Comparing Bitcoin v0.1 (2009) against open-source code from 11 Satoshi candidates
Based on analysis of Bitcoin v0.1.0 (January 2009) — main.cpp, net.cpp, ui.cpp, serialize.h, bignum.h
| Trait | Satoshi | M. Stokes | V. Falco | Wei Dai | P. Le Roux | J. McCaleb | L. Sassaman | H. Finney | P. Gutmann | A. Back | G. Andresen |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Language | C++ | C++ | C++ | C++ | C (some .cpp) | C++ | C | C | C | C | C++ |
| Comments | // only | // (819 vs 8) | // mostly | // mostly | /* */ primary | // mostly | /* */ only | /* */ only | /* */ only | /* */ only | // mostly |
| Naming | CamelCase | CamelCase | CamelCase | CamelCase | C style | CamelCase | snake_case | snake_case | snake_case | snake_case | CamelCase |
| C class prefix | Yes (CBlock) | Yes (CNetwork) | No | No | N/A | No | N/A | N/A | N/A | N/A | Yes (CScheduler) |
| Hungarian vars | f/n/map/v | m_b/n/p full | m_ prefix | simple | b/sz/n full | m prefix | N/A | N/A | N/A | N/A | Partial (n prefix) |
| Indentation | 4 spaces | tabs | 2 spaces | tabs | tabs | tabs | 2 spaces | tabs | tabs | tabs | 4 spaces |
| if spacing | if (x) | if ( x ) | if (x) | if (x) | mixed | if(x) | if (x) | if (x) | — | if ( x ) | if (x) |
| Return style | return x | return x | return x | return x | return x | return(x) | return x | return x | — | — | Mixed |
| Brace style | Allman | Allman | Allman | Allman | K&R-ish | K&R | Allman | K&R | — | K&R | Mixed Allman/K&R |
| Ret type placement | same line | same line | same line | same line | same line | same line | same line | separate | — | same line | same line |
| Platform | Windows-first | Windows MFC | Windows | Cross+MSVC | Windows | Cross-plat | Unix+Win32 | Unix-first | Cross-plat | Unix-first | Unix/Linux |
| Raw ptrs / NULL | Yes | Yes | Some | No smart | Yes (BOOL) | Some smart | — | — | — | — | Mixed |
| No namespaces | Yes | Yes | — | — | — | — | — | — | — | — | — |
| Rank | Candidate | Score | Era Code | Best Match | Key Gap | |
|---|---|---|---|---|---|---|
| 1 | Michael Stokes | 11/12 | Shareaza (2002–2017) | ONLY candidate matching C prefix + Hungarian + MFC + P2P protocol design | Tabs not spaces; if ( x ) has extra interior spaces | |
| 2 | Vincent Falco | 9/11 | DSPFilters (2009) | Windows P2P developer (BearShare) — exact profile | BearShare source closed; no C prefix in available code | |
| 3 | Gavin Andresen | 8.5/12 | scheduler, IBLT (2015) | C prefix (CScheduler) + 4-space indent + line comments | Unix not Windows; mixed brace/return style. Style may reflect Satoshi's influence. | |
| 4 | Wei Dai | 8.5/11 | Crypto++ (1995–present) | Most general C++ traits match; sophisticated codebase | Not Windows-first; no C prefix or Hungarian notation | |
| 5 | Paul Le Roux | 5.5/12 | E4M/TrueCrypt (1998–2000) | Hungarian notation + Windows. Criminal = anonymity motive | Writes C not C++, block comments, tabs | |
| 6 | Jed McCaleb | 4.5/11 | NewCoin (2011) | Writes C++, CamelCase naming | Tabs, return(x), if(x), not Windows-first | |
| 6 | Len Sassaman | 4.5/9 | Mixmaster | Allman braces, if (x) spacing | Writes C not C++, block comments | |
| 8 | Hal Finney | 2/10 | RPOW (2004) | if (x) spacing, return x style | Writes C, tabs, block comments, separate-line return type | |
| 8 | Peter Gutmann | ~2/12 | cryptlib | Writing stylometry #2 match (ULC Legal study) | Writes C, block comments, tabs | |
| 10 | Adam Back | 1/10 | hashcash | Same-line return type | Writes C, tabs, block comments, spaces inside parens, snake_case | |
| — | Nick Szabo | N/A | (Java only) | Cannot evaluate — no public C/C++ code | ||
| — | Craig Wright | N/A | (none) | Cannot evaluate — 0 public repos |
Across all 10 candidates, the stylometric analysis has converged on a very specific profile for Satoshi: someone who wrote Windows MFC/ATL C++ peer-to-peer applications in the 2000–2008 era. The C class prefix, Hungarian notation, Allman braces, precompiled headers, and heavy Win32/MFC references are not generic C++ habits — they are the specific fingerprint of a Visual C++ application developer working on desktop software.
The three candidates who best match this profile:
Two of Satoshi's most distinctive traits — the C class prefix (CBlock, CTransaction) and Hungarian notation (fFound, nBestHeight, mapWallet) — were previously unmatched by any candidate. These conventions come specifically from Microsoft's MFC (Microsoft Foundation Classes) and COM programming traditions.
Michael Stokes' Shareaza is the first and only codebase to match both traits. Shareaza uses CamelCase with C prefix (CCollectionFile, CNetwork, CBTClient, CDownload, CBuffer, CAlbumFolder) and full Hungarian notation (m_bActive, nLength, nCount, pFile, pPacket, pHost). The Shareaza codebase also uses StdAfx.h (precompiled headers), the same pattern as Satoshi's monolithic headers.h. And Stokes designed a decentralized P2P protocol (Gnutella2), matching Satoshi's domain expertise in peer-to-peer network design.
The remaining gap between Stokes and Satoshi — tabs vs. 4 spaces for indentation, and if ( x ) with extra interior spaces vs. Satoshi's if (x) — is the smallest discrepancy of any candidate. Indentation style is also the trait most easily changed by a developer (via editor settings or project conventions), making it a weaker signal than naming conventions or comment style.
Satoshi's writings contain well-documented Commonwealth English patterns: "colour," "favour," "grey," "defence," "analyse," and the colloquialism "bloody hard." The Bitcoin whitepaper uses "favour." Bitcoin v0.1's UI code uses SetBackgroundColour and GetColour. These spellings are standard in the UK, Australia, New Zealand, and Canada.
Michael Stokes resides in Australia (confirmed on the Shareaza Wiki). Australian English uses British spellings as standard — "colour," "favour," "analyse," "defence." The word "bloody" is quintessentially Australian slang.
Shareaza's source code confirms Stokes writes in British/Australian English:
| Word | British (Stokes) | American | Ratio |
|---|---|---|---|
| colour vs color | 302 | 61 | 83% British |
| initialise vs initialize | 2 | 48 | 4% British |
| serialise vs serialize | 0 | 403 | 0% British |
| Total British spellings | 354 instances across codebase | ||
The pattern is telling: Stokes defaults to British spelling for words he chose himself (his own function names like CalculateColour(), GetColour(), OnSysColourChange()) but uses American spelling where forced by the Windows API (which uses "Color" in its own type names like COLORREF). This mixed British/American pattern is exactly what Satoshi's writing exhibits — and exactly what you'd expect from an Australian developer working with American APIs.
Satoshi's corpus shows the same mix: "favour" and "colour" (British) alongside "characterized" and "optimize" (American). This is natural for a Commonwealth English speaker immersed in American technology — you spell your own words in your native dialect but absorb American spellings from the tools you use daily.
Multiple studies have analyzed 742+ timestamps from Satoshi's bitcointalk posts, SourceForge commits, and emails (Oct 2008 – Dec 2010). The findings are consistent:
Sleep window (near-zero activity): ~05:00 – 11:00 UTC
Peak activity: ~14:00 – 23:00 UTC
| Period | UTC | London (GMT) | US Eastern (EST) | US Pacific (PST) | Australia AEST (UTC+10) |
|---|---|---|---|---|---|
| Sleep | 05:00–11:00 | 5 AM – 11 AM | 12 AM – 6 AM | 9 PM – 3 AM | 3 PM – 9 PM |
| Peak | 14:00–23:00 | 2 PM – 11 PM | 9 AM – 6 PM | 6 AM – 3 PM | 12 AM – 9 AM |
Corporate filings, web archives, and community records allow us to reconstruct Stokes' location with reasonable confidence. Sources include the Australian Securities & Investments Commission (ASIC), the Australian Business Register (ABR), Wayback Machine snapshots of Mercora's team page, Shareaza Wiki revision history, and a WIPO domain dispute decision.
| Date | Event | Location Implied | Source |
|---|---|---|---|
| Nov 2002 | Registers Shareaza Pty Ltd (ACN 102 912 667, WA 6014) | Perth, Australia | ASIC / ABR |
| ~2003 | Listed as CTO / co-founder, Mercora Inc. | Sunnyvale, CA (or remote?) | MarketScreener, GigaOM |
| Jun 2004 | Open-sources Shareaza 2.0, transfers domain | Unknown | Shareaza Wiki |
| Nov 2004 | Files voluntary deregistration of Shareaza Pty Ltd | Australia (filing) | ASIC doc 020841849 |
| Sep 2005 | Title on Mercora team page changes from CTO to "Client Architect" | Unknown | Wayback Machine |
| Nov 2005 | Disappears from Mercora team page entirely | Left Mercora | Wayback Machine |
| Nov 2005 | Shareaza Pty Ltd officially deregistered | Australia | ASIC |
| Feb 2006 | ABN cancelled | Australia | ABR |
| Late 2005 – Jan 2008 | COMPLETELY DARK — no digital trace found anywhere | Unknown | — |
| Jan 5, 2008 | Shareaza Wiki first revision states: "He currently resides in Australia" | Australia | SourceForge wiki rev 1733 |
| Oct 31, 2008 | Bitcoin whitepaper published | Stokes appears to be in Australia at this time | |
| Jan 3, 2009 | Bitcoin genesis block mined | Stokes appears to be in Australia at this time | |
| Aug 2008 | Social.fm (formerly Mercora) shuts down | N/A (Stokes had left years earlier) | Web archives |
| 2010–2014 | Confirmed in Australia, employed with side jobs | Australia | Shareaza Wiki (EN + NL) |
Possibly not. Despite being listed as CTO of a Sunnyvale startup, several clues suggest he may have been remote from Australia the entire time:
"I looked at how Shareaza/2.0 and Bitcoin/0.1 do networking. There is no chance this could've been the same programmer. Shareaza's Sockets network code is robust, showing deep experience with the subject. Satoshi's Sockets code is just what you'd read in a textbook, full of subtle bugs, like in-progress connect() or send() not sending all the requested data."
— Robert Graham, professional C/C++ programmer and security researcher, responding to the whowrotebitcoin.com analysis
This is a critical distinction beyond formatting. Code stylometry measures conventions (naming, spacing, braces) — but Graham is identifying a difference in competency level for networking code specifically. Stokes' Shareaza was a production-grade multi-protocol P2P client handling millions of connections; his socket code reflects years of real-world network programming. Satoshi's networking code, while functional, reads like someone who learned sockets from documentation rather than from building high-traffic P2P systems.
This further supports the conclusion that Stokes himself likely did not write Bitcoin — but someone from the same Windows MFC development ecosystem, with less networking experience but comparable coding conventions, may have. The stylometric match identifies the school of programming; the competency gap identifies a different practitioner within that school.
Satoshi announced Bitcoin on the metzdowd.com cryptography mailing list — a cypherpunk-adjacent forum. His whitepaper cites cypherpunk work (Hashcash by Adam Back, b-money by Wei Dai). We searched the complete cypherpunk mailing list archive (92,194 messages, 2000–2016) for every candidate in our analysis.
| Candidate | Posts | Assessment |
|---|---|---|
| Ray Dillinger | 849 | Massive presence. #1 in ULC writing stylometry study. |
| Adam Back | 589 | Major contributor. Discussed P2P DoS resistance + e-cash. |
| Len Sassaman | 166 | Active participant. |
| Hal Finney | 107 | Active. First person to receive a Bitcoin transaction. |
| Ian Grigg | 103 | Active. Ricardian Contracts inventor. |
| Wei Dai | 70 | Moderate. Creator of b-money (cited by Satoshi). |
| Nick Szabo | 36 | Occasional. Bit Gold designer. |
| Gavin Andresen | 16 | Minor presence. |
| BearShare (Falco mentioned) | 5 | Mentioned by others, not posted by Falco himself. |
| Shareaza (Stokes mentioned) | 2 | Mentioned in French copyright lawsuit context only. |
| Michael Stokes | 0 | Not on the cypherpunk list at all. |
| Vincent Falco | 0 | Not on the cypherpunk list at all. |
| Paul Le Roux | 0 | Not on the cypherpunk list at all. |
The code stylometry points to a Windows MFC C++ P2P application developer. The cypherpunk mailing list analysis points to a Unix-oriented cryptography researcher. These two communities barely intersect:
A Windows developer who read the cypherpunk lists without posting. They absorbed the ideas (Hashcash, b-money, distributed systems) and had the programming skills to implement them. Their code style reflects their professional background (Windows MFC), while their knowledge reflects years of silent reading.
A cypherpunk designed the system (choosing the cryptographic primitives, writing the whitepaper) while a Windows developer coded it. The code reflects the coder's style; the whitepaper reflects the designer's knowledge. Satoshi's communications could be either or both.
A rare individual who was both: a professional Windows C++ developer by day (explaining the MFC conventions, Hungarian notation, wxWidgets) and a cypherpunk enthusiast by night (explaining the cryptographic knowledge, mailing list awareness, British English). Such a person would be hard to find because they'd appear in neither community under both identities.
To test whether any cypherpunk mailing list participant matches Satoshi's code style, we searched GitHub for public C/C++ code from the top 30+ most active posters. The results are unambiguous.
| Developer | Handle | Repos | Language | Style | Windows MFC? |
|---|---|---|---|---|---|
| Moxie Marlinspike | moxie0 | sslsniff (570☆), tortunnel | C++ | /* comments, 2-space, boost::asio, Unix | No |
| Zooko Wilcox | zooko | cryptopp fork, crawl | C/C++ (fork) | Wei Dai's code, not original. Python primarily. | No |
| Jacob Appelbaum | ioerror | 9 C/C++ repos | C | Pure C (csidh, dnscrypt, flashrom), Unix/Linux | No |
| Adam Langley | agl | critbit (334☆), curve25519-donna (344☆) | C | Pure C, Google cryptographer, Unix | No |
| Trevor Perrin | trevp | libsignal-protocol-c, openssl | C | Pure C, Signal Protocol designer, Unix | No |
| Wei Dai | weidai11 | cryptopp (5,444☆) | C++ | CamelCase, Allman, tabs, cross-platform. Score: 8.5/11 | Partial |
| Hal Finney | halfinney | RPOW, bc_key | C | Pure C, /* comments, tabs, snake_case. Score: 2/10 | No |
Eugen Leitl (4,539 posts), R.A. Hettinga (2,620), Jim Choate (1,871), grarpamp (1,402), coderman (1,390), Declan McCullagh (1,363), Tim May (1,287), John Young (1,125), Major Variola (1,044), Bill Stewart (1,032), Ray Dillinger (849 posts, #1 in ULC writing study), David Honig (648), Jim Bell (237), Steven Schear (284), Thomas Shaddack (247), Cathal Garvey (264), Georgi Guninski (575), Peter Trei (516), K. Brown (281), Zenaan Harkness (816), Len Sassaman (166), Nick Szabo (36), and many others — none have public C or C++ code on GitHub. Most are theorists, activists, journalists, or worked in closed-source environments. Those with GitHub accounts write Ruby, Python, Perl, Nix, or have empty repos.
Zero cypherpunk mailing list participants match Satoshi's Windows MFC C++ coding style.
Every cypherpunk with public code writes Unix-style C or Python. The cypherpunk community was — and remains — a Unix ecosystem. Satoshi's Windows MFC/ATL C++ fingerprint (C class prefix, Hungarian notation, StdAfx.h precompiled headers, wxWidgets GUI, 5,000+ Win32 API references in comparable codebases) exists entirely outside the cypherpunk world. This is not a sampling artifact; it reflects a genuine cultural divide between the privacy/cryptography community (Unix) and Windows application development.
The two-community gap is now empirically confirmed, not merely hypothesized. Satoshi's identity sits at the intersection of two worlds that almost never overlap:
Satoshi had deep knowledge from the left column (cryptographic primitives, e-cash theory, distributed systems) but wrote code in the style of the right column (Windows MFC conventions, P2P networking patterns). Finding the person who bridges these two worlds — or the collaboration that combined them — is the key to solving the Satoshi mystery.
An exhaustive search of the Windows P2P development ecosystem — the exact community matching Satoshi's code profile — has uncovered several new candidates. These developers wrote Windows MFC C++ P2P applications in the early 2000s, using the same conventions found in Bitcoin v0.1. Some have timeline gaps that coincide with Satoshi's activity. None have been previously investigated in the Satoshi literature.
Kevin Hearn is the most intriguing new lead. He matches the Satoshi profile on multiple dimensions that no other candidate combines:
The critical barrier: all of Hearn's code is closed source. WinMX, Tixati, and DarkMX are proprietary. Without access to his actual C++ code, we cannot confirm or deny the stylometric match. If anyone has access to WinMX source code (perhaps from reverse engineering, leaked builds, or legal archives), a comparison against Bitcoin v0.1 would be one of the most important tests in the Satoshi investigation.
Source code analyzed:
| Project | Author | Source |
|---|---|---|
| Bitcoin v0.1.0 | Satoshi Nakamoto (Jan 2009) | github.com/trottier/original-bitcoin |
| Shareaza | Michael Stokes (2002–2017) | github.com/jason-jxc/Shareaza |
| DSPFilters | Vincent Falco (2009) | github.com/vinniefalco/DSPFilters |
| Crypto++ | Wei Dai (1995–present) | github.com/weidai11/cryptopp |
| E4M / TrueCrypt | Paul Le Roux (1998–2000) | github.com/FreeApophis/TrueCrypt |
| NewCoin | Jed McCaleb (Oct 2011) | github.com/XRPLF/rippled first commit |
| Mixmaster | Len Sassaman et al. | github.com/crooks/mixmaster |
| RPOW | Hal Finney (2004) | github.com/NakamotoInstitute/RPOW |
| cryptlib | Peter Gutmann | github.com/cryptlib/cryptlib |
| hashcash | Adam Back (~2002–2005) | github.com/hashcash-org/hashcash |
| scheduler | Gavin Andresen (2015) | github.com/gavinandresen/scheduler |
| IBLT_Cplusplus | Gavin Andresen | github.com/gavinandresen/IBLT_Cplusplus |
Analysis performed by comparing coding conventions across 12 stylometric traits: language choice, comment style, naming conventions, class prefix patterns, variable naming conventions, indentation, control flow spacing, return statement style, brace placement, function declaration format, platform orientation, and pointer/memory management patterns.
Shareaza corpus: 527 .cpp files, 675 .h files. E4M/TrueCrypt corpus: Mount.c, Dlgcode.c (derived from E4M 2.02a). cryptlib corpus: .c files with 159 block comment instances and 0 line comment instances.
Of the additional candidates investigated (Ray Dillinger, Phil Wilson/Scronty, Ian Grigg, Dustin Trammell, Mike Hearn, Martti Malmi, David Chaum), only Gavin Andresen had substantial public C++ code suitable for comparison. The others write in C, Java, Ruby, Assembly, TypeScript, or have no public code.
Generated April 2026. Code stylometry is one analytical lens — it can rule candidates out but cannot definitively confirm identity. Writing style can be deliberately altered.