Since the early days of Bitcoin, there has been a debate about how much Bitcoin was mined by Satoshi Nakamoto. The question is mostly interesting for its own sake: by all appearances, Satoshi Nakamoto either no longer has the private keys to these early coins, or at the very least is uninterested in spending them. Still, it's an interesting question: in a parallel universe where Satoshi reappears out of the void, how much Bitcoin would be in Satoshi's wallet?
There have been a number of other attempts to estimate Satoshi's holdings before. For those interested, I would especially recommend this Quora answer, which uses a more complex (and probably more accurate) method of estimating which coins were mined by Satoshi. However, you don't actually need sophisticated techniques to understand the evidence available. I'm going to make a simpler analysis that primarily looks at the estimated hash rate of the Bitcoin network in 2009.
Estimating The Network Hash Rate
The total hash rate of the Bitcoin network can be estimated from fields that are included in Bitcoin blocks. Every block mined has a special block header which contains the most important metadata about the block. Block headers are 80 bytes, and include the following data:
| Field | Size |
|---|---|
| version | 4 |
| prevBlockHash | 32 |
| merkleRoot | 32 |
| timestamp | 4 |
| difficultyTarget | 4 |
| nonce | 4 |
For this analysis, we will be looking at two of the fields in the block header: the timestamp and the difficulty target.
The difficulty target is a number that encodes the minimum block difficulty. There is a simple formula that translates the 32-bit difficulty field in the block header into a 256-bit difficulty target. The difficulty target is used to tell if a block hash meets the criteria to be accepted as a new block: if the 256-bit block hash is numerically less than the 256-bit difficulty target, then the block meets Bitcoin's proof-of-work requirement. The difficulty target is periodically adjusted (more on this in a moment).
The timestamp field is a 32-bit unsigned Unix timestamp, which encodes the time the block was mined. Because Bitcoin is a distributed system, there is no universal reference clock that can be used by all nodes. Despite this, block timestamps are still necessary for difficulty adjustments. Nodes validate the timestamp field loosely, allowing it to have some skew. The exact rules for what timestamps nodes will consider to be valid are a bit complex, but in general nodes on the network require that new blocks have timestamps within two hours of their own clock.
Bitcoin is designed to have a 10 minute block interval, which means that on average new blocks should appear every 10 minutes. A new difficulty target is calculated every 2016 blocks, with the goal of keeping the block interval on schedule. This is done by taking the actual time taken to mine the last 2016 blocks, and using that to compute a new difficulty target. The elapsed time is calculated using the timestamp from the block headers. At a 10 minute block interval, 2016 block interval works out to exactly 14 days. Therefore the difficulty is adjusted about once every two weeks.
With this background, it should be apparent how we can estimate the historical Bitcoin network hash rate. For each 2016 block difficulty period, you can use the block timestamps to estimate the actual elapsed time in that difficulty period. This might be inaccurate by a few hours, but that's negligible compared to the total period length (about 14 days). Using the difficulty formula, you can then estimate the number of hashes it took to mine the blocks in the period, and together these numbers can be used to estimate the hash rate of all nodes mining on the network.
Early Bitcoin Network Hash Rate
The chart below shows Bitcoin's network hash rate from the genesis block mined January, 2009 through early 2010. You can find the code I used to generate this graph on GitHub, along with additional notes about how I gathered the data and my methodology.
The genesis block was mined on January 3, 2009. For the next six months or so, the Bitcoin hash rate stayed very constant, at around 5 MH/s. There was a dip in network hash rate for a short time after that, and then the hash rate started picking up quickly around Christmas. I've included a few extra months of 2010 data to show how dramatic the increase in hash rate was.
Most of the blocks mined in 2009 have very few transactions in them. The majority of them just include a single coinbase transaction, which is the required transaction encoding payout of the block reward to the miner. Coupled with the anemic hash rate, we can speculate that there were very few users of Bitcoin in 2009. It's known that a few enthusiasts like [Hal Finney](https://en.wikipedia.org/wiki/Hal_Finney_(computer_scientist)) (the first user of Bitcoin) downloaded and ran Satoshi's code. Hal previously stated that he actually mined one of the first 100 blocks. But there's no evidence that any of these early adopters, including Hal, did much more than run the code for a short time before losing interest.
In fact, things were so dire that for most of 2009 blocks were being mined much slower than the 10 minute block interval target. You can click "Block Interval" in the chart legend to see the average block interval in each period. The goal block interval is 600 seconds. It wasn't until the final difficulty period in 2009 (which started at block 32256, mined Dec 30, 2009) that the difficulty target had to be adjusted upwards from the minimum value.
Based on the above, I find it reasonable to assume that most of the hashing power in the first year or so of Bitcoin's existence came from Satoshi Nakamoto. If real users were actually joining and leaving Bitcoin, one would expect the hash rate to have varied a lot more, particularly in the first six months. Starting in early 2010 the network hash rate does start increasing rapidly, suggesting that's when the real serious users started using (and mining) Bitcoin.
Was Satoshi Solo Mining?
We know that Hal Finney and a few other people downloaded and installed Bitcoin in 2009. But the available testimony suggests that they merely tried it out, and weren't mining or using Bitcoin seriously. It's possible that these users lost interest after a few hours or days, which is reasonable when you consider that at the time Bitcoin would have been using a lot of CPU power for no apparent benefit to the user.
The few months have a consistent hash rate of about 5 MH/s. Would it have been feasible for Satoshi Nakamoto to have solo mined with 5 MH/s in 2009? The answer is "yes", and in fact it's possible to achieve this hash rate using a single Intel CPU. The linked Bitcoin wiki page gives a 5.1 MH/s hash rate for the Core i5-650 CPU, which released in January, 2010 with a 3.2 GHz clock speed. The Intel CPUs available in 2008 when Satoshi Nakamoto created Bitcoin would have been slightly earlier generation "Core 2" processors. Those would have been nearly as fast as a Core i5-650. In fact, the highest end desktop processors available when Satoshi Nakamoto started mining Bitcoin would have been much faster than that. The wiki page shows that a Core 2 Quad Q6600 (released January, 2007) would have been capable of achieving 11 MH/s. The numbers for AMD CPUs in this era are similar.
The hashing power of CPUs available at the time Bitcoin was written gives even stronger evidence that Satoshi was solo mining in 2009: if even one other person was mining full time, the hash rate should have been much higher than what we actually see. For further evidence that Satoshi was mining with a single CPU/Bitcoin process, see the Quora post linked earlier in this article.
Conclusions
The most common estimate I've seen for Satoshi's holdings is 1 million BTC. This is quite reasonable given that 1.6 million BTC were mined in 2009, which means that Satoshi could have mined 1 million BTC with about 60% of the total network hash rate. If anything, I would put 1 million as a lower bound, particularly if you consider that Satoshi probably mined into 2010 (and beyond?).
Most of the mining rewards from 2009 have never been spent. There's no evidence to suggest that Satoshi Nakamoto will actually reappear with 1 million BTC. If Satoshi did spend 2009 coins in new transactions it would be a newsworthy event that would quickly attract a great deal of presumably unwanted attention.
If anything, the evidence here makes Bitcoin's success even more remarkable. Writing something as complex as Bitcoin is no small feat: besides the novel cryptography, Bitcoin 0.1 included a custom peer-to-peer protocol, a special purpose scripting language, wallet functionality, and a GUI. Apparently very few people actually downloaded and ran Bitcoin in 2009. It would have been easy to give up on the project, particularly considering that Bitcoin is a network whose value is derived from its users. Thankfully that's not what happened, and Satoshi was able to run the network long enough to build a user base.