Satoshi Nakamoto is estimated to control about 1.1 million BTC. The coins were mined in roughly 22,000 blocks during 2009 and early 2010, and almost none have ever been spent. Nobody has published an official balance and no address is proven to be Satoshi's. The number is a forensic estimate, and most of it comes from one researcher, Sergio Demian Lerner. Other analysts have challenged it. The newest development is about the coins' future rather than their size. In April 2026 a draft Bitcoin Improvement Proposal, BIP-361, suggested phasing out old signature types to defend against quantum computers. Old coins that are never moved, including those linked to Satoshi, would in effect be frozen.
The newest development: BIP-361 and the quantum question (April 2026)
On 14 April 2026, BIP-361 was posted to the Bitcoin BIPs repository on GitHub (Cointelegraph, 15 April 2026). It is titled "Post Quantum Migration and Legacy Signature Sunset." The authors are Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire-Demers. In the repository its status is Draft, and its number was assigned on 11 February 2026.
What the draft proposes:
- Phase A. For about 160,000 blocks (roughly three years) after activation, coins can only be sent from legacy scripts to post-quantum scripts.
- Phase B. Later, nodes tighten the rules for verifying ECDSA and Schnorr signatures. Coins still held in vulnerable outputs could then no longer be spent. The document is inconsistent on timing: one section says two years after Phase A, and the abstract says a flag day five years after activation.
- Recovery. Cointelegraph reports an optional third phase that would let holders recover funds with a zero-knowledge proof. The repository text we reviewed defines only Phases A and B.
The draft says that as of 1 March 2026, more than 34% of all bitcoin sat in outputs that had already revealed a public key on-chain. Cointelegraph reports that about 1.7 million BTC sits in early pay-to-public-key (P2PK) outputs, including the coins attributed to Satoshi. Cointelegraph also reports that Lopp himself called the draft a rough sketch that is not ready for adoption. BIP-361 has no activation date and no consensus.
The draft quotes Satoshi on lost coins. On 21 June 2010, Satoshi wrote on Bitcointalk: "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone."
Where the 1.1 million BTC figure comes from
Lerner's 2013 discovery
On 17 April 2013, Lerner published "The Well Deserved Fortune of Satoshi Nakamoto" on his blog, Bitslog. He studied the ExtraNonce field in the generation transaction of blocks 0 to 36,288. The ExtraNonce goes up each time the 32-bit nonce runs out, so for a single miner it behaves like a slow counter. One dominant entity showed up as a distinct, steady chain of values. Lerner later named that miner "Patoshi."
His first estimate was about 1 million BTC, which he said he made "at eyesight." He wrote that 1,148,800 of the 1,814,400 BTC issued up to that point had never been spent. He suspected most of these belonged to the dominant miner but said he had not checked this. He also said he could not be 100% certain that every block he attributed to Patoshi was Satoshi's.
The 2019 refinement: about 22,000 blocks
In April 2019 Lerner revised his work in "The Return of the Deniers and the Revenge of Patoshi." He used a more precise pattern-following method and covered the first 50,000 blocks, from January 2009 to April 2010. He attributed about 22,000 blocks to Patoshi, or about 1.1 million BTC at 50 BTC per block. Three lines of evidence support the single-miner reading:
- ExtraNonce chains. Privacy flaws in the v0.1 client let ExtraNonce values link one miner's blocks.
- Restricted nonces. Patoshi blocks use only a limited set of values in the nonce's least significant byte.
- No timestamp inversions. None of the 694 timestamp inversions in the first 50,000 blocks falls between two Patoshi blocks, although Patoshi produced 43% of those blocks. Lerner reads this as one clock running one piece of software.
He found that 99.9% of Patoshi blocks are unspent, against about 10% of other blocks from the same period.
The mining machine (2020)
In August 2020 Lerner reported that Patoshi searched only five subranges of the nonce space. He concluded that one high-end, multi-threaded 2009-era computer could have mined every Patoshi block. Specialised hardware is also possible. After about the first 18,000 blocks, Patoshi began cutting its hashrate by leaving parts of the nonce range unsearched. Lerner does not say why.
Who disputes it
In 2019 the developer known as nullc argued that early unspent coins were probably not mined by a single party. He put the coins involved at "more like 200k." Lerner rejected that argument, and other researchers have also published lower totals. Lerner also says the link between Patoshi and Satoshi rests on circumstantial evidence, not a cryptographic signature.
| Point | What is established | Source |
|---|---|---|
| Estimated holding | About 1.1 million BTC | Lerner, 2019 |
| Blocks attributed | About 22,000 | Lerner, 2019 |
| Reward per block | 50 BTC. It fell to 25 BTC at block 210,000 on 28 November 2012 | Bitcoin Wiki |
| Spent | About 0.1% of Patoshi blocks | Lerner, 2019 |
| Proof of ownership | None. No signature from a Patoshi address has ever been published | — |
Why mining so much was possible
In early 2009 a home CPU could mine bitcoin. Hal Finney ran the software shortly after its release, when the difficulty was 1. He mined several blocks over a few days and then stopped because his computer was running hot ("Bitcoin and me," Bitcointalk, 19 March 2013). With few other miners and a 50 BTC block reward, one persistent participant could produce a large share of the early blocks.
How much BTC do the Patoshi blocks add up to?
Set how many early blocks you attribute to Patoshi, the reward per block and the share left unspent to see the BTC that estimate implies.
| Blocks attributed to Patoshi | Block reward | Share of those blocks never spent | Estimated unspent BTC in the attributed blocks |
|---|---|---|---|
| 22,000 blocks | 50 BTC | 99.9 % | 1,098,900 BTC |
| 22,000 blocks | 50 BTC | 100 % | 1,100,000 BTC |
| 18,000 blocks | 50 BTC | 99.9 % | 899,100 BTC |
- All three values are inputs you can change; the defaults restate figures from Lerner's 2019 analysis as reported in this article.
- The result is arithmetic on the block count, not proof of who holds the keys: the link between Patoshi and Satoshi is circumstantial.
This multiplies your inputs only: it cannot settle the disputed attribution (nullc put the coins at "more like 200k"), prove ownership, or show what BIP-361 would do to these coins.
Satoshi's documented timeline
- 31 October 2008. Satoshi emails "Bitcoin P2P e-cash paper" to the Cryptography Mailing List, with a link to the white paper at bitcoin.org/bitcoin.pdf.
- 3 January 2009. The genesis block is mined. Its generation transaction contains the text "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks." Because of a quirk in the code, its 50 BTC reward cannot be spent.
- January 2009. Satoshi sends Hal Finney 10 BTC in the first bitcoin transaction (Finney, 2013).
- 12 December 2010. Satoshi's last Bitcointalk post: "Added some DoS limits, removed safe mode (0.3.19)."
- 23 April 2011. In a private email to developer Mike Hearn, Satoshi writes that they have "moved on to other things," according to Hearn.
Why the coins have never moved
Nobody knows. There are three common explanations, and none can be tested:
- The keys are lost. Bitcoin has no way to recover lost keys.
- Not spending was a choice. Leaving the coins alone would keep the creator from becoming the system's largest seller.
- The holder has died or cannot act.
The blockchain cannot tell these apart. A signed message or a transaction from a Patoshi address would settle whether the keys still exist.
How to judge anyone who claims to be Satoshi
The only meaningful test is cryptographic: a message signed with the key of a known early Satoshi address, or a transaction from one. Documents, interviews and lawsuits prove nothing about who holds the keys.
Craig Wright
On 14 March 2024, at the end of the trial brought by the Crypto Open Patent Alliance (COPA), Mr Justice Mellor said Craig Wright is not Satoshi Nakamoto and not the author of the Bitcoin white paper. The written judgment, [2024] EWHC 1198 (Ch), followed on 20 May 2024. In it the judge wrote: "I am entirely satisfied that Dr Wright lied to the Court extensively and repeatedly." He also found Wright personally responsible for the forgeries COPA had identified. On 29 November 2024, Lord Justice Arnold refused Wright permission to appeal.
Peter Todd
HBO's documentary "Money Electric: The Bitcoin Mystery" (October 2024) named Bitcoin developer Peter Todd as Satoshi on circumstantial evidence. On 8 October 2024 Todd posted "I am not Satoshi" on X.
What to watch
- Activity on Patoshi-linked addresses. Public block explorers would show any spend from an early address within minutes.
- BIP-361 and related quantum proposals. Watch whether they move beyond Draft status and whether Phase B is changed or dropped.
- New forensic work. Changes to the Patoshi attribution could move the estimate either way.
Limitations: the holding is an estimate built mostly on one researcher's unsigned analysis, and BIP-361 is a draft that may change or never activate.
