Did the N.S.A. Invent Bitcoin?
In March of 2024, a judge in the Rolls Building, on Fetter Lane in London, delivered a ruling that an Australian computer scientist named Craig Wright was not, in fact, the inventor of Bitcoin. The judgment ran to a hundred and thirty-one pages. Wright had been claiming the title for almost a decade—producing documents, sending cease-and-desists, suing developers who said otherwise—and the judge, Mr. Justice Mellor, found that he had lied “extensively and repeatedly,” and had forged evidence “on a grand scale.” Wright would later be convicted of contempt of court. Watching the spectacle, one was tempted to draw a small consolation from the fact that, of the dozen or so people who have, at one time or another, been seriously proposed as the true Satoshi Nakamoto, at least one could now be confidently struck from the list.
This is not, on the whole, a satisfying way to learn things. The Satoshi mystery—who, in October of 2008, posted a nine-page paper to a cryptography mailing list and, three months later, mined the first block of a currency that has since reached a market capitalization in the trillions—remains the most consequential authorial puzzle of the digital age. Most of the candidates have, like Wright, denied it, or, like Wright, insisted on it without proof, which amounts to the same thing. And so, periodically, a new theory surfaces. The latest, and one of the more persistent, holds that there was no individual at all. Bitcoin, the theory goes, was invented by the National Security Agency.
It sounds preposterous. But, then, in early 2013, the suggestion that the N.S.A. was tapping the cell phones of the leaders of friendly nations—Angela Merkel, say—would have sounded preposterous, too. By June of that year, after Edward Snowden’s documents had begun to appear in the Guardian, it was a fact. A certain humility about what one is willing to call absurd has, since then, become a useful intellectual posture.
The case for the N.S.A. begins with an observation that is genuinely striking, even to skeptics. In June of 1996, three cryptographers at the agency’s Office of Information Security—Laurie Law, Susan Sabett, and Jerry Solinas—published a paper titled “How to Make a Mint: The Cryptography of Anonymous Electronic Cash.” It appeared on a mailing list at M.I.T. and, a year later, in the American University Law Review. The paper described a system for digital money that required, the authors said, four properties: privacy, user identification, message integrity, and non-repudiation. It was published twelve years before the Bitcoin white paper. Twelve years before Satoshi Nakamoto, whoever he, she, or they may have been.
The paper exists. The agency wrote it. These are not in dispute. What is in dispute is everything else.
The case proceeds along several lines, all of them circumstantial, some of them suggestive, none of them quite conclusive. The hash function that secures the Bitcoin blockchain, SHA-256, was indeed designed by the N.S.A., and published by the National Institute of Standards and Technology in 2001. This is a documented fact, and it has launched a thousand speculations, the most lurid of which holds that the agency built a back door into the algorithm—a hidden channel that would allow it to track Bitcoin transactions, perhaps to harvest network metadata, perhaps to do worse. The trouble with this theory is that SHA-256 is one of the most heavily scrutinized cryptographic functions in the world, examined by academics, hostile state actors, and a generation of paranoid graduate students, and no one has found such a thing. What Snowden’s documents revealed, in 2013, was a back door in a different N.S.A. algorithm—Dual_EC_DRBG, an elliptic-curve random-number generator, since deprecated. SHA-256 was not implicated. One could, of course, argue that the absence of evidence is itself suspicious—that a back door so well concealed must be very well concealed indeed—but this is the structure of an unfalsifiable claim, the kind that, in a courtroom, doesn’t survive cross-examination.
There is also the matter of motive. The N.S.A. has the brains: cryptographers, mathematicians, computational resources of a kind the public can only guess at. It has the institutional appetite for global financial visibility, since the Snowden disclosures suggested that the agency considers no signal too small to harvest. And Bitcoin, far from being the anonymous instrument of legend, turns out to be a forensic accountant’s dream. Every transaction is recorded on a public ledger, in perpetuity. When the F.B.I. dismantled the Silk Road, in 2013, it did so largely by analyzing that ledger. From this, one might conclude that Bitcoin is precisely the kind of currency a surveillance agency would design—pseudonymous enough to attract bad actors, transparent enough to track them. Or one might conclude the opposite: that no agency interested in surveillance would build its instrument on a ledger visible to its rivals. Both arguments are available. Both have their adherents.
And then, finally, there is the question of why an Australian computer scientist named Craig Wright would have spent ten years claiming credit for an invention he did not produce. There is no good answer to that one, either, but it suggests something about the shape of the field: Bitcoin attracts a certain personality, and the questions it raises invite a certain kind of conviction.
It is here that the case for the N.S.A., taken on its own terms, begins to fray.
Consider, first, the 1996 paper itself. Read carefully, it turns out to be something other than what enthusiasts describe. It is, in essence, a literature review—a survey of existing work on electronic cash, most of it by the Dutch cryptographer David Chaum, all of it premised on the existence of a central bank. The four properties it lists—privacy, identification, integrity, non-repudiation—are not innovations; they are the table stakes of any payment system that has ever been seriously proposed. What the paper does not contain is the conceptual move that makes Bitcoin Bitcoin: the elimination of the central authority. There is no proof-of-work. There is no chain of cryptographically linked blocks, no mining incentive, no hard-coded supply schedule. The systems described in the N.S.A. paper were designed to work with a bank. The system Satoshi Nakamoto designed in 2008 was, explicitly and pointedly, designed to work without one. The resemblance, on inspection, is the resemblance between a sketch of a horse and a working internal-combustion engine.
Consider, too, the question of language. Linguists who have studied Nakamoto’s posts and emails have noticed that, while the writing is fluent and assured, it tends to use British rather than American spellings. “Cheque” rather than “check.” “Colour” rather than “color.” “Maths,” not “math.” This pattern is consistent. It is not what one would expect from an N.S.A. employee writing under cover, and it is certainly not what one would expect from an institutional document signed by committee. It is what one would expect from a single person, raised on a particular variety of English, writing in his or her natural voice. (Or, possibly, a single person executing a feint of remarkable patience. The unfalsifiable theory permits no exit.)
But the deepest problem with the N.S.A. theory is not technical or linguistic. It is, for lack of a better word, political. Bitcoin did not arrive in a vacuum. It emerged from a community of cryptographers and political activists known, since the early nineteen-nineties, as the cypherpunks—a loose movement of people whose explicit goal was to use cryptography to defend the individual against the state. Wei Dai, who proposed b-money in 1998. Adam Back, whose Hashcash supplied the proof-of-work mechanism Nakamoto would later borrow. Hal Finney, who received the first Bitcoin transaction. Nick Szabo, who, before any of them, had written about something he called “bit gold.” These were not government employees. They were, by inclination and often by stated conviction, suspicious of government—of central banks, of intelligence agencies, of anything that could be plausibly described as a node of unaccountable power. Nakamoto’s white paper was first circulated on the cypherpunk mailing list. The early correspondence about the protocol took place in the same milieu.
And then there is the matter of the genesis block. On January 3, 2009, when Nakamoto mined the first block of the Bitcoin chain, he embedded in it a single piece of text, a kind of cipher to be read by anyone who came looking. It was a headline from that day’s Times of London: “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks.” This was not an arbitrary timestamp. It was a manifesto, condensed to a sentence: a complaint about the bank rescues that had defined the financial crisis, and an implicit argument that something different was now possible. It is hard to imagine an artifact less likely to be produced by an American intelligence agency, an institution whose statutory job descriptions include the protection of the very banking system the message is mocking. The cover, if it is a cover, would be perfect to the point of absurdity.
What remains? The N.S.A. produced a paper in 1996 about electronic cash. It designed the hash function Bitcoin uses. It has the resources, more or less, to do almost anything. These are facts. They sit alongside a great many other facts—about cypherpunks and motive and language and ledger—and they do not, when assembled honestly, support the inference some would draw from them. They suggest only that the agency was paying attention to a problem that was, in 1996, on the minds of a number of serious people, and that, fifteen years later, would be solved by someone working from a different set of premises entirely.
The theory persists, anyway. Russian state media has, for years, asserted that Bitcoin is a C.I.A. operation, presumably because the alternative—that a piece of consequential infrastructure was built by people no one can name—is harder for an institutional consciousness to hold. (One Duma deputy, Andrei Svintsov, declared as much from the floor.) The American conspiracy ecosystem, which thrives on the inverse of the same impulse, returns to the N.S.A. theory whenever Bitcoin is in the news, which is to say, often. The theory’s longevity is not really about evidence. It is about the difficulty of accepting that a small group of cryptographers, working largely without funding and entirely without institutional cover, could have built the most successful private currency in human history. There ought to be more to the story, the theory says. Surely there is more to the story.
Maybe there is. Maybe Snowden, or someone like him, will one day produce a folder of documents proving the whole thing. Until then, the prudent posture is the one Justice Mellor adopted in his courtroom, on the question of whether Craig Wright was Satoshi Nakamoto. He looked at the evidence. He weighed it. He found, as the lawyers say, that the burden had not been discharged.
What is more interesting, in the end, is that the question of who created Bitcoin has come to matter rather less than the questions of what to do with it now that it exists. Whoever Nakamoto was, the taxation of cryptocurrency is now a problem confronted by national revenue services on six continents. The use of digital assets in money laundering is the subject of a vast and growing regulatory apparatus. Cryptocurrency transaction reporting has been folded into the routine work of compliance officers, who, twenty years ago, would have laughed at the suggestion that they might one day have to understand a Merkle tree. These are the questions that occupy the hours of working lawyers, and they are answered not in the archives of intelligence services but in the offices of practitioners who have, by necessity, learned the field as it emerged.
The mystery of Satoshi Nakamoto is, in this sense, a luxury. It is the kind of question one entertains after the practical questions have been answered—or, more often, in the margins of answering them. The man, woman, or committee who wrote the white paper has long since gone silent. The wallet associated with the early mining, holding a fortune now estimated in the tens of billions of dollars, has not been touched since 2010. There are theories about why. There are theories about everything. The currency, meanwhile, continues to do its work, indifferent to the question of who set it in motion.
It is a strange kind of monument: anonymous, autonomous, and—on the available evidence—built by a private citizen, working alone, against the institutions that would have had every reason to stop him.
Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.
There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.
One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).
Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.
He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.
