A Blind Stylometric Search Across 12,979 Authors and 104,901 Texts
with Multi-Baseline Analysis, Legal Motive Verification, and Candidate Counter-Evidence Assessment
Prepared by JUDr. Mag. Ján Čarnogurský, MBA
(ulclegal.com)
March 2026
1. Executive Summary
This report presents the results of the largest stylometric attribution study ever conducted on the question of who created Bitcoin under the pseudonym Satoshi Nakamoto. Using custom-built software, we analysed the writing patterns of 104,901 unique email authors across two mailing lists – the Cypherpunks list (12,708 authors, 92,193 emails) and the Cryptography list at metzdowd.com (271 authors) – and compared their writing fingerprints to Satoshi’s 68,000 words of known writing.
What is stylometry? Every person has unconscious habits in how they use language: which small words they prefer (‘the’, ‘of’, ‘and’), how long their sentences tend to be, whether they use British or American spellings. These patterns are as distinctive as a fingerprint and remarkably stable across different topics. Stylometry measures these patterns mathematically. Courts have accepted stylometric evidence in fraud and authorship dispute cases.
Our principal stylometry findings:
(1) Ray Dillinger is the strongest overall match. From 104,901 authors, Ray Dillinger – the cypherpunk who reviewed Bitcoin’s source code before its launch in January 2009 – scored the lowest distance from Satoshi’s writing on our validated statistical test (Delta 0.77 on a scale where below 1.0 means ‘same author’). He also matches Satoshi’s exclusive use of the word ‘cannot’ (never ‘can not’), with 86% double-spacing after full stops (Satoshi: ~81%), and scores in the ‘same author’ range on all four forum-based baselines.
(2) The whitepaper was likely not written by the same person as the forum posts. When we used the Bitcoin whitepaper as a separate baseline, a completely different set of candidates ranked highest than when we used the forum posts as baseline. There is zero overlap between the top three candidates for each baseline. The whitepaper’s writing style is statistically closest to Craig Wright’s post-2016 blog posts and Nick Szabo’s academic writing, while the forum posts match the cypherpunks group (Dillinger, Gutmann, Back, Rosing). This represents a notable shift from our earlier ulclegal.com article (October 2024), where the Naive Bayes method ranked Phil Wilson as the closest match to both the whitepaper and Satoshi’s emails. The change results from the different methodology: Naive Bayes classification with the 50 most common Satoshi words is sensitive to topic overlap (Wilson writes extensively about Bitcoin’s technical design, as does Satoshi), while Burrows’ Delta measures unconscious function word patterns that are independent of topic. When the comparison shifts from ‘what you write about’ to ‘how you unconsciously structure sentences‘, Wilson moves from first place to the uncertain boundary (Delta 1.01), and the cypherpunks mailing list authors – who were not included in our earlier study’s candidate pool – emerge as the strongest matches. Both methods have merit, but Delta is considered more robust against topic contamination in the stylometry literature.
(3) Adam Back has a notable inconsistency. Back scored 0.91 (same author range) on function word analysis and has the strongest circumstantial profile: Scottish, 12 British spellings, inventor of Hashcash. However, he writes ‘can not’ (two words) 17 times versus only 4 times ‘cannot’ – the opposite of Satoshi, who exclusively uses ‘cannot’ (12 times, never ‘can not’). This does not exclude Back, but it represents a measurable stylistic inconsistency that other top candidates (Dillinger, Gutmann, Finney) do not share. He also stated in 2013 that he was still learning basic Bitcoin concepts on IRC, logged and witnessed by developers.
(4) Nick Szabo is not the forum Satoshi. Szabo ranked 24th out of 29 candidates against the forum posts (Delta 1.33). His writing is closer to the whitepaper’s academic register but far from the conversational Satoshi. This contradicts the 2014 Aston University study which used a much smaller candidate pool. Our 210,000-word Szabo corpus – scraped from his Unenumerated blog – provides a far more reliable comparison.
(5) Three previously proposed candidates were assessed. Phil Wilson’s pre-Bitcoin technical writing (scrontsoft.com) scores Delta 1.85 (‘different author’). However, the scrontsoft.com archive consists primarily of readme files and code documentation – a fundamentally different genre from Satoshi’s conversational forum posts. Genre mismatch alone can inflate Delta by 0.3-0.5 points, so this result should be interpreted with caution. It excludes Wilson as the forum post author, but does not rule out other forms of involvement. Notably, Wilson’s post-2016 narrative prose on vu.hn (60,614 words) scores Delta 1.01 – on the boundary of ‘same author’. While this text was written after Satoshi’s style had been publicly documented, our BCNext mimicry analysis demonstrates that sustaining a convincing stylometric disguise across 60,000 words is extremely difficult: BCNext’s mimicry broke down on deep features (exclusive use of ‘can not’, article frequency) despite surface-level success. Wilson’s vu.hn text shows no such breakdowns – his ‘cannot’ usage (34 times, never ‘can not’) matches Satoshi perfectly, and his function word distribution remains consistent throughout. This does not prove Wilson’s involvement, but it means his prose cannot be dismissed as easily as other excluded candidates. Sergey Ivancheglo (CFB) scores Delta 1.60, with involuntary Russian-language article underuse that cannot be faked across 134,000 words, which clearly disqualifies him as a Satoshi candidate. Craig Wright scores Delta 1.38 and was ruled ‘not Satoshi’ by the UK High Court in March 2024 with extensive evidence of forgery.
(6) The UIGEA gambling motive explains Satoshi’s extreme anonymity. Bitcoin’s whitepaper appeared 12 days before the final regulations of the Unlawful Internet Gambling Enforcement Act (UIGEA). The Genesis Block was mined 16 days before the UIGEA compliance deadline. Bitcoin’s original code contained GUI code for a poker client and for a peer-to-peer marketplace. This timeline and code inclusion provides the only candidate-independent explanation for why Satoshi employed extreme operational security from the very beginning – before Bitcoin had any users or monetary value.
Methodological note: this study does not prove that any specific individual is Satoshi Nakamoto. Stylometric analysis measures statistical similarity, not identity. The absence of cryptographic proof (a signed message from Satoshi’s known private keys) means all attribution remains probabilistic.
2. How We Did It –Methodology in Plain Language
2.1 The Writing Fingerprint
Imagine sorting every word a person has ever written and counting how often they use each one. Most people use the word ‘the’ about 5–7% of the time, ‘of’ about 2–3%, ‘and’ about 2–3%, and so on. These percentages form a unique pattern – a writing fingerprint. Even when writing about completely different topics, a person’s use of these small ‘function words’ stays remarkably constant, because these are unconscious choices. Nobody thinks about how often they use the word ‘the’ – but everybody uses it at a slightly different rate.
We measured 50+ such function words in every text we analysed, creating a numerical fingerprint for each author. We also measured several other features: double-spacing after full stops (a legacy typing habit from the typewriter era), British versus American spelling forms, contraction usage (‘don’t’ vs ‘do not’), and the specific choice between ‘cannot’ and ‘can not’.
2.2 Burrows’ Delta – How We Measure Similarity
The core statistical tool we used is called Burrows’ Delta, a standard method in computational stylometry since 2002. In simple terms, it works like this: first, we calculate how each author uses each function word compared to the average of all authors in our dataset. If an author uses ‘the’ much more than average, that’s a notable feature of their writing. Then we compare two authors by adding up how different their word-usage patterns are across all 50+ function words. A small total difference (below 1.0) suggests the texts were likely written by the same person. A large total difference (above 1.5) suggests different authors. Scores between 1.0 and 1.5 are in the uncertain zone.
Critical implementation detail: the ‘proper’ version of this test requires comparing all authors simultaneously, because the statistical spread across the entire population is what gives the individual comparisons meaning. Earlier studies (and our own initial attempts) that compared only two authors at a time produced meaningless results – everything scored at the ceiling. Our proper multi-author implementation, validated by correctly identifying Satoshi’s own texts as same-author, produces meaningful differentiation.
2.3 The Multi-Baseline Approach
Most prior Satoshi attribution studies used a single baseline: either all of Satoshi’s writing combined, or just the whitepaper. We used five separate baselines, each representing a different segment of Satoshi’s output: (1) all forum posts combined, (2) metzdowd mailing list emails from 2008-09, (3) BitcoinTalk posts from approximately 2009, (4) BitcoinTalk posts from approximately 2010, and (5) the Bitcoin whitepaper. This approach, which we developed from the dual-baseline method used in our earlier ulclegal.com article, reveals whether the same candidates rank highly across all baselines (supporting single authorship) or whether different candidates match different segments (supporting multi-authorship).
2.4 Self-Validation: Proving the Method Works
Before comparing any external candidates, we tested whether our method could correctly identify Satoshi within Satoshi’s own texts. We split the forum posts into time-based segments and compared them against each other. The results confirmed the method works: Satoshi’s BitcoinTalk 2009 vs 2010 scored Delta 0.31-0.39 (correctly identified as same author), and the Satoshi’s metzdowd emails scored 0.83 (same author, slightly different platform). The Whitepaper scored 1.34 against the forum posts – notably more distant, which raises the question of whether the same person wrote both.
2.5 What We Searched
We searched two major mailing list archives: the Cypherpunks mailing list (92,193 emails from 12,708 unique authors, spanning 2000–2016) and the Cryptography mailing list at metzdowd.com (approximately 12,000 emails from 271 unique authors, spanning 2006–2008 — the exact mailing list where Satoshi first announced Bitcoin on 31 October 2008). Combined, we processed over 104,000 individual emails from approximately 12,979 unique authors. To our knowledge, this is the largest blind stylometric search ever conducted in the Satoshi attribution context.
2.6 The ‘Cannot’ vs ‘Can Not’ Discovery
During our analysis, we discovered that Satoshi exclusively uses the single-word form ‘cannot’ (12 occurrences) and never the two-word form ‘can not’ (0 occurrences). This is a distinctive and easily verifiable habit. We tested all candidates for consistency with this pattern. Some candidates, such as Ray Dillinger (0 ‘can not’, 30 ‘cannot’) and Peter Gutmann (0 ‘can not’, 3 ‘cannot’), perfectly match Satoshi’s usage. Others, notably Adam Back (17 ‘can not’ vs 4 ‘cannot’), diverge significantly.
Note on ‘can not’: some prior Satoshi attribution studies and online analyses have treated the two-word form ‘can not’ as a distinctive Satoshi marker. Our corpus analysis of 595 original Satoshi posts and the whitepaper shows this is incorrect – Satoshi uses ‘cannot‘ exclusively (12 occurrences across the forum posts, 3 in the whitepaper) and never ‘can not’. This distinction matters: candidates like Adam Back (17× ‘can not’) and the anonymous remailer ‘admin’ (19× ‘can not’) diverge from Satoshi on this specific feature, while Ray Dillinger (0× ‘can not’, 30× ‘cannot’) and Hal Finney (0× ‘can not’, 2× ‘cannot’) match perfectly.
3. Main Results
3.1 How We Narrowed 104,901 Authors to 29 – and How Delta Works
Searching 12,979 email authors one by one using the full Burrows’ Delta method would be computationally impractical and statistically noisy – most of these authors wrote only a few words, and meaningful stylometric comparison requires at least several thousand words. Instead, we used a two-stage funnel:
Stage 1: Fingerprint Screening (12,979 → ~50 candidates). We built a quick scoring system based on Satoshi’s most distinctive and easily measurable writing habits.
Each author received 0–8 points based on: double-spacing after full stops (0-3 points based on how closely their ratio matched Satoshi’s ~81%), British spelling forms like ‘colour’ and ‘favour’ (0-2 points), frequency of the word ‘the‘ in the normal native English range of 4-7% (0-1 point – this filter alone eliminates most non-native English speakers, as writers whose first language lacks articles, such as Russian or Chinese, typically use ‘the’ at only 1-3%), contraction rate in the moderate range (0-1 point), and use of the word ‘cannot‘ (0-1 point).
Authors needed at least 1,000 words for a reliable score. On the Cypherpunks list, only 3 authors out of 12,708 scored the maximum 8/8: Adam Back, Mike Rosing, and an anonymous remailer. On the Cryptography list, 7 out of 271 scored 7/7. We retained all authors scoring 6 or above, plus any author with notable individual features, yielding approximately 50 candidates.
Stage 2: Full Burrows’ Delta with z-scores (50 → 29 candidates). We then ran the full proper multi-author Delta on these candidates plus named candidates from prior research (Szabo, Wright, Wilson, CFB, BCNext, Finney). Here is how the z-score calculation works in plain language:
Imagine that across all 29 authors in our final population, the average usage of the word ‘the’ is 5.2%, and the typical spread (standard deviation) is 1.1 percentage points. If Satoshi uses ‘the’ at 5.9%, that is 0.64 standard deviations above average – his z-score for ‘the’ is +0.64. If Adam Back uses ‘the’ at 5.3%, his z-score is +0.09. The difference between their z-scores for ‘the’ is |0.64 − 0.09| = 0.55. We repeat this calculation for all 50+ function words and take the average of all the differences. That average is the Delta score.
The key insight is that z-scores normalise for the natural variation in each word. Some function words (like ‘the’) vary a lot between authors, while others (like ‘very’) vary little. Without z-scores, the words with the most variation would dominate the comparison and drown out the subtler signals. By converting everything to standard deviations first, every function word contributes equally to the final score regardless of its absolute frequency.
This is why our ‘proper‘ multi-author Delta produces meaningful results while the simpler two-sample comparison that some studies use does not: the two-sample version has no population to calculate standard deviations from, so the z-scores degenerate. In our initial attempts, every two-sample comparison scored at the ceiling (2.0), producing no differentiation between candidates. The multi-author version, with 29 authors providing robust standard deviations, produces a meaningful spread from 0.31 (Satoshi versus himself) to 1.85 (Wilson’s technical writing).
Authors with fewer than 4,000 words in the archive were excluded as unreliable – function word frequencies fluctuate too much in small samples. Several cypherpunks authors who scored well on the fingerprint but had very high Delta were dropped as false positives: their fingerprint match was coincidental, not reflecting genuine stylistic similarity across the full 50-word function word distribution. The final population of 29 includes all candidates who either (a) scored in the top tier on the fingerprint screening, (b) were named in prior attribution research, or (c) represent Satoshi’s own writing segments for self-validation.
This funnel ensures we did not miss any strong candidate while keeping the Delta calculation statistically meaningful – the more authors in the population, the more reliable the standard deviations that underpin the z-scores.
3.2 The Final Ranking (Forum Baseline)
In the table below, the reference baseline is Satoshi’s combined forum posts (61,438 words from both metzdowd and BitcoinTalk). The whitepaper is deliberately excluded from this baseline in order to test it independently – if it were included, we could not measure how far its writing style diverges from the forum posts. Each candidate’s Delta score measures how far their function word distribution is from this combined forum baseline. Satoshi’s own time-based segments (BTC 2010, BTC 2009, Metzdowd) do not score exactly zero because they are subsets of the combined baseline text, not the combined text itself – each subset has slightly different word frequencies due to topic variation and the natural randomness of smaller samples. Their scores of 0.31-0.83 establish the ‘same author’ calibration range: any external candidate scoring in this range has a function word distribution as close to Satoshi as Satoshi’s own writing is to itself across different time periods and platforms. The whitepaper scored as a separate candidate against this forum baseline, lands at Delta 1.34 – notably more distant than any of the forum segments, and almost identical to Nick Szabo’s score of 1.33. Candidates scoring below approximately 1.0 are in the ‘same author’ range; between 1.0 and 1.5 is uncertain; above 1.5 suggests a different author.
Reference: Satoshi forum posts (61,438 words). Population: 29 authors. Method: Proper multi-author Burrows’ Delta with corpus-wide z-scores. The ‘cannot’ column shows whether the candidate matches Satoshi’s exclusive use of ‘cannot’ (never ‘can not’).
| Author | Delta | Words | DblSp | the% | Brit | cn! | cannot | Range | Identity |
| Satoshi:BTCTalk 2010 | 0.31 | 29,839 | * | 6.2 | 5 | 0 | 2 | ★ | (self-test) |
| Satoshi:BTC 2009 | 0.39 | 22,775 | * | 5.3 | 7 | 0 | 1 | ★ | (self-test) |
| cp:bear | 0.77 | 67,615 | 86% | 4.9 | 5 | 0✓ | 30 | ★ | R.Dillinger |
| Satoshi:Metzdowd | 0.83 | 8,742 | 81% | 6.2 | 1 | 0 | 6 | ★ | (self-test) |
| cp:pgut001 | 0.86 | 30,456 | 82% | 5.7 | 15 | 0✓ | 3 | ★ | P.Gutmann |
| cp:eresrch | 0.87 | 19,050 | 97% | 5.0 | 3 | 4✗ | 1 | ★ | M.Rosing |
| cp:adam | 0.91 | 90,584 | 77% | 5.3 | 12 | 17✗ | 4 | ★ | A.Back |
| cp:honig | 0.96 | 44,772 | 77% | 4.8 | 8 | 0✓ | 5 | ★ | D.Honig |
| cp:hal | 0.99 | 7,061 | 100% | 6.7 | 0 | 0✓ | 2 | ★ | H.Finney |
| Wilson(vu.hn) | 1.01 | 60,614 | ** | 6.7 | 15 | 0✓ | 34 | ? | P.Wilson |
| Nick Szabo | 1.33 | 210,313 | 45% | 6.5 | 12 | 1✗ | 82 | ? | |
| Satoshi:Whitepaper | 1.34 | 3,076 | 97% | 7.7 | 1 | 0 | 3 | ? | |
| Craig Wright | 1.40 | 6,902 | ** | 6.2 | 1 | 0✓ | 6 | ? | |
| CFB/Ivancheglo | 1.60 | 134,315 | 0% | 2.1 | 3 | 9✗ | 20 | DIFF | |
| Wilson(scronty) | 1.85 | 23,665 | 17% | 7.6 | 3 | DIFF |
* 0% = BitcoinTalk HTML strips double-spaces (actual ~81%).
** 0% = HTML source strips double-spaces. cn! = uses of ‘can not’ (Satoshi NEVER uses this; ✓=matches, ✗=diverges).
★ = same author (<1.0). ? = uncertain (1.0–1.5). DIFF = different (>1.5).
3.3 The Multi-Baseline Discovery
When we changed the baseline from forum posts to the whitepaper, the ranking changed completely:
Closest to FORUM Satoshi (conversational writing): Ray Dillinger (0.77), Peter Gutmann (0.86), Mike Rosing (0.87), Adam Back (0.91)
Closest to WHITEPAPER Satoshi (academic writing): Craig Wright (1.06), Anonymous remailer (1.12), Nick Szabo (1.23), Adam Back (1.22)
There is zero overlap between the forum top 3 and the whitepaper top 3. Ray Dillinger, the strongest forum match, drops to rank 16 against the whitepaper (Delta 1.37). Craig Wright, the closest whitepaper match, is rank 27 against the forum (Delta 1.40). This divergence is consistent with the hypothesis that the whitepaper and forum posts were drafted by different people – or by the same person in dramatically different writing registers.
3.4 Satoshi’s Internal Consistency
The Satoshi corpus shows a clear gradient from formal to informal:
| Segment | Words | ‘the’% | ‘a’% | ‘of’% | ‘it’% | Contr% | British% |
| Whitepaper | 3,076 | 7.74 | 3.38 | 2.76 | 1.17 | 0.88 | 33% |
| Metzdowd 08-09 | 8,742 | 6.17 | 3.29 | 2.44 | 1.46 | 1.60 | 6.2% |
| BTC ~2009 | 22,775 | 5.28 | 2.39 | 1.33 | 2.78 | 3.35 | 13% |
| BTC ~2010 | 29,839 | 6.20 | 2.54 | 1.47 | 2.24 | 2.93 | 5.8% |
The whitepaper uses ‘the’ at 7.74% while the forum posts average 5.3-6.2%. Contractions increase fourfold from whitepaper (0.88%) to BitcoinTalk 2009 (3.35%). The pronoun ‘it’ (conversational) doubles from whitepaper to forum. The whitepaper also contains mixed British-American spellings within a single 3,076-word document: ‘favour’ (British) alongside ‘characterized’ (American).
4. Candidate-by-Candidate Assessment
4.1 Ray Dillinger
Stylometric evidence FOR being Satoshi: Lowest Delta of any external candidate (0.77 – firmly in ‘same author’ range). Scores ★ SAME on all four forum-based baselines – the only external candidate with this consistency. 86% double-spacing (Satoshi: ~81%). Exclusively uses ‘cannot’ (30 times), never ‘can not’ – matching Satoshi perfectly. 5 British spellings.
Circumstantial evidence: Dillinger (known online as ‘bear’) was one of the first people Satoshi contacted in late 2008. He reviewed Bitcoin’s source code before its public release, providing security feedback. He is a veteran cypherpunk and privacy advocate active on the mailing lists throughout the relevant period with 67,615 words of archived writing.
Evidence AGAINST being Satoshi: American – the 5 British spellings may come from quoting others. Has publicly described his role as a reviewer, not as the creator. Has neither confirmed nor denied any deeper involvement. Not previously discussed in attribution research.
Motive to hide: As a privacy-focused cypherpunk, Dillinger would have ideological reasons for anonymity. However, no specific legal or financial motive has been identified.
4.2 Adam Back
Stylometric evidence FOR being Satoshi: Delta 0.91 (★ same author range). 12 British spellings (Satoshi: ~11). 77% double-spacing. Scottish – naturally writes British English. 90,584 words of archived writing. Invented Hashcash, the proof-of-work system cited in the Bitcoin whitepaper. First person Satoshi contacted by email (August 2008).
Evidence AGAINST being Satoshi: Writes ‘can not’ 17 times versus ‘cannot’ only 4 times – the opposite of Satoshi’s exclusive ‘cannot’ usage. This is a specific, verifiable inconsistency. In 2013, joined the bitcoin-wizards IRC channel and asked basic questions about UTXO and address balances – logged and witnessed by developers, suggesting he did not have deep knowledge of Bitcoin’s internals at that time (source). Consistently denied being Satoshi. His company Blockstream promotes off-chain scaling solutions that some argue contradict Satoshi’s on-chain scaling vision. Openly acknowledged the coincidences: ‘I do use double-space and native spelling British. Can code C++’ (source).
Motive to hide: If Back were Satoshi, his position as CEO of Blockstream would create a massive undisclosed conflict of interest. However, Hashcash was published openly under his real name, suggesting anonymity was not a concern for him prior to Bitcoin.
4.3 Hal Finney
Stylometric evidence FOR being Satoshi: Delta 0.99 (★ same author, barely). 100% double-spacing – the highest of any candidate. Exclusively uses ‘cannot’ (never ‘can not’). Created RPOW (Reusable Proof of Work), a direct predecessor technology. Received the first Bitcoin transaction.
Evidence AGAINST being Satoshi: Jameson Lopp documented that on April 18, 2009, Finney was competing in a 10-mile race in Santa Barbara while Satoshi was simultaneously confirming transactions and sending emails (source). Finney and Satoshi ran nodes from different IP addresses on different ISPs. By August 2010, his wife reported his typing had slowed to a ‘sluggish finger peck’ due to ALS, yet Satoshi was still actively posting (source). Finney openly shared his Satoshi correspondence with journalists. Died of ALS in 2014.
Motive to hide: Finney was a privacy advocate, but his openness about his Bitcoin involvement – publishing debug logs, showing emails to reporters – is inconsistent with Satoshi’s extreme operational security.
4.4 Nick Szabo
Stylometric evidence FOR being Satoshi: Closest match to the whitepaper baseline (Delta 1.23). Created Bit Gold, a theoretical predecessor to Bitcoin. The 2014 Aston University study ranked him first based on linguistic analysis of the whitepaper.
Evidence AGAINST being Satoshi: Delta 1.33 against forum Satoshi – ranked 24th out of 29 candidates. Satoshi was apparently unaware of Wei Dai’s b-money when contacting Adam Back in August 2008 – Szabo would have known about it. Wei Dai himself stated: ‘Why would Satoshi cite b-money but not Bit Gold if Satoshi was Nick?’ (source). Uses American English (he is American of Hungarian descent). In April 2008, publicly asked for help coding Bit Gold – six months before the whitepaper (source). Uses ‘can not’ once (Satoshi: never).
Motive to hide: As a legal scholar, Szabo would understand regulatory risks. However, Bit Gold was proposed openly under his real name.
4.5 Craig Wright
Stylometric evidence being Satoshi: Delta 1.40 against forum Satoshi. Only 1 British spelling despite being Australian. However, closest external match to the whitepaper baseline (Delta 1.06). Uses ‘cannot’ exclusively (matching Satoshi on this specific feature).
Evidence AGAINST being Satoshi: The UK High Court ruled convincingly in March 2024 (COPA v. Wright) that Wright ‘is not Satoshi Nakamoto,’ that he ‘lied to the court extensively and repeatedly,’ and committed ‘forgery on a grand scale.’ Sentenced December 2024 to 12 months suspended for contempt (source).
Motive context: Extensive gambling industry ties: Lasseter’s Online Casino (1998), Centrebet, Playboy Gaming. Told the ATO he ‘had been producing software for online casinos when he was writing code that later helped develop Bitcoin.’ His whitepaper-proximity is notable, but the court definitively excluded him.
4.6 Phil Wilson
Stylometric evidence: His vu.hn narrative prose (post-2016) scores 1.01 – on the author/uncertain boundary. His confirmed pre-Bitcoin writing from scrontsoft.com scores 1.85 – definitively different than Satoshi. However, he uses ‘cannot’ exclusively (34 times, matching Satoshi).
The vu.hn narrative: Wilson’s Bitcoin Origins account on vu.hn provides the most detailed insider narrative of Bitcoin’s creation, including step-by-step instructions for constructing the Bitcoin logo. His narrative explicitly claims multiple team members drafted Satoshi posts, with one person posting them to avoid contradictions. He also claims the original concept involved online gambling payment infrastructure.
Assessment: Wilson’s pre-Bitcoin technical writing is stylistically incompatible with Satoshi. His post-2016 prose is closer but was written after Satoshi’s style was publicly documented. The UIGEA motive argument he provides is compelling and independently corroborated by the poker code in Bitcoin v0.1.
5. Why Would Satoshi Hide? – The Legal Motive Analysis
One of the most puzzling aspects of the Satoshi mystery is the extreme operational security (OPSEC) employed from the very beginning. OPSEC means the practices used to protect one’s identity from detection. Satoshi used Tor (an anonymising network that routes internet traffic through multiple relays to hide the user’s location), registered the bitcoin.org domain through an anonymous registration service, and created a completely fictional identity with a Japanese name. This level of pre-emptive anonymity – before Bitcoin had any value, users, or law enforcement attention – requires a concrete reason, a strong motive.
5.1 The UIGEA Timeline
The Unlawful Internet Gambling Enforcement Act (UIGEA) provides the most compelling timeline match:
October 13, 2006: UIGEA signed into law by President Bush. The law makes it a federal crime for financial institutions to process payments connected to illegal online gambling.
August 18, 2008: The domain bitcoin.org is registered anonymously.
October 31, 2008: Bitcoin whitepaper published on the metzdowd.com mailing list.
November 12, 2008: UIGEA final regulations released – 12 days after the whitepaper.
January 3, 2009: Bitcoin Genesis Block mined.
January 19, 2009: UIGEA compliance deadline – 16 days after the Genesis Block.
April 15, 2011: ‘Black Friday’ – founders of PokerStars, Full Tilt Poker, and Absolute Poker indicted under UIGEA.
April 26, 2011: Satoshi’s last known communication – 11 days after Black Friday.
Bitcoin’s original v0.1 source code contained GUI code for a poker client (lines 1573–1788). The poker client GUI is a result of the intentional coding instructions of the developer. Satoshi never explained why this code was included. The creation of an anonymous, censorship-resistant payment system would directly address UIGEA’s payment-blocking mechanism.
5.2 Motive Assessment by Candidate
Ray Dillinger: No known gambling industry connection. Privacy-focused cypherpunk with ideological reasons for anonymity, but no specific legal pressure from UIGEA.
Adam Back: No gambling industry connection. Hashcash was published openly. No UIGEA exposure.
Hal Finney: No gambling connection. Publicly transparent about Bitcoin involvement. Weak motive to hide.
Nick Szabo: Legal scholar who understands regulatory risk. Published Bit Gold openly. No gambling connection.
Craig Wright: Extensive gambling industry ties: Lasseter’s Online Casino (Australia’s first government-licensed online casino), Centrebet, Playboy Gaming, MGM, Bodog. Told the Australian Tax Office he produced software for online casinos while writing code that helped develop Bitcoin. If true, UIGEA would provide a direct motive for anonymity. However, the COPA court found his Satoshi claims fraudulent based on extensive evidence.
Phil Wilson: His vu.hn narrative explicitly cites online gambling as Bitcoin’s original use case and UIGEA as the reason for anonymity. This is the only candidate narrative that coherently explains the extreme pre-emptive OPSEC.
5.3 The 1.1 Million Unmoved Bitcoin – and Recent Movements
Approximately 1.1 million BTC in addresses associated with the earliest mining period (2009-2011) were long considered permanently dormant. However, 2024 and 2025 saw unprecedented movement from ‘Satoshi-era’ wallets. In July 2025, eight wallets moved 80,000 BTC (over $8 billion) in the largest such transfer on record (source: CoinDesk). Galaxy Digital helped a Satoshi-era investor sell more than $9 billion in Bitcoin in July 2025. In total, over 270,000 BTC aged 7+ years moved on-chain in 2025 alone – a new record.
Critically, blockchain analysis firms such as Arkham have confirmed that the moved coins are not linked to Satoshi Nakamoto’s own addresses. The wallets that moved belong to early miners – people who ran mining software in 2009-2011 – not to the creator’s known addresses. Satoshi’s own estimated holdings of approximately 1.1 million BTC remain untouched.
The distinction matters for our analysis: the early miners who are now selling mined Bitcoin when it was nearly worthless and are taking profits at historically high prices. This is rational economic behaviour. Satoshi’s continued inaction – holding tens of billions in value without moving a single coin for over 15 years – is not rational unless there is a compelling reason not to spend. That reason could be death (as in Hal Finney’s case), loss of private keys, or fear of legal consequences that would follow from revealing one’s identity through a traceable transaction. The UIGEA liability hypothesis provides the most specific version of the third explanation.
6. Definitively Excluded Candidates
6.1 Sergey Ivancheglo (CFB) and the BCNext Mimicry
Ivancheglo’s 134,315 words of English writing show systematic underuse of articles: ‘the’ at 2.1% (Satoshi: 5.9%). This is an involuntary marker of writers whose first language lacks articles (Russian, Belarusian). It cannot be consistently controlled across 134,000 words. Delta: 1.60 (‘different author’).
However, Ivancheglo – who cryptographically proved in 2017 that he was also the anonymous ‘BCNext’ who founded the NXT cryptocurrency – successfully mimicked Satoshi’s writing patterns for 56,606 words as BCNext, including 96.7% double-spacing and near-native article usage. BCNext used ‘can not’ 45 times (never ‘cannot’), revealing the mimicry was imperfect. This case proves that short-term stylometric mimicry is possible, but that deep features (article frequency, specific word-form choices) expose the disguise over a large enough corpus.
6.2 Craig Wright
Excluded by the UK High Court in COPA v. Wright (March 2024). Justice Mellor found Wright ‘lied to the court extensively and repeatedly’ and committed ‘forgery on a grand scale’. Our stylometry independently confirms: Delta 1.40 against forum Satoshi, only 1 British spelling (Source).
7. Phil Wilson – A Complex Case
Wilson’s confirmed pre-Bitcoin writing from scrontsoft.com (23,665 words of DirectX programming tutorials and readme files, 2000-2008) scores Delta 1.85 – the second-worst match of any reasonable candidate. However, as noted in Section 1, this corpus consists of code documentation, a fundamentally different genre from Satoshi’s conversational forum posts, and genre mismatch alone can inflate Delta by 0.3-0.5 points. Therefore, the scrontsoft.com divergence should not be interpreted as conclusive.
Wilson’s post-2016 narrative prose on vu.hn (60,614 words) scores Delta 1.01 – on the boundary of being the same author as Satoshi. Critically, this large corpus shows no signs of the stylometric breakdowns we documented in BCNext’s mimicry: Wilson’s ‘cannot’ usage (34 times, never ‘can not’) matches Satoshi perfectly, and his function word distribution remains internally consistent across 60,000 words.
What makes Wilson uniquely difficult to dismiss is the legal and circumstantial dimension. As discussed in our earlier article (ulclegal.com: ‘Bitcoin Turns 15 Today. Who is Satoshi Nakamoto?’, October 2024), Wilson provides the only candidate narrative that coherently explains several otherwise puzzling facts:
- the extreme pre-emptive OPSEC before Bitcoin had any value;
- the poker client and marketplace GUI code in Bitcoin v0.1;
- the precise correlation between UIGEA enforcement dates and Bitcoin’s creation timeline; and
- Satoshi’s permanent withdrawal after the Silk Road attracted law enforcement attention.
Wilson also occupies a unique position regarding Craig Wright. Wright has consistently denied Wilson’s involvement and refused to name him as the ‘third member’ of the alleged Satoshi team – even in court proceedings where Wright claimed to be Satoshi himself. Yet Wilson is the only person in the world who has publicly and consistently confirmed Wright’s partial involvement in Bitcoin’s creation, while simultaneously explaining Wright’s inability to produce valid cryptographic proof: according to Wilson, Wright was responsible for infrastructure and business aspects, not for the cryptographic keys, which Wilson claims were destroyed in 2011.
This creates a paradox: Wright, who used forged documents to support his own Satoshi claims, denies the involvement of the one person who actually supports Wright’s partial involvement. If Wilson’s account is fabricated, there would be no reason for Wright to deny it – Wilson’s narrative is, in fact, the most favourable publicly available account of Wright’s role. Wright’s denial of Wilson is therefore either evidence that Wilson’s account is false, or evidence that Wright fears Wilson’s account because it contradicts Wright’s claim to be the sole or primary creator.
There is a further logical inference to be drawn. The COPA judgment established, with extensive documentary evidence, that Wright is a habitual and deliberate liar who fabricated evidence over a period of years. If we accept the court’s finding that Wright lies systematically to advance his interests, then his resolute denial of Wilson’s involvement must itself be treated with suspicion. A truthful person denying Wilson would be evidence against Wilson. But a proven liar denying Wilson – particularly when Wilson’s account is the only public narrative that partially supports Wright’s own claim to have been involved with Bitcoin’s creation – points in the opposite direction. If Wright were telling the truth about Wilson, it would be one of the few instances where his word aligned with verifiable reality, and there would be no strategic reason for the denial. The more parsimonious explanation is that Wright denies Wilson precisely because Wilson’s account is substantially true, and it threatens Wright’s narrative of sole or primary authorship. Put simply: if a convicted liar says that someone was not involved, that person probably was involved.
The COPA v. Wright judgment (2024) found that Wright forged documents and lied extensively. Wright claimed to demonstrate the ability to sign with Satoshi’s key in private sessions with Gavin Andresen in 2016, though the public proof he subsequently provided was shown to be fraudulent.
Our stylometric analysis cannot resolve this paradox. Wilson’s pre-Bitcoin writing excludes him as the author of Satoshi’s forum posts, but genre mismatch weakens this conclusion. His post-2016 prose is stylistically compatible over a large corpus. And his narrative provides the only coherent explanation for the UIGEA motive, the poker code, the marketplace code, and the extreme OPSEC. He remains a candidate who cannot be excluded on the balance of evidence.
8. Conclusions
First, Ray Dillinger emerges as the strongest composite match to Satoshi’s forum writing: lowest Delta (0.77), consistent ‘cannot’ usage (never ‘can not’), high double-spacing (86%), and the only external candidate scoring ★ SAME on all four forum baselines. He reviewed Bitcoin’s code before launch.
Second, the multi-baseline analysis reveals that the Whitepaper and forum posts have completely different candidate profiles, with zero overlap between the top three for each. This is the study’s most significant methodological finding.
Third, Adam Back – previously the strongest candidate based on fingerprint criteria – has a notable ‘can not’ divergence from Satoshi’s exclusive ‘cannot’ usage. His 2013 IRC learning logs also suggest he did not have deep Bitcoin knowledge at that time.
Fourth, Nick Szabo ranks 24th out of 29 candidates against the forum posts, contradicting the 2014 Aston University study. His writing is closer to the whitepaper’s academic register but far from the conversational Satoshi.
Fifth, the UIGEA gambling motive provides the only candidate-independent explanation for Satoshi’s extreme pre-emptive anonymity. The timeline correlation and the poker code in Bitcoin v0.1 are independently verifiable facts.
Sixth, we documented the first proven case of deliberate stylometric mimicry (BCNext), establishing that superficial feature matching alone is insufficient for attribution.
Seventh, Phil Wilson cannot be excluded on the balance of evidence. His pre-Bitcoin technical writing does not match Satoshi’s forum style, but genre mismatch weakens this finding. His post-2016 prose is stylistically compatible across 60,000 words without the mimicry breakdowns we documented in BCNext. His narrative provides the only coherent explanation for the UIGEA motive, the code artefacts, the extreme OPSEC, and the Wright paradox. As we concluded in our earlier ulclegal.com article, the circumstantial and legal evidence warrants continued investigation.
The absence of cryptographic proof remains the fundamental barrier to definitive attribution. Until someone produces a valid digital signature from Satoshi’s known keys, all attribution analysis is necessarily probabilistic.
9. Data Availability and Reproducibility
All scripts, corpus files, and intermediate results generated during this research are available from ULC Čarnogurský upon request. The Satoshi reference corpus (68,175 words, 595 posts, 88.5% double-spacing) was built from metzdowd.com monthly archives and direct BitcoinTalk scraping, with whitespace preservation verified. The whitepaper was extracted from the original PDF using PyMuPDF with image blocks excluded. The cypherpunks archive was sourced from github.com/cryptoanarchywiki/2000-to-2016-raw-cypherpunks-archive. Nick Szabo’s corpus (217,687 words, 306 posts) was scraped from unenumerated.blogspot.com. Craig Wright’s corpus (6,902 words) was manually collected from his Medium blog. All analysis tools were built in Python and are fully reproducible.

– End of Report –

