A Brief History

Whitfield Diffie and Martin Hellman publish New Directions in Cryptography. For the first time, two strangers can agree on a shared secret over an open channel — no in-person key exchange required.

Without this paper there is no PGP, no TLS, no signatures, no Bitcoin. The whole layer that lets a wallet prove ownership of an address descends from it.

David Chaum publishes "Blind Signatures for Untraceable Payments," the first credible design for digital cash. A bank can sign a token without seeing what it signs; the user spends an unlinkable bearer instrument. Chaum founds DigiCash in 1989 to commercialize it.

DigiCash files for bankruptcy in 1998. The technology worked. The business — a centralized issuer trying to convince banks to license its protocol — did not. Chaum's lesson is built into Bitcoin: the issuer can't be a company. The issuer has to be the protocol.

Tim May circulates The Crypto Anarchist Manifesto at the Crypto '88 conference. Cryptography, he argues, is about to do for transactions what the printing press did for speech — break the state's monopoly on enforceability.

The text is half-prophecy, half-provocation. Its picture of "anonymous markets" and "untraceable digital cash" reads as a Bitcoin prospectus written twenty years early.

Eric Hughes, Tim May, and John Gilmore launch the cypherpunks mailing list out of Gilmore's living room in the Bay Area. For roughly a decade it's the most interesting forum on the internet for anyone serious about applied cryptography.

Hughes's 1993 Cypherpunk Manifesto gives the movement its slogan: Cypherpunks write code. The list's archive is the source material for almost every primitive Bitcoin uses.

Adam Back proposes Hashcash as a spam deterrent for email: senders must perform a small amount of work — a partial SHA-1 hash collision — for each message. Cheap for one mail, expensive for a million.

Bitcoin's whitepaper cites it. The proof-of-work primitive that secures every block is Hashcash with a different target and a chained data structure.

Wei Dai sketches b-money on the cypherpunks list: a distributed digital cash system where every participant maintains a balance ledger, and proof-of-work creates units. He never builds it.

Satoshi's first email to Wei Dai, in August 2008, opens: "I'm getting ready to release a paper that expands on your ideas." The whitepaper cites b-money in its references.

Nick Szabo proposes bit gold: a chain of proof-of-work puzzles, each timestamped, each consuming the previous solution as input. The resulting string is scarce, verifiable, and unforgeable.

Bit gold is, structurally, Bitcoin minus the consensus mechanism. Szabo never solved the double-spend problem; Satoshi solved it by tying timestamps to a single longest-chain rule and incentivizing miners with new units.

The largest bankruptcy in U.S. history. The credit system seizes. Money-market funds break the buck. The Federal Reserve and Treasury improvise the largest backstop in financial history; the bill, in unrealized form, will run through 2026.

Six weeks later, an unknown author publishes a paper proposing a financial system without backstops.

Satoshi Nakamoto posts Bitcoin: A Peer-to-Peer Electronic Cash System to the cryptography mailing list at 18:10 EDT on Halloween. The paper is nine pages. It references Hashcash, b-money, and Merkle tree timestamping.

The core insight isn't any single primitive — it's the assembly. Proof-of-work + longest-chain rule + UTXO model + a hard-coded issuance schedule. The reason Bitcoin works is that the parts, individually old, lock together.

Block 0 is mined. Its coinbase contains the now-famous string:

> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks

A timestamp, a political statement, and a proof of non-pre-mining all at once. The 50 BTC subsidy from this block is provably unspendable due to a quirk in Satoshi's code.

Satoshi sends 10 BTC to Hal Finney at block 170. Finney tweets "Running bitcoin" the same day from his Apple keyboard, having just downloaded and run the node software. He is the first person to do so other than the author.

Finney would be diagnosed with ALS later that year. He died in 2014, his estate cryopreserved at Alcor. The thousands of BTC he mined in the network's first year remain in known addresses.

Laszlo Hanyecz posts on Bitcointalk offering 10,000 BTC for two pizzas. Jeremy Sturdivant takes him up on it, ordering Papa John's from Florida and shipping the BTC.

The first commercial transaction. At today's price, the pizzas cost roughly the GDP of a small country. The point of the artifact isn't the price; it's that the system worked end-to-end — a stranger on the internet trusted the protocol enough to extend credit on top of it.

After WikiLeaks publishes the Cablegate documents, Visa, MasterCard, PayPal, and Bank of America freeze its donation channels — without court order. WikiLeaks pivots to accepting Bitcoin in mid-2011.

Satoshi's final message on the topic, before disappearing, is a plea: "It would have been nice to get this attention in any other context. WikiLeaks has kicked the hornet's nest, and the swarm is headed towards us." It is the first moment Bitcoin is used for its censorship-resistance property, on purpose, by a notable target.

Satoshi posts a minor patch announcement on Bitcointalk and goes silent. Email correspondence with Gavin Andresen continues briefly into 2011, then stops entirely.

No retirement statement, no handover. He left ~1.1 million BTC unspent, which is the strongest evidence we have that he meant it.

The Tokyo-based exchange — at one point routing ~70 % of all Bitcoin trading volume — halts withdrawals, then files for bankruptcy. ~850,000 BTC, customer and exchange funds, are gone. Most was siphoned over years by exploits the company never caught.

Lesson, expensive but durable: not your keys, not your coins. Self-custody becomes the default ideology of Bitcoin users from this point on. Centralized exchanges remain dominant in volume; they no longer enjoy a presumption of trust.

Vitalik Buterin's smart-contract platform goes live, having raised ~$18M in a 2014 BTC-denominated presale. Ethereum gives a generation of developers a programmable substrate and absorbs most of the "altcoin" energy that had previously fragmented across hundreds of forks.

The relevance here is reflexive: Ethereum's emergence forces a definitional question on Bitcoin. Is Bitcoin a platform (in which case it should compete on programmability)? Or is it specifically money (in which case it shouldn't)? That question becomes the block-size war.

Mike Hearn and Gavin Andresen ship Bitcoin XT, a fork that raises the block size to 8 MB. It's the opening shot of the block-size war. Within months XT loses momentum; Hearn writes a "Bitcoin has failed" essay and exits the space in early 2016. He is wrong about Bitcoin's failure, right that a coordination crisis is brewing.

The fault line is structural. Big-block advocates want cheap on-chain payments. Small-block advocates want cheap verification — nodes anyone can run. Both sides are correct about their priorities; neither side will compromise.

Major mining pools and a handful of Bitcoin Core developers meet in Hong Kong and sign an agreement: Core will work on a SegWit soft fork; miners will then signal a 2 MB hard fork as a follow-up.

Within months, neither side fully delivers. SegWit code ships; the 2 MB hard fork stalls in dispute. The agreement's collapse poisons trust and sets up the 2017 confrontation.

After two years of stalemate, a faction of users — not miners — announces they will run nodes that reject any block not signaling SegWit, starting August 1. They are betting that the economic majority will follow.

The signaling miners blink first. By July, BIP 91 (a faster pre-emptive signal) achieves majority hashrate. SegWit locks in at block 477,120 on July 21 and activates at block 481,824 on August 24.

The deep lesson of the war: hashrate is downstream of the social layer, not upstream. Users running nodes are the ultimate enforcers of consensus rules. Miners build whatever blocks the network is willing to accept.

The big-blocker faction, having lost the SegWit fight, hard-forks at block 478,558 into Bitcoin Cash — 8 MB blocks, no SegWit, separate chain. Every Bitcoin holder receives BCH 1:1 on the new chain.

BCH subsequently fragments — into BSV (2018), BCHN/BCHA (2020), and several smaller splits. None reach Bitcoin's market value, hashrate, or developer activity. The "scaling debate" was decided by which chain users kept running their nodes on. Most kept running Bitcoin.

The Lightning Network's three reference implementations — lnd, c-lightning, eclair — reach mainnet-ready releases. SegWit's malleability fix, two years late, finally unlocks the off-chain scaling path the small-blockers had been promising.

Adoption is slow at first. By 2026 Lightning routes ~5,000 BTC of public capacity and an unknown larger volume of payments inside custodial wallets (Strike, Cash App, Wallet of Satoshi). It is not the end-state of scaling, but it is the only working Layer 2 in production at non-trivial scale.

El Salvador adopts Bitcoin as legal tender alongside the U.S. dollar — the first nation-state to do so. President Nayib Bukele's government rolls out the Chivo wallet and a $30 sign-up bonus.

The reception splits along predictable lines: the IMF is hostile; Bitcoin users are euphoric; the actual on-the-ground adoption is mixed (most Salvadorans hold dollars by preference). What's load-bearing isn't whether it "worked" in the first year; it's that the experiment exists and other small economies are watching.

Taproot activates at block 709,632, the largest soft fork since SegWit. It bundles Schnorr signatures (BIPs 340), Taproot script trees (BIP 341), and a new tapscript opcode set (BIP 342).

Net effect: cheaper multisig, better privacy (cooperative spends look like single-sig), and a foundation for advanced contracts. Activation used a Speedy Trial mechanism with no UASF brinkmanship — a sign of how dramatically the social contract had clarified since 2017.

Casey Rodarmor's ord protocol launches, using a numbering scheme for individual sats plus Taproot's expanded witness capacity to "inscribe" arbitrary data into Bitcoin transactions. Within months the mempool sees sustained inscription-driven congestion.

The community splits: traditionalists see inscriptions as spam; speculators see them as a fee-revenue boon to miners. The protocol-level question is settled — there is no clean way to filter inscriptions without breaking other use cases — and the practical question becomes whether the fee market can absorb the demand. Mostly it does.

After more than a decade of rejected applications, the SEC approves eleven spot-Bitcoin ETF filings simultaneously — BlackRock, Fidelity, Ark, Bitwise, and others. Trading begins the next morning.

Within a year the ETFs accumulate over a million BTC under management, surpassing Satoshi's estimated holdings. The mechanical effect is a permanent change in the marginal buyer of Bitcoin: pension funds, RIAs, and 401(k)s now have a low-friction lane. Whether that's good for Bitcoin's monetary properties is a separate question; that it changed the demand curve is not in dispute.

Block 840,000. The subsidy drops from 6.25 BTC to 3.125 BTC. Bitcoin's annual issuance rate falls below ~0.8 % — below gold's typical 1.5–2 %.

Each halving is a forcing function on miner economics: every operator below the marginal cost of production must either upgrade hardware, find cheaper power, or shut down. The 2024 halving lands during an ETF-driven price expansion; the squeeze is mild. The next halving (~2028) will land into whatever conditions exist then. The schedule does not care.