Back proposed an e-cash system "entirely disconnected" from banking with exactly Bitcoin's five core attributes: payer/payee privacy, distributed network resistance to shutdown, built-in scarcity, no required trust in any individual or bank, and a publicly verifiable protocol. All five became Bitcoin's foundation.
Back proposed a distributed bank where "k of n nodes have to collude before they can compromise" it — Bitcoin's exact security model. The phrasing maps almost directly: Back's nodes that "come and go" → Satoshi's nodes that "leave and rejoin the network at will."
After Wei Dai proposed b-money, Back suggested combining his Hashcash proof-of-work with b-money's coin minting. That is exactly how Bitcoin works. Nobody else on the Cypherpunks or Cryptography lists made this specific combination. Satoshi later described Bitcoin as "an implementation of Wei Dai's b-money proposal" — the combination Back proposed 10 years earlier.
A related wrinkle: the Satoshi emails Back produced for the Craig Wright trial show Satoshi only learning about b-money from Back in August 2008. But Back's Hashcash paper explicitly discussed b-money. Back conceded this was inconsistent. Carreyrou believes Back staged that email exchange to deflect suspicion — that he already knew b-money from his own paper, and pretended not to.
Back proposed increasing computational difficulty as chips improved — Bitcoin's exact inflation-control mechanism. He proposed public immutable timestamps using hash trees (Bitcoin uses this with Hashcash). He made the energy-defense argument using nearly identical language to what Satoshi would write a decade later.
"As long as the wastage is lower than the costs of fiat money it's a win."
"If Bitcoin did grow to consume significant energy, I think it would still be less wasteful than the labour and resource intensive conventional banking activity it would replace."
Cafiero compared the Bitcoin white paper against papers from 12 suspects. Back came out closest — but Finney was a very close second. After recomputing with a different distance metric, the results flipped. Cafiero called the results inconclusive — twice. He noted that if Satoshi knew how stylometry worked (and Back clearly did, having written about defeating it in 1998), it would be easy to game the analysis.
Starting with 34,000 mailing list users, filtered to 620 who discussed digital money, then applied 7 sequential writing filters:
Additional convergence markers: "proof-of-work" hyphenated as compound noun (8 people on the lists; Back is one); cross-referenced with "WebMoney" mention (4 people) — overlap yields Back only. "Partial pre-image" hyphenated — only Back and Finney used it; Finney wrote "preimage" in one word, Back hyphenated it, like Satoshi. "Burning the money" to mean destroying coins — only Back used this phrase pre-Bitcoin.
Hyphenation error analysis: 325 Satoshi hyphenation errors identified; Back shared 67 (next closest: 38).
Back (1996): "I'm better at coding, than constructing convincing arguments."
Satoshi (2008): "I'm better with code than with words though."
Back denied ever using "bloody." Carreyrou found a 1998 post where he used it. Back later denied Satoshi's 2015 block size email was a forgery, calling its observations "spot on" and "consistent with Satoshi views IMO" — then used the same vocabulary Satoshi used ("dangerous," "widespread consensus," "consensus rules," "trivial") in his own posts that same week.
Back was the most prolific commenter on e-cash proposals on Cypherpunks for a decade. During Satoshi's entire active period (late 2008 – April 2011), he made no public comments about Bitcoin on the Cryptography list. He claimed on the "Let's Talk Bitcoin" podcast that he "participated" in the 2008 discussion — no posts found. His first public Bitcoin comment was June 2011, six weeks after Satoshi's final post (April 26, 2011).
The day Sergio Demian Lerner published his analysis revealing Satoshi's ~1.1M coin fortune, Back joined Bitcointalk. Within hours he was proposing sophisticated improvements. Within two weeks he was demanding Wikipedia restore the standalone Satoshi page. Within 18 months he had founded Blockstream.
Back wrote strident posts opposing larger blocks using specific vocabulary. Then "Satoshi" reappeared for the first time in 4 years using the same terms: "dangerous," "widespread consensus," "consensus rules," "trivial," "robust." Four days after Satoshi wrote "Very disappointing Gavin and Mike," Back wrote "Very disappointing Gavin and Mike."
Carreyrou: when he cited Satoshi's "I'm better with code than with words," Back interrupted with "I did a lot of talking though for somebody, I mean..." — phrasing Carreyrou interprets as Back speaking as Satoshi. Back denied it was a slip. The syntax is genuinely ambiguous; Carreyrou is reading a lot into a conversational stumble.
Carreyrou requested the metadata for Back's Satoshi emails (produced for the Craig Wright trial). Back ignored the first email, ignored the follow-up eight days later, and never provided them. Even granting that the precautions Satoshi took would make the metadata nearly useless, the refusal is notable.
Every piece of evidence entering Ringger's model was sourced from Carreyrou's investigation — a one-sided inquiry. Bayesian models do not protect against bad inputs. A well-structured DAG with cherry-picked priors produces confidently wrong answers. The model has zero counter-evidence nodes, despite our code stylometry analysis being available at the time Ringger published.
Cafiero explicitly called his results "inconclusive" — twice, after two different computational approaches. Ringger's model assigns a high Bayes factor to the stylometry category, treating an inconclusive result as positive evidence. This is a direct misread of what the expert said.
Many of Ringger's 10 evidence categories are not independent — they share underlying observations from the same mailing list corpus. The writing funnel, the blueprint posts, the behavioral silence, and the phrase parallels are all sourced from the same set of archived posts. Treating them as independent multiplies probability incorrectly, inflating confidence.
Bitcoin's January 2009 release is unmistakably the work of a Windows GUI developer. Key identifiers:
Back's Hashcash implementation and related academic code share almost nothing with Bitcoin v0.1:
class CBlock {
int nVersion;
uint256 hashPrev;
// line comment
void SetNull() {
nVersion = 0;
}
};
/* block comment */
int hashcash_check(
const char *resource,
int bits) {
char token[MAX_TOK];
int version = 0;
}
Back's code: C (not C++), snake_case (not CamelCase), block comments (not line comments), tabs (not spaces), no class hierarchies, no C prefix, no Hungarian notation, Unix-focused. Score: 1 out of 12 traits match.
Our survey of 30+ Cypherpunks mailing list participants with public code on GitHub found not one whose code resembles Bitcoin v0.1. The Cypherpunks community writes Unix C — open-source, command-line, platform-agnostic. Bitcoin was written by someone who thought in Windows MFC objects. These are two different developer cultures with minimal overlap.
This is the paradox at the center of the Satoshi mystery: the person who designed Bitcoin had Cypherpunk knowledge but Windows MFC coding habits. Back has the former but not the latter.
Carreyrou built the most rigorous Satoshi investigation published to date. The 1997–1999 blueprint is the strongest single piece of evidence for any candidate — Back didn't just describe Bitcoin's ideas, he published a near-complete technical specification a decade before launch. The writing funnel is striking. The behavioral signals — radio silence during Satoshi's active years, joining Bitcointalk the day Lerner exposed Satoshi's holdings — are hard to explain away.
The code evidence complicates this picture. Back scores 1 out of 12 on code stylometry against Bitcoin v0.1. His Hashcash source, PhD work, and known academic code are Unix C — snake_case, block comments, no class structures. Bitcoin v0.1 is Windows MFC C++ — C-prefix classes, Hungarian notation, line comments throughout, Allman braces, precompiled headers. The divergence is substantial. Either Back is not Satoshi, or he wrote Bitcoin in a style deliberately foreign to his own practice. Both remain possible.
The extended Bayesian model (documented on the Bayesian Model page) incorporates the code evidence and still returns a high posterior, but with a meaningful uncertainty tail. The 99.99% figure and the code divergence are both real. They don't easily resolve into a single number.
The analysis most likely to shift the estimate: a direct code stylometry comparison of Back's post-2013 Blockstream C++ against Bitcoin v0.1 using quantitative tools. That comparison hasn't been done.
| Evidence | Direction | Strength | Assessment |
|---|---|---|---|
| 1997–1999 technical blueprint | Pro | Very strong | Uniquely compelling — no other candidate matches this |
| Hashcash + b-money synthesis (1998) | Pro | Very strong | Back was the only person to make this specific proposal |
| Writing funnel (34,000 → 1) | Pro | Moderate–strong | Compelling, but filters chosen post-hoc from target's writing |
| Hyphenation analysis (67 vs 38) | Pro | Moderate | Quantitative and verifiable; not decisive alone |
| Cryptography list silence (2008–2011) | Pro | Moderate–strong | Hard to explain for the most vocal e-cash advocate |
| Lerner / Bitcointalk timing (2013) | Pro | Suggestive | Same-day join has other explanations; notable regardless |
| 2015 block size vocabulary match | Pro | Suggestive | Four-day echo of "very disappointing" is striking |
| Metadata refusal | Pro | Suggestive | Suspicious, but metadata may have been truly uninformative |
| Cafiero stylometry | Neutral | Inconclusive | Expert's own description — twice. Cannot be used as positive evidence. |
| El Salvador "slip" | Weakly pro | Weak | Ambiguous syntax; Carreyrou over-interprets |
| Code stylometry (1/12 match) | Counter | Moderate | Bitcoin's MFC fingerprint doesn't appear in Back's code |
| Back's coding background (Unix/C, not Windows/C++) | Counter | Moderate | PhD, Hashcash, career work: Unix-oriented throughout |
| Back's explicit denials | Weakly counter | Weak | Expected regardless of truth; weak evidence either way |