The Bitcoin Whitepaper Explained, Section by Section

Key takeaways

• The whitepaper is a nine-page paper, “Bitcoin: A Peer-to-Peer Electronic Cash System”, sent to a cryptography mailing list on 31 October 2008 under the name Satoshi Nakamoto.
• Its central idea is to replace a trusted payment company with a public record of transactions, kept in order by proof of work.
• It does not state the 21 million limit and never uses the word blockchain. Lightning and mining pools came later.
• The first six of its twelve sections hold the core design and need no maths.

What is the Bitcoin whitepaper?

The Bitcoin whitepaper is the short technical paper in which Satoshi Nakamoto first described Bitcoin, titled “Bitcoin: A Peer-to-Peer Electronic Cash System”. It was sent to a cryptography mailing list on 31 October 2008, about two months before the first block was created. It runs to nine pages and is free to read at bitcoin.org/bitcoin.pdf.

It is a design proposal, not a user guide, and says nothing about wallets or exchanges. The software followed in January 2009, as The History of Bitcoin recounts, and the author is covered in Who Is Satoshi Nakamoto?

What problem does the paper start with?

The introduction starts with trust. Online commerce depended almost entirely on financial institutions acting as middlemen. The paper names the cost: because a middleman can reverse a payment in a dispute, fully final payments are not possible, and merchants must collect extra customer information and accept some fraud.

The paper proposes proof instead of trust, so that two parties could pay each other directly. The obstacle is double spending. A digital file can be copied, so an electronic coin could be spent twice, and the usual fix is a central operator who checks every payment against its own books. The paper asks whether a crowd of strangers could do that job instead.

How do transactions, timestamps and proof of work fit together?

Sections 2 to 4 build the core: coins as chains of signatures, a shared timestamp record, and proof of work to make that record costly to rewrite.

Transactions (section 2). The paper defines an electronic coin as a chain of digital signatures. To pay someone, the current owner signs a message containing the previous transaction and the next owner’s public key. Anyone can check the signatures, but they cannot show that the owner did not already sign the same coin over to someone else. The only way to rule that out is for everyone to see all transactions and agree on their order.

Timestamp server (section 3). The fix is to bundle transactions into blocks and publish a hash of each block, as one might publish a fingerprint in a newspaper. Each block includes the previous block’s hash, so the blocks form a chain, and changing an old block would break every link after it.

Proof of work (section 4). Anyone can publish a block, so something must make publishing costly. A block only counts if its SHA-256 hash falls below a target, and the only way to get there is to try a number called a nonce over and over. Checking an answer takes a moment, while finding one takes real computing effort.

Because rewriting an old block means redoing the work for it and every block after it, the longest chain, the one with the most work behind it, is taken as the true history. The paper calls this one CPU, one vote. How Does Bitcoin Work? explains the mechanism from a user’s side and What Is a Blockchain? as a data structure. Difficulty adjusts to keep block timing steady, as Bitcoin Hash Rate and Mining Difficulty Explained describes.

How does the network run, and why do miners get paid?

Sections 5 and 6 describe the routine and the reward: nodes follow the same five steps, and block creators are paid in new coins and transaction fees.

1. New transactions are sent to all nodes.
2. Each node gathers them into a block and works on its proof of work.
3. A node that finds one announces the block.
4. Others accept it only if every transaction in it is valid and unspent.
5. They show acceptance by building the next block on top of it.

Nodes always follow the longest chain. If two blocks appear at nearly the same moment, nodes keep both branches and switch to whichever grows longer.

For the incentive, the first transaction in each block creates a new coin for whoever built it. That pays for the effort and solves the issuing problem, since no central authority creates coins. If a transaction’s outputs add up to less than its inputs, the difference is a fee for the block’s creator, and the paper expects fees to take over once a predetermined number of coins is in circulation.

What do the sections on disk space, light verification and change cover?

Sections 7 to 9 are practical refinements, and each has a counterpart in Bitcoin today.

Reclaiming disk space (section 7). The paper summarizes a block’s transactions with a single hash from a Merkle tree, a structure in which many items roll up into one fingerprint. Once a coin’s latest transaction is buried under enough blocks, older spent transactions can be discarded without breaking the chain of hashes.

Simplified payment verification (section 8). Someone checking a payment can keep just the block headers and ask a node for the branch of the tree linking the payment to a block. They cannot check the rules themselves, so they depend on honest nodes outnumbering attackers. The paper expects busy businesses to run their own nodes, as What Is a Bitcoin Node? describes.

Combining and splitting value (section 9). A transaction can take several inputs and normally pays out to at most two places: the recipient, and change back to the sender. What Is a UTXO? works through an example.

What do the privacy and attacker sections say?

Section 10 argues a public ledger can still keep identities out, and section 11 shows why an attacker’s odds shrink fast.

Privacy (section 10). Bitcoin cannot protect privacy by keeping records private, because transactions must be public. The paper keeps names out instead: the world sees an amount moving between keys, much as a stock exchange publishes trades without naming the traders. It advises a new key pair for each transaction and admits that transactions with several inputs reveal a shared owner. This is pseudonymity, not anonymity, as Is Bitcoin Private? explains.

Calculations (section 11). The paper considers an attacker building a rival chain faster than the honest one. Even a successful attacker cannot create money from nothing or take coins that were never theirs, because nodes reject invalid transactions. The attacker could only try to reverse their own recent payments, and treating the race as a gambler’s ruin problem, the paper shows those odds fall exponentially with each block added on top. That reasoning underlies waiting for several confirmations.

What is not in the whitepaper?

Several things people attribute to the paper are not in it.

• The 21 million limit. The paper mentions only a predetermined number of coins. The cap and halving schedule are in the software, as How Many Bitcoin Are Left to Mine? explains.
• The word blockchain. The paper describes blocks linked by proof of work but never uses that word.
• Lightning, pools and ASICs. The paper assumes ordinary computers each voting alone. The Lightning Network was described in a separate paper in 2015, as What Is the Lightning Network? notes, and pooling and specialized chips came later.

How does the paper’s design map to Bitcoin today?

Most of the 2008 design is still recognizable, though details have changed. Transactions now spend earlier outputs and are signed with the owner’s key.

Whitepaper idea	Bitcoin today
Timestamp server	Blocks added about every ten minutes (a figure the paper uses only in its disk-space estimate)
Proof of work with SHA-256	Still SHA-256, now computed on specialized ASIC hardware
One CPU, one vote	Hash power, with many miners joining pools
New coins for the block’s creator	A subsidy that halves every 210,000 blocks, plus fees, as What Is the Bitcoin Halving? explains
Merkle trees to drop spent data	A Merkle root in each block header, and pruned nodes
Simplified payment verification	Light wallets, which often rely on a server run by someone else

How can you read the paper without a maths background?

You can read the whitepaper without a maths background by treating the first six sections as the whole story and skimming the rest.

Start with the abstract and the introduction, then read sections 2 to 6 in order, keeping this article open for terms such as hash or nonce. Skim the rest, and in section 11 take the conclusion rather than the equations. It was written for readers who already knew cryptography, so its terseness is not your fault.

It is also a 2008 proposal, and today’s network has added upgrades, hardware and an industry, as Inside a Bitcoin Mining Operation shows. The paper will not tell you whether bitcoin suits your finances, and for money decisions a qualified professional is the right person to ask. If you are new to the subject, the Start Here path gives an ordered route.

Where to go next

• The History of Bitcoin: From a Whitepaper to a Global Network: what happened after the paper.
• Who Is Satoshi Nakamoto? What We Know and What We Don’t: the author behind the name.
• How Does Bitcoin Work? Blocks, Miners and Keys Explained: the mechanism from a user’s side.
• What Is a Blockchain? Bitcoin’s Ledger Explained: the data structure at the paper’s core.