The Bitcoin Whitepaper, Explained in Pictures

1. 1

   Hash functions: any input, a 256-bit fingerprint

   A hash function h(x) takes any input — a number, a document, the works of Shakespeare — and outputs a fixed 256-bit number. Change one bit of the input and the output changes completely, and you can't reverse it. That unpredictability is what Bitcoin builds its tamper-evidence on.

   

2. 2

   Digital signatures: proving ownership without revealing the key

   Each Bitcoin identity is a private key (known to one person) and a public key (known to everyone). Signing a message with the private key lets anyone verify it with the public key — that's how a coin's owner authorizes a transfer without exposing the secret.

   

1. 3

   The cost of trusted intermediaries

   Internet commerce still runs on trusted third parties to process payments and resolve disputes. Satoshi's point in the introduction is modest but radical: mediation costs make small online payments uneconomical, so why not build a system based on cryptographic proof instead of trust?

   

2. 4

   Earlier attempts: b-money, Bit gold, RPOW

   Before Bitcoin, Wei Dai's b-money and Nick Szabo's Bit gold stayed theoretical, and Hal Finney's RPOW worked but was centralized. Finney also became the first person ever to receive a Bitcoin transaction from Satoshi — the paper's ideas had a lineage.

   

1. 5

   Section 2: a coin is a chain of signatures

   An electronic coin is defined as a chain of digital signatures. Each owner passes the coin on by signing a hash of the previous transaction together with the public key of the next owner — anyone can walk the chain and verify every handoff.

   

2. 6

   Following one coin from Alice to David

   Alice signs her transfer to Bob; Bob signs his transfer to Charlie, referencing the transaction he received; and so on. Each new signature locks in the entire history behind the coin — this is the 'hash of the previous transaction' concept in action.

   

3. 7

   Section 3: the timestamp server

   Before Bitcoin, a timestamp service published a hash of the day's data in a newspaper — proof the data existed at that date. Bitcoin generalizes this: each block's hash incorporates the previous block's hash, so the whole history is chained together.

   

4. 8

   Why one changed bit breaks everything

   Because every block hash includes the previous one, altering a single transaction even by one bit changes its block's hash, which changes the next block's hash, and so on forever. That domino effect is the tamper-evidence that makes old history effectively unrewriteable.

   

5. 9

   Publishing digests in the newspaper

   In the 1990s, the way to anchor a hash was to print it in The New York Times — nobody could retroactively alter the archive. It worked, but it was centralized: one company controlled the timestamping. Decentralizing that trust is the paper's actual quest.

   

1. 10

   The required zeros

   To add a block, miners must find a number (the nonce) such that hashing the block — previous hash, transactions and nonce together — produces an output starting with a required number of zeros. There's no shortcut: only brute-force trial and error proves you spent the work.

   

2. 11

   Hunting for a nonce

   Miners start the nonce at zero and increment it, hashing the whole block each time. Every new nonce yields a completely different hash, so the search is pure probability — the energy spent trying is the 'work', and the found nonce is its proof.

   

3. 12

   Forks and the longest-chain rule

   Two miners can find valid blocks at nearly the same moment, splitting the network's view. Nodes keep whichever branch they heard about first — and the tie resolves the moment one branch extends further, because everyone switches to the longest chain.

   

1. 13

   Section 5: the six steps of the network

   New transactions are broadcast to all nodes; each node collects them into a block; each node hunts for the proof of work; when found, the block is broadcast; nodes accept it only if every transaction is valid and unspent; acceptance is expressed by building on that block next.

   

2. 14

   Checking 'not previously spent' fast

   To validate a block, nodes must confirm none of its coins were already spent. Instead of scanning the whole chain (O(n)), each node keeps an in-memory table of transaction IDs mapped to their block and position — searchable in O(log n) with binary search.

   

3. 15

   Section 6: where new coins come from

   The first transaction in every block is special: it creates new coins from nothing and awards them to the miner. This incentive pays for the network's security, meters the money supply toward the 21 million cap — and, as the paper notes, makes honesty the most profitable strategy for even a powerful attacker.

   

1. 16

   Section 7: reclaiming disk space

   Once a coin's latest owner is known, old transactions in the chain of ownership no longer need to be stored. The paper's answer is a Merkle tree: transactions are hashed pairwise up to a single root hash that lives in the block header, so spent transactions can be dropped without breaking the chain.

   

2. 17

   Inside the block header

   The block header carries three things that matter: the previous header's hash, the Merkle root summarizing all transactions, and the nonce. Headers chain to each other — which is why a pruned node can still verify the chain of proof of work.

   

3. 18

   The Merkle tree, drawn out

   Take every transaction's hash, pair them up, hash each pair, and repeat until one hash remains: the Merkle root. Only the green boxes need to be stored — everything red can be recomputed from them on demand.

   

4. 19

   Section 8: proving inclusion without storing the block

   Ask 'was my transaction really in that block?' and a full node can answer with a Merkle proof: a handful of hashes that, combined with your transaction, reconstruct the root. That's simplified payment verification — the reason a phone can verify payments without storing 500+ GB.

   

5. 20

   Section 9: combining and splitting value

   Coins don't have to be passed one at a time. A transaction can gather several inputs and always produce two outputs — one to the recipient, one back to yourself as change. Value in must equal value out; the paper shows exactly this In/Out diagram.

   

6. 21

   The cash register analogy

   Paying $1.55 with a dollar bill, a 50-cent coin and a 10-cent coin works exactly like Bitcoin: you hand over everything you have, and the 'cashier' returns 5 cents of change. That's why Bitcoin transactions so often pay themselves back.

   

1. 22

   Keeping the UTXO set straight

   With every transaction public, each node tracks which outputs remain spendable. The paper's chain-of-ownership plus the transaction-ID table from section 5 is what modern nodes implement as the UTXO set — the list of coins that can still be spent.

   

2. 23

   Section 10: privacy — the paper's most dated claim

   The paper argues privacy holds because identities are public keys, not names — the public can see transactions flow, but not who they belong to. Written before exchanges tied keys to bank accounts, it's the section reality has most thoroughly revised.

   

3. 24

   Section 11: how safe are your confirmations?

   Satoshi computes the odds that an attacker with less than half the network's power can catch up after you accept a payment. At 10% of the hash power, the attacker catches up just 20.5% of the time after one confirmation — and effectively never after six. That table is where the six-confirmation convention comes from.

   

Continue the Story