

Why He’s the Most Intriguing Lead

The Barrier

Without access to his source code (everything is proprietary), we cannot confirm the stylometric match. His behavioral profile is the strongest match to Satoshi of any candidate — but code stylometry requires code.

What Would Settle It

What’s strong (biographical)

• 1996 UMR student site linked to Adam Back, Hal Finney, cypherpunks, Digicash, ecash. Dorsey was authentically in that milieu at age 19. Wayback snapshot.
• 1996 yearbook photo allegedly shows him wearing an Adam Back “RSA in 3 lines of Perl” shirt. Back was the first person Satoshi emailed in Aug 2008.
• Cypherpunk mailing list appearance in 1996 and 2000.
• 1997 ACM member — Satoshi’s whitepaper cites a 1997 ACM paper.
• 1991–93 Mira Digital Publishing (Jim McKelvey’s firm) — Jack wrote commercial Windows document imaging software as a 15-year-old intern. Later Mira pivoted to academic paper preparation in a layout style matching the Bitcoin whitepaper.
• Dnet / despatchNet.com (1998–2008) — a dispatch/payments platform Jack co-founded with Greg Kidd (Federal Reserve, later Coinbase seed / Ripple employee #10). Dnet built a peer-to-peer networking system for “settling payments” and explicitly aimed to “provide an ATM for couriers, most of whom don’t have bank accounts.” Erik Westra was the primary coder. Development ran until July 10, 2008 — then Westra went dark for 9 months, resurfacing only after Bitcoin launched.
• Timeline overlap: Jack was fired from Twitter Oct 15, 2008; Satoshi whitepaper dropped Oct 31, 2008. Jack returned to Twitter March 2011; Satoshi’s last known email was April 2011.
• “Bit Rot Kid” — one of 52 self-declared handles on his Jan 2001 LiveJournal. Pro-Dorsey side frames this as foreshadowing “bitcoin.”
• “Satoshi” origin — his close friend Crystal Taylor’s first test-tweet on Mar 8, 2006 was “satoshi tomeii!” (referencing DJ Satoshi Tomiie). Jack published these internal chat logs in March 2011, right as Satoshi was disappearing.
• Today — funds the majority of Bitcoin Core development; financed the anti-CSW lawsuit.

What’s weak (code)

12-Trait Stylometric Comparison: Dorsey vs Satoshi

Dorsey’s Actual Code (Publicly Available)

#import <Cocoa/Cocoa.h>

@implementation NSApplication (shutCocoaUp)
- (void) buttonPressed: (id)sender
{
  //  !!! is there a better way to do this?
}
@end

int main(int argc, const char **argv)
{
  return NSApplicationMain(argc,argv);
}

def getburnsfor(tags):
  burns = []
  for t in tags:
    try: burns += file(pathjoin('tag',t)).read().split()
    except: pass
  ...
  # !!! better way to do this sort?
  sburns = []
  for b in burns:
    sburns.append((os.path.getmtime(pathjoin('burn',b)),b))
  sburns.sort()
  sburns.reverse()

What Satoshi’s code actually looks like

class CBlock
{
public:
    // header
    int nVersion;
    uint256 hashPrevBlock;
    unsigned int nBits;
    unsigned int nNonce;

    CBlock()
    {
        SetNull();
    }

    bool IsNull() const
    {
        return (nBits == 0);
    }
};

The C-prefixed class, the nVersion/hashPrevBlock/nBits Hungarian notation, the 4-space indent, the Allman braces, and the PascalCase method names are all absent from Dorsey’s 2004 code in both languages.

The one similarity decashed cites, contextualized

Decashed’s code-based argument rests on two observations: both Dorsey and Satoshi use // single-line comments, and both write self-questioning comments. Examples:

The habit of self-questioning is shared — but the marker differs (!!! vs ////), the language differs (Obj-C/Python vs C++), and every other structural feature of the surrounding code is opposite. “Is there a better way?” is not a fingerprint; it is one of the most common comment patterns any programmer writes.

The unfalsifiable rebuttal

Bottom line

On pure code stylometry, Dorsey scores 1/12 — tied with Adam Back for the weakest match. Every structural marker that identifies Satoshi (C++, MFC, Hungarian notation, C prefix, Allman braces, 4-space indent, Windows-first) is absent from Dorsey’s publicly available code. He is the opposite archetype: a Mac/Unix scripting and Obj-C utility developer.

The biographical fit is genuinely interesting — much stronger than most candidates. A cypherpunk-adjacent 1996 UMR student working on Windows imaging software at 15, co-founder of a P2P dispatch and payments system that quietly shut down in July 2008, who was fired from Twitter two weeks before the Bitcoin whitepaper — that is not nothing. But biography without code evidence is what every Satoshi theory has. The NYT built its Adam Back case on biography; it collapsed when we looked at the code.

The honest position: Dorsey could have hired or directed someone with the MFC background to write Bitcoin (Erik Westra, the Dnet programmer, is the obvious candidate for that role — he went dark exactly when Satoshi appeared). But Dorsey as Satoshi writing Bitcoin v0.1 himself is not supported by any code we can examine.

What would settle it

Satoshi's writings contain well-documented Commonwealth English patterns: "colour," "favour," "grey," "defence," "analyse," and the colloquialism "bloody hard." The Bitcoin whitepaper uses "favour." Bitcoin v0.1's UI code uses SetBackgroundColour and GetColour. These spellings are standard in the UK, Australia, New Zealand, and Canada.

Satoshi's corpus shows the same mix: "favour" and "colour" (British) alongside "characterized" and "optimize" (American). This is natural for a Commonwealth English speaker immersed in American technology — you spell your own words in your native dialect but absorb American spellings from the tools you use daily.

Multiple studies have analyzed 742+ timestamps from Satoshi's bitcointalk posts, SourceForge commits, and emails (Oct 2008 – Dec 2010). The findings are consistent:

Sleep window (near-zero activity): ~05:00 – 11:00 UTC
Peak activity: ~14:00 – 23:00 UTC

Timezone Assessment

• BEST FIT London (GMT) — Sleep 5–11 AM (normal), work 2–11 PM (normal). Plus: Genesis Block quotes The Times of London, British spellings throughout Satoshi's writings.
• GOOD FIT US Eastern (EST) — Sleep midnight–6 AM (normal), work 9 AM–6 PM (normal business hours).
• POSSIBLE US Pacific (PST) — Sleep 9 PM–3 AM (early to bed), work 6 AM–3 PM (early riser).
• RULED OUT Australia AEST (UTC+10) — "Sleeping" 3–9 PM (peak waking hours), "working" midnight–9 AM (all-nighter every day for 14+ months). The Chain Bulletin called this "not even remotely possible unless Satoshi is a vampire."