The Bitcoin Whitepaper and How It Works

The whitepaper's first sentence clearly states its goal: "a purely peer-to-peer version of electronic cash [that] would allow online payments to be sent directly from one party to another without going through a financial institution." Satoshi saw the very structure of internet payments depending on a trusted third party such as a bank or card network as the problem. With a third party involved, fees are added, small payments become impractical, and the possibility of chargebacks pushes merchants to demand more information from customers.

The hardest problem in creating digital money without a third party is double-spending. Because digital data can be perfectly copied, a way is needed to prevent the same coin from being sent to two people at once. Earlier attempts at electronic cash solved this by having a central issuer redeem and reissue every coin, which meant the system disappeared if the issuer disappeared.

The whitepaper's solution is to prove the order of transactions. If a majority of network participants can agree on which transaction happened first, any later transaction attempting to spend the same coin is automatically invalidated. In other words, Bitcoin is not a 'copy-prevention technology' but a 'technology for reaching consensus on chronological order.'

This perspective matters because everything else in the design flows from it. Proof-of-work, the linking of blocks, the longest-chain rule, and mining rewards are all answers to a single question: who determines the order?

Sections 3 and 4 of the whitepaper describe the timestamp server and proof-of-work. Transactions are grouped into blocks, and each block includes the hash of the previous block, chaining them together. Changing a past block would break the hashes of every subsequent block, meaning any tampering would require redoing the computation for the entire chain after that point.

Proof-of-work is the process of repeatedly trying random values for a nonce until a block's hash falls below a specific target. Finding the answer requires enormous computation and electricity, but verification takes only a single hash check. This asymmetry is what 'imposes a cost on the record.'

When a conflict arises, nodes accept the longest chain — more precisely, the chain with the greatest cumulative proof-of-work — as canonical. The crucial point is that the basis for this majority vote is computational effort invested, not the number of accounts or IP addresses. Voting based on IP addresses fails because addresses can be created without limit (a Sybil attack), but computation cannot be forged.

Section 11 of the whitepaper calculates the probability that an attacker could catch up to the honest chain. If the attacker's hashpower is below half of the network's, the probability of a successful reversal converges exponentially toward zero as more blocks are added. This calculation is the basis for the convention of waiting for six confirmations (about one hour).

Bitcoin has no bank-style 'balance' field. Instead, there is a set of unspent transaction outputs — UTXOs. The balance shown by a wallet is the sum of all UTXOs it can spend with its private key.

Sending funds means taking your held UTXOs as inputs and creating new outputs — one for the recipient's share, and one for the change. The difference between the total input and total output becomes the fee paid to the miner. Because of this structure, wallets receive change at a fresh address each time, which is also tied to privacy practices.

Each input carries the owner's digital signature. Since signing is done with a private key and verification with the corresponding public key, a UTXO cannot be moved without the private key, and no one can recover it if the key is lost. The whitepaper's Section 2 phrase, "a chain of digital signatures," refers to this structure.

Transactions within a block are summarized via a Merkle tree into a single 32-byte root hash stored in the block header. This lets a lightweight node verify that a specific transaction is included in a block without downloading every transaction. Sections 7 and 8 of the whitepaper, on reclaiming disk space and simplified payment verification (SPV), rest on this structure.

Section 6 of the whitepaper addresses incentives. The miner who creates a block receives both newly issued coins and transaction fees. Early on, the issuance reward gives participants a reason to join the network, and as issuance shrinks, fees are designed to take over that role.

The issuance amount is set by software rules. The block reward is cut in half every 210,000 blocks (about four years), and the sum of this geometric sequence converges to 21 million coins. The reward, which was 50 BTC in 2009, became 3.125 BTC in April 2024. The total supply cap is not a value decided by policy, but a mathematical consequence of the halving rule.

The mechanism that keeps the block interval at about 10 minutes is the difficulty adjustment. Every 2,016 blocks (about two weeks), the actual time elapsed is checked and the target is recalculated. Difficulty rises if hashpower increases and falls if it decreases — so more mining equipment does not speed up issuance.

The whitepaper argues this incentive structure makes honest mining more rational than attacking. If an entity that secures a majority of hashpower tries to roll back the chain, doing so undermines the value of its own held coins and equipment.

The whitepaper is a nine-page design overview and does not contain every rule of today's network. The 1MB block size limit, the difficulty adjustment period, the details of the scripting language, and address formats were all set later through implementation and consensus.

Major changes since then have been carried out via soft forks. Segregated Witness (SegWit) in 2017 separated signature data to ease capacity and scalability issues, and Taproot in 2021 improved the signature scheme to enhance the privacy and efficiency of smart contracts. The Lightning Network is an attempt to solve, at a second layer, the small-payments problem the whitepaper mentioned.

Debates not covered in the whitepaper have also emerged. The 2017 dispute over increasing block size led to the Bitcoin Cash fork, an event that empirically demonstrated 'how difficult it is to change the rules.' The interpretation that this difficulty in changing rules is a property of the asset, rather than a cost, comes from this episode.

It's worth keeping in mind when reading the whitepaper that it is a technical proposal, not a forecast or an investment document. Price, markets, and its character as an asset were not the paper's subject, and the explanations on this page likewise are not investment advice.