The earliest known email from Satoshi Nakamoto went to Adam Back on August 20, 2008. It asked him to check a citation of Hashcash, and then it added a link to a draft:
Satoshi Nakamoto (email to Adam Back, August 20, 2008, 5:30:39 PM UTC)I think you would find it interesting, since it finds a new use for hash-based proof-of-work as a way to make e-cash work. You can download a pre-release draft at
http://www.upload.ae/file/6157/ecash-pdf.htmlFeel free to forward it to anyone else you think would be interested. I’m also nearly finished with a C++ implementation to release as open source.
That address is the only trace of the first version of the Bitcoin paper. Three versions of the paper are on record, and two of them survive as files whose hashes anyone can check. This is the third: a PDF that two cypherpunks were invited to pass around, and that nobody has produced since.
1. What the emails kept
Two days later the same link went to Wei Dai, with the same title and the same abstract pasted below it. Between them, the two emails hold the draft’s title, “Electronic Cash Without a Trusted Third Party,” its whole abstract, and two references in the form Satoshi meant to print them: Hashcash as “[5] A. Back” and b-money as “[1] W. Dai … (2006?)”. All of that is text of the emails, not of the PDF. The body, the figures and the rest of the reference list are in neither message.
Laid beside the paper posted on October 31, the abstract barely moved:
| Abstract | Wording |
|---|---|
| August 20 email | ”Digital signatures offer part of the solution” |
| October 31 paper | ”Digital signatures provide part of the solution” |
| March 24, 2009 revision | the same, plus a rewritten majority sentence: “As long as honest nodes control the most CPU power on the network” became “As long as a majority of CPU power is controlled by nodes that are not cooperating to attack the network” |
One word in ten weeks. What changed were the title and the references. By October 3, when the PDF that went public was created, the title was “Bitcoin: A Peer-to-Peer Electronic Cash System,” b-money stood at [1] with the year 1998 that Dai had given him, and Hashcash had moved to [6]. The description of the machine was already finished in August. (The full list of what changed between October and March is kept with the October paper.)
2. The two men who got the link
The first two people to get the link were the authors of the two works the emails cite, [5] and [1]. Satoshi wrote to Back because of Hashcash, and to Dai because Back had pointed him to b-money the day before. The record does not show either of them reading the draft.
Back answered the next day and began, “Sorry still not read your paper yet,” before pointing Satoshi to Rivest and Shamir’s MicroMint (his later regret over the paper is weighed in the Adam Back identity hypothesis). Dai, in a reply that carries no date, gave the year 1998 and promised to “take a look at it and let you know if I have any comments or questions.” In April 2013 he wrote what became of that promise:
Wei Dai (LessWrong comment, April 20, 2013, 7:56:08 AM UTC)This may have been partially my fault because when Satoshi wrote to me asking for comments on his draft paper, I never got back to him. Otherwise perhaps I could have dissuaded him (or them) from the “fixed supply of money” idea.
Satoshi had invited both men to forward the file to anyone who might be interested. No record shows that either did. It is a pity. The version Satoshi showed to experts before anyone else drew no comment from either of them.
3. The two files that survived
| Version | Created (PDF metadata) | Pages | Bytes | Contact address | SHA-256 | Where it is now |
|---|---|---|---|---|---|---|
August 2008 draft (ecash.pdf) | — | — | — | satoshi@anonymousspeech.com (the emails) | — | No copy known. Title and abstract in the email to Back and the email to Dai |
| October 31, 2008 | 2008-10-03 13:49:58 −07:00 | 8 | 183,697 | satoshi@vistomail.com | 427c63b3…2faa | Archived here; gone from bitcoin.org since March 2009 |
| March 24, 2009 revision | 2009-03-24 11:33:15 −06:00 | 9 | 184,292 | satoshin@gmx.com | b1674191…f553 | bitcoin.org/bitcoin.pdf, archived here |
The October version was nearly lost as well. In March 2009 the PDF at the same address was replaced with the revision, and for six years the only paper to be had there was the nine-page one.
4. Two searches
Gwern and the August draft
In 2014 Gwern published the Dai emails and went after the file they pointed to. He listed every place he looked. The file host had vanished. The Internet Archive held neither the download page nor the PDF. Google searches for “ecash-pdf” found nothing, and neither did a search of BitcoinTalk. The paper had never been checked into the project’s Subversion repository. He asked Dai, Back and Gregory Maxwell, and none of them had a copy. He asked Hal Finney too, expecting no answer, and none came before Finney died on August 28, 2014.
People are still trying the door. The Internet Archive’s index for the upload.ae address starts in February 2020, and every capture in it is an error page or a redirect. The latest one is from October 2025.
The cryptography list and the October version
The second search was for a different file. On January 23, 2015, James Evans asked the same mailing list where the paper first appeared whether anyone had saved the October 2008 version. The next day StealthMonger, a list member who had kept it since 2008, answered, and then could not send it. He called himself an untraceable pseudonym, and he would not send the 183,697-byte file over any connection that could tie it to him. Zooko Wilcox-O’Hearn added that he had looked for it himself and not found it.
What followed is the funniest stretch in the record of the Bitcoin paper. Paul Hoffman asked “Why not Pastebin?” Paul Madore proposed Mega over Tor. StealthMonger answered all of them at once that Tor is not anonymous, and offered the file by robot mail in about thirty parts. Natanael recommended I2P; Richard Outerbridge wondered whether confidentiality and anonymity were “not only orthogonal but undeceivable? Oops, meant undecidable.” In the middle of it, Bryan Bishop set the hashes side by side: StealthMonger’s file was not the one “everyone else has.” Then David Johnston volunteered: “I’m not anonymous, neither is my web site.” Four days later:
David Johnston (Cryptography mailing list post, January 30, 2015, 5:51:16 AM UTC)I finally have the first issued version of the bitcoin paper from StealthMonger.
For your amusement and to enable you to download it from a website with an SSL certificate signed by one of those SSL companies (that sadly used SHA1), I’ve made it a page on our yarn store web site.
The shop was Black Sheep at Orenco, a yarn store in Hillsboro, Oregon. In February 2015 its page, between the knitting and spinning lessons and the sock club, called it “the only yarn store in the world that also hosts the missing 2008 revision of the bitcoin whitepaper,” and gave the PDF’s SHA-256 hash.
A week, a debate about the NSA, a mail robot, and a yarn shop. That is what it took to bring back the version Satoshi had posted to that same list in 2008.
Ten days after that, Evans went back to the list and asked for the August draft, pasting its abstract from the Dai email. The list’s index for February 2015 shows no reply.
StealthMonger gave two dates for his copy: on January 24 the file’s local date, November 2, 2008, and on January 26 the day he received it, November 8. They describe different things, and the record does not say how the file came to carry the earlier one.
No copy of ecash.pdf has been made public in the eighteen years since Satoshi sent the link. The original was in Satoshi’s hands, and his last known email is dated April 26, 2011. The draft is lost.
