Satoshi Nakamoto's computer ran on London time, but his sleep pattern points to North America

Bitcoin 0.1 was announced on 8 January 2009, and the copy Hal Finney downloaded carries three timestamps that put the machine that built it on British time. The folder of source code inside it is stamped 23:15:06 on 10 January 2009, in the local time of the computer that packed it. The program file beside it, bitcoin.exe, records its build at 23:16:00 UTC. Finney, the cryptographer who received the first Bitcoin payment two days later, had the archive on his own machine by 02:34 UTC on 11 January.

YFarmX ran a forensic analysis of Satoshi Nakamoto’s primary archive to test where those clocks, and the person behind them, were. The archive covers 144 emails to Martti Malmi, 535 forum posts, 159 code commits, the release files and the early blockchain. Its answer runs two ways: the settings a person chooses point to Britain, and the habits a person keeps without choosing point to North America.

How do we know Satoshi’s computer was set to British time?

All 144 emails Satoshi sent Martti Malmi, Bitcoin’s second developer, between May 2009 and February 2011 carry a timezone offset of +0100 in summer and +0000 in winter, and the switch lands on the European date. Malmi published the full correspondence, 260 emails on both sides, as a witness in the 2024 High Court case against Craig Wright.

Autumn 2009 is the cleanest test. Satoshi’s email sent late on 23 October 2009 is stamped +0100; the next, on 26 October, is stamped +0000. The UK and the EU put their clocks back on 25 October. The US did so on 1 November. An email’s date line is written by the sender’s own software, so the offset reflects the clock setting at Satoshi’s end.

An offset of +0000 in winter and +0100 in summer on European rules fits Britain, Ireland and Portugal. It held for the whole of Satoshi’s active life, with no sign of a move.

The first release rules out every US timezone

The Bitcoin 0.1 archive gives a second, independent reading of the build machine’s clock, and it rules out every timezone in the United States. YFarmX re-read all three timestamps from the raw files.

The folder’s 23:15 had to fall before Finney already held the files at 02:34 UTC. That puts the packing computer at most 3 hours 19 minutes behind UTC. US Eastern time runs five hours behind in January and Pacific time eight, so on either clock the folder would have been packed after Finney had it. On a UTC clock, which is London in January, the folder stamp lands 53 seconds before the build stamp.

The release files carry one more sign of care. All 48 files in the archive carry a placeholder time just after 01:00, which leaves the folders as the only stamps showing when the work was done.

Satoshi slept between 07:00 and 14:00 UTC

Satoshi’s 854 timestamped posts, emails and code commits from December 2008 to February 2011 leave a daily gap from 07:00 to 14:00 UTC, with 13 of the 854 falling inside it. The busiest hours run from 16:00 to 02:00 UTC.

On a winter clock, the seven silent hours read three ways:

Posting times alone can be staged by someone determined to mislead. The mining record is harder to stage.

The mining rig went dark in the same hours

The early Bitcoin miner known as Patoshi, identified by Sergio Lerner from patterns in the first blocks, ran almost round the clock, and when it was switched off for a night-length stretch, the outage fell inside Satoshi’s sleeping hours. Lerner’s 2013 count credits the machine with 1,148,800 bitcoin, a paper value of about $97.4 billion at the Chainlink BTC/USD price of $84,808.10 read at 14:28 UTC on 24 September 2026. By his reading those coins have never been spent.

Block timestamps come from the mining computer’s own system clock, in UTC. YFarmX checked the block headers from 0 to 60,479 against Lerner’s list of Patoshi blocks. In the clean 2009 window, 7 of 13 overnight outages had their midpoint between 09:30 and 12:30 UTC, against 1.6 expected by chance, a probability of 0.0004.

The restarts line up with Satoshi’s messages too. A ten-day mining outage that began at 21:37 UTC on 14 August 2009 ended at 21:04 UTC on 24 August. Satoshi’s first emails after five weeks of silence went out at 22:00 and 22:04 UTC that evening. The miner and the inbox came back within the hour of each other.

Satoshi’s node ran on a home line in Los Angeles

Hal Finney’s log from January 2009 records the one other Bitcoin node he connected to, the operator of the project’s chat channel, at 68.164.57.219. Jameson Lopp identifies that node as Satoshi’s. The address resolves to h-68-164-57-219.lsanca54.dynamic.covad.net, a Covad residential DSL line in Los Angeles.

The same log shows the node reporting its own address as 192.168.0.1, the default address of a home router. So the node sat on a home network, with the Bitcoin port forwarded through the router. The node accepted incoming connections at that address, so the machine answering was on that line. In the same week, 7 to 12 January 2009, the build machine’s clock read British time.

A British persona run from North America

Every signal pointing to Europe is a setting someone chooses, and every signal pointing to North America is a habit or a fact of where the machine sat.

The genesis block, mined on 3 January 2009, carries the text “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks”, a London front page. The simplest reading of the whole record is a British or European persona, kept up with discipline, run by someone living in North America, most likely on the US West Coast, as of January 2009.

That shifts the weight of the evidence towards North America. A Briton who slept from 07:00 to 14:00 every day and ran a node through a Los Angeles connection fits the facts too, less economically. The analysis is about geography, and it is kept to geography by design.

Two famous clues come from the software Satoshi used

Two of the most repeated clues to Satoshi’s whereabouts are readings of other people’s clocks.

The +0800 offset on Satoshi’s earliest emails, long read as a hint of Japan or elsewhere in Asia, belongs to the anonymous mail service Satoshi used in 2008 and early 2009. Its own headers stamp +0800, its mailer runs on the server, and the relay address sits with a Malaysian provider on UTC+8. The offset stayed at +0800 through both the US and the European clock changes.

The claim that Satoshi’s code commits show British Summer Time comes from how Subversion displays them. Subversion stores commit times in UTC and shows them in the reader’s own timezone, so an analyst in Britain sees +0100 in summer and one in California sees Pacific time. The European clock evidence lives in the email headers and the release archive.

Why writing-style matching keeps naming the wrong people

Five people have been publicly named as Satoshi since 2014, and every claim has ended in a denial or a court ruling. The Aston study and the New York Times investigation both leaned on writing style.

Craig Wright’s claim went furthest. Mr Justice Mellor ruled on 20 May 2024 that Wright is not Satoshi and did not write the whitepaper or the early software. Wright was sentenced to 12 months in prison, suspended for two years, for contempt of court on 20 December 2024, and was put under a three-year general civil restraint order on 7 March 2025.

Adam Back, chief executive of Blockstream, answered the New York Times on X within hours: “i’m not satoshi”. He put the matches down to “a combination of coincidence and similar phrases from people with similar experience and interests”.

YFarmX’s stylometry test used three controls the named studies skipped: a pool of unnamed writers from the same mailing-list threads, a correction for how much each person has written, and matching email against email rather than forum posts against essays. Three results came out of it:

• Genre outweighs the writer. Satoshi’s own casual email and formal whitepaper score a Burrows’ Delta distance of 0.95 apart, further than Satoshi and a different person writing in the same genre, at 0.82. That undoes any test that sets Satoshi’s forum posts or emails against a candidate’s essays.
• Prolific writers look closer. Across the unnamed writers, the more text a person had, the closer they scored to Satoshi, a correlation of minus 0.81. Cut every writer to the same word count and the ranking reshuffles.
• The top match was the correspondent. In the one clean test, same genre, same weeks, same threads, Hal Finney scored closest. Finney was replying to Satoshi about the same software in the same threads, and shared vocabulary lifts the score.

Run with those controls on the roughly 80,000 words Satoshi left, stylometry finds a writing style shared across a community of cryptographers, which is why it keeps producing names.

Satoshi’s late nights stopped in September 2010

Satoshi’s late-night activity stopped around 1 September 2010. Between February and August 2010, 40 of 394 forum posts went out between 02:00 and 08:00 UTC; from September to December 2010, none of 107 did, a probability of about one in 100,000. The daytime gap stayed where it was, so the clock setting held and the evenings changed. That was three months before Satoshi handed the project to Gavin Andresen.

Satoshi was active on both US Thanksgivings in the archive, in 2009 and 2010. There were no posts over Christmas and New Year, 11 days in 2009 and about 17 in 2010, and a seven-day gap from 29 August to 5 September 2010 spanned the UK’s late summer bank holiday, with activity again on US Labor Day the next day.

The spelling splits along one line. Everyday words are British: colour, favour, grey, neighbour. Programming words are American: license, dialog, initialize, serialize. Satoshi wrote “e-mail” 53 times and “email” 7 times, and typed two spaces after a full stop in 95 to 100% of text for 20 straight months.

The fortune is why naming Satoshi is dangerous

The coins are the reason a wrong name is dangerous. The Patoshi machine’s 1,148,800 bitcoin carry a paper value of about $97.4 billion at the Chainlink price read at 14:28 UTC on 24 September 2026, and anyone publicly tagged as Satoshi is taken to hold them.

The record of the named so far is a record of harm. Dorian Nakamoto, an engineer in Temple City, California, was chased by reporters after the 2014 Newsweek cover. Peter Todd and Adam Back were both left answering the claim in public. The High Court’s ruling on Wright is the only verdict any of these claims has reached.

Satoshi published the whitepaper on 31 October 2008, mined the genesis block on 3 January 2009 and left the project to Gavin Andresen at the end of 2010. The archive shows a person who kept a London clock, spelled like a Briton, slept through the American night, ran a miner from a home in Los Angeles and gave out nothing that fixed a name. That is as far as the evidence reaches: British settings, American hours and a home in Los Angeles.

How this investigation was done

YFarmX’s analysis drew on Martti Malmi’s published emails, the Satoshi Nakamoto Institute’s forum archive, the SourceForge code history, the cryptography mailing list, the Bitcoin 0.1 release files, Hal Finney’s January 2009 log and the first 60,480 block headers.

Two findings were re-verified against the raw files: the January 2009 build clock and the email clock changes. The probability figures are the analysis’s own. The two-space typing figure depends on how each archive stores whitespace.