The Bitcoin white paper, page by page

§ 1Introduction

Frames the trust problem with the existing banking and e-commerce systems: irreversible transactions are not really possible, reversal costs are passed to merchants, fraud is accepted as unavoidable, micropayments are infeasible because of fixed minimum-friction costs.

"What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party."

The introduction does not promise to abolish banks. It promises a specific alternative for one specific failure mode — reversibility-dependent fraud — and leaves the rest of the financial system intact.

§ 2Transactions

Defines a Bitcoin as "a chain of digital signatures." Each owner transfers the coin by signing a hash of the previous transaction together with the public key of the next owner. Anyone can verify the chain.

But signatures alone don't stop the same coin from being signed over to two different recipients. Section 2 explicitly names the unsolved problem:

"The problem of course is the payee can't verify that one of the owners did not double-spend the coin. A common solution is to introduce a trusted central authority, or mint, that checks every transaction for double spending. […] We need a way for the payee to know that the previous owners did not sign any earlier transactions."

The rest of the paper is the construction of that way.

§ 3Timestamp Server

Borrows from Haber and Stornetta's 1991 work on cryptographic timestamping (one of the eight references). The idea: a timestamp server takes a hash of a block of items, publishes the hash, and each new block includes the previous block's hash. The result is a chain where every block proves the existence of every prior block at or before the time it was published.

This is the structural skeleton of the blockchain — though Satoshi never uses that word. The novelty isn't the chain itself; it's how the chain gets agreed upon, which is the next section.

§ 4Proof-of-Work

The central innovation of the paper. To add a block, miners must find a value whose hash, combined with the block header, begins with a target number of zero bits. Finding such a value is computationally expensive (brute-force search); verifying it is instantaneous.

"The proof-of-work involves scanning for a value that when hashed, such as with SHA-256, the hash begins with a number of zero bits. The average work required is exponential in the number of zero bits required and can be verified by executing a single hash."

This converts the abstract "longest chain" idea into something a network can actually defend. Whoever has the most computational power has the most influence over which chain becomes canonical. To rewrite history, an attacker would have to redo the proof-of-work of every block since the change — and keep up with new blocks being added by everyone else at the same time.

Section 4 also introduces difficulty adjustment in one sentence: "To compensate for increasing hardware speed and varying interest in running nodes over time, the proof-of-work difficulty is determined by a moving average targeting an average number of blocks per hour." That target became 10 minutes.

§ 5Network

Six operational steps describing exactly what a Bitcoin node does:

1. New transactions are broadcast to all nodes.
2. Each node collects new transactions into a block.
3. Each node works on finding a proof-of-work for its block.
4. When a node finds a proof-of-work, it broadcasts the block.
5. Nodes accept the block only if all transactions in it are valid and not already spent.
6. Nodes express their acceptance by working on creating the next block in the chain, using the hash of the accepted block as the previous hash.

Step 6 is the consensus mechanism. There is no vote, no quorum, no governance committee. A node "accepts" a block by building on top of it. The rule of consensus is: "always to consider the longest chain to be the correct one and […] keep working on extending it."

§ 6Incentive

Half a page. Establishes the entire economic model of Bitcoin.

"By convention, the first transaction in a block is a special transaction that starts a new coin owned by the creator of the block. This adds an incentive for nodes to support the network, and provides a way to initially distribute coins into circulation, since there is no central authority to issue them."

That sentence creates the block subsidy (now the largest component of miner revenue alongside fees), the issuance schedule, and the entire mining industry. The phrase "a way to initially distribute coins" is what eventually became the 21M supply cap — though the specific number doesn't appear in the paper at all. It was set in the source code.

Section 6 also addresses the game-theoretic question of why miners follow the rules:

"He ought to find it more profitable to play by the rules, such rules that favour him with more new coins than everyone else combined, than to undermine the system and the validity of his own wealth."

§ 7Reclaiming Disk Space

An engineering pragmatism note. Once a block's transactions are buried under enough later blocks, the spent transactions can be discarded to save disk space — provided the block's header (which depends on all transactions through a Merkle root) remains untouched.

This is where Satoshi introduces Merkle trees by reference (Merkle 1980 — another of the eight citations). The block header commits to a Merkle root of all transactions, so any transaction can be proven to be in a block without storing the rest of the block. This same property powers SPV in Section 8.

Satoshi estimates that with Moore's Law, the storage requirement "should not be a problem even if the block headers must be kept in memory."

§ 8Simplified Payment Verification

How a lightweight client (today: most mobile and hardware wallets) can verify a payment without running a full node.

"It is possible to verify payments without running a full network node. A user only needs to keep a copy of the block headers of the longest proof-of-work chain. […] He can't check the transaction for himself, but by linking it to a place in the chain, he can see that a network node has accepted it, and blocks added after it further confirm the network has accepted it."

SPV is the basis of how every modern mobile Bitcoin wallet works. It also frames why the "longest chain" rule matters so much — a light client can't verify transactions, only block headers, so the security of SPV is entirely the security of the chain selection rule.

§ 9Combining and Splitting Value

Explains how a transaction can have multiple inputs and multiple outputs — the basis of the UTXO model.

If Alice wants to send 1.5 BTC and she only has two outputs of 1 BTC each, she creates one transaction with both as inputs and two outputs: 1.5 BTC to the recipient, 0.5 BTC back to herself as change. No partial coins exist; transactions consume whole outputs and produce new ones.

This is also where Satoshi explicitly addresses the "fan-out" problem: he notes that the paper does not require keeping a per-coin history forever; only the unspent outputs need to be tracked. This is the conceptual origin of the UTXO set.

§ 10Privacy

Bitcoin's privacy model is honest about its limits. Identities are not directly linked to keys, but transactions are public.

"The traditional banking model achieves a level of privacy by limiting access to information to the parties involved and the trusted third party. The necessity to announce all transactions publicly precludes this method, but privacy can still be maintained by breaking the flow of information in another place: by keeping public keys anonymous."

Satoshi recommends using a fresh key pair for each transaction so the public log can't easily be linked back to a single owner. This works in practice less well than it sounds — modern chain-analytics firms cluster addresses heuristically — but the principle is still the basis of how good privacy hygiene looks in Bitcoin today.

§ 11Calculations

The most mathematical section. Computes the probability of a successful attack: an attacker generating an alternate chain faster than the honest network, then releasing it to reverse a confirmed transaction.

The model is a binomial random walk: each new block increases the honest chain's lead by 1 with probability p (honest fraction of hashrate) and decreases it by 1 with probability q (attacker fraction, where q < 0.5). Satoshi approximates this with a Poisson distribution.

The famous table in this section shows attacker success probability as a function of attacker hashrate and number of confirmations the victim has waited (z):

"q=0.1 z=5 P=0.0009137
q=0.1 z=6 P=0.0002428
q=0.1 z=10 P=0.0000012"

At 10% attacker hashrate, six confirmations drops success probability to ~0.024%. This is where the "wait 6 confirmations" convention comes from — it isn't arbitrary; it's the number in Satoshi's table where the probability of a double-spend by a sub-majority attacker becomes negligible.

§ 12Conclusion

Half a page summarising the construction. Worth reading in full because it preserves Satoshi's framing of what was actually new:

"We have proposed a system for electronic transactions without relying on trust. […] To solve this, we proposed a peer-to-peer network using proof-of-work to record a public history of transactions that quickly becomes computationally impractical for an attacker to change if honest nodes control a majority of CPU power."

The conclusion ends on the network's voluntary character: nodes can join and leave at will, and the longest-chain rule lets them re-synchronise without ceremony. "They vote with their CPU power, expressing their acceptance of valid blocks by working on extending them and rejecting invalid blocks by refusing to work on them." Eighteen years later, the protocol still works exactly that way.