The Patoshi pattern: the fingerprint of Bitcoin’s dominant early miner

Lerner’s 2013 inference from extra-nonce slopes

Every Bitcoin block contains a nonce, a number the miner changes over and over while searching for a valid hash. The original software also kept a second counter, the extra-nonce, inside the block’s reward transaction, and bumped it each time the main nonce ran out of values. Because the extra-nonce was written into the block, it left a trace. In April 2013 Sergio Demian Lerner, an Argentine security researcher, plotted the extra-nonce of every block in Bitcoin’s first months against block height and saw something that should not have been there.

Instead of a random scatter from many independent miners, he saw long straight lines: the extra-nonce climbing at a constant slope, then dropping back and climbing again, over and over, through blocks 0 to 36,288. A constant slope is consistent with a mining process counting at a steady rate; assigning it to a unique machine or owner requires additional assumptions. The periodic restarts, roughly every hundred hours, looked like a program being restarted, perhaps for a wallet backup. Other miners’ blocks lay off those lines, scattered as expected.

Lerner’s conclusion was that a single entity had mined most of the early blocks, and his rough tally, in his own words “at eyesight,” was about one million bitcoin. He was careful about what he could not say: his parser was lightly tested, he could not be certain every marked block belonged to the same miner, and the pattern identified a machine, not a person. He also noted that the coins had never been spent.

A second inference from nonce distributions

Six years later, answering skeptics, Lerner published a stronger fingerprint. The blocks on those straight lines shared a second oddity: the least significant byte of their nonce fell only in the ranges 0 to 9 and 19 to 58, about one-fifth of the possible values. Among the first 50,000 blocks, 27,680 had a nonce in that narrow band, when chance would predict about 10,000. Solving for how many blocks must have been restricted on purpose gives roughly 22,000, which matches the extra-nonce count. Lerner treated the two patterns as corroboration, but the classification remains a statistical model.

He added a third. Block timestamps come from each miner’s own clock, so blocks mined by different people are sometimes out of order, a child block stamped earlier than its parent. Among the non-Patoshi blocks in his sample he counted 224 such inversions. Among the Patoshi blocks he counted zero. Lerner interpreted that contrast as evidence of coordinated timing; it is not direct identification of a physical machine or owner.

At 50 bitcoin per block, 22,000 blocks is close to 1.1 million coins. Lerner reported in the same 2019 post that 99.9 percent of them remained unspent. He also wrote that he would prefer to stop there and leave Patoshi alone, which is more or less what he did.

Re-mining tests a proposed explanation

In 2020 Lerner reported re-mining early block headers to study which valid nonce solutions had been passed over. He proposed that the observed pattern fit a search divided into five sub-ranges and a decrementing nonce, unlike the released initial client’s upward scan.

This is a reconstruction from outputs of an unknown program. It narrows possible explanations under its assumptions, but does not establish an exact processor model or identify an operator. The mining explainer explains the nonce search that this analysis studies.

An estimate depends on a block-classification rule

Lerner’s 2019 estimate is approximately 22,000 blocks. Multiplying by the initial 50 BTC subsidy gives about 1.1 million BTC. The multiplication is exact for that hypothetical block count; deciding which blocks belong in the set is the uncertain part.

The Patoshi dossier discusses alternative published selections. These are competing estimates, not a confidence interval for a known person’s wealth. This entry reports Lerner’s estimate with its publication date rather than presenting an upper or lower bound as settled fact.

What the pattern shows, and what it does not prove

The patterns support Lerner’s inference that a dominant setup mined a large share of the selected early blocks. That conclusion depends on the classification model. It does not establish whose setup it was. The link to Satoshi Nakamoto is circumstantial: the pattern begins at the very start of the chain, in blocks mined in the network’s first days. Lerner himself put the limit plainly, in a line our dossier quotes: because the relation rests on unsigned emails and not math, we will never be sure.

Independent work has both supported and complicated the picture. A 2021 paper in PLoS ONE by María Óskarsdóttir and Jacky Mallett confirmed what it calls the extended Patoshi anomaly in the first hexadecimal digit of the nonce across all of the first 64 blocks, and credited Lerner with noticing it. But the same paper found the anomaly reappearing in later periods, in 2010 to 2011, 2012 to 2014 and 2016 to 2018, long after the original miner is thought to have stopped. A nonce quirk, on its own, is not the signature of one person.

A 2022 study by Alyssa Blackburn and colleagues took a different route, linking pseudonymous addresses with a procedure they report as better than 99 percent accurate, and concluded that between the launch in January 2009 and the day the price first reached one dollar, 9 February 2011, most bitcoin was mined by just sixty-four agents. The dominant early miner was the largest member of a small club, not a lone figure in an empty network. None of this identifies anybody. Our article on who Satoshi Nakamoto is sets out what the documentary record establishes, which is a great deal about the work and nothing about the name.

Read a Patoshi estimate as a dated classification

Before repeating an estimate, identify the analysis date, the rule used to select blocks, and the conclusion being drawn. A total associated with one classified block set is not automatically the same as a current balance, a count of addresses, or an amount proven to belong to Satoshi.

The reproducible part is the proposed pattern and how it groups observations. The connection from that pattern to a named person is a further inference. A later analysis can refine the grouping without turning the original estimate into a cryptographic demonstration of identity or present control.