The Bitcoin white paper ends with a list of eight references. Three of them carry the same two names, Stuart Haber and W. Scott Stornetta, two researchers who spent the early 1990s working out how to prove the date of a digital document. Another is an anti-spam scheme by a cryptographer named Adam Back. Another is an essay posted to a mailing list in 1998. One is a probability textbook from 1957.
So who invented blockchain? No single person. The chain of linked records came from Haber and Stornetta in 1991. The costly puzzle that makes forging the record expensive came from Adam Back’s Hashcash in 1997, with older academic roots. The idea of money kept on a shared public ledger came from Wei Dai and Nick Szabo. On 31 October 2008 the pseudonymous Satoshi Nakamoto sent a paper to a cryptography mailing list that fitted those pieces together in a way none of their authors had, and added the incentive that makes them hold.
This lesson follows that relay, one problem and one set of people at a time, and stops on each attempt that fell short. It is the sixth lesson of our money and economics path, and it picks up where the lesson on how banks create money left off: every system in this story had to answer the question a bank answers every day, namely who keeps the ledger and who stops the same money from being spent twice. If Bitcoin itself is new to you, start with our guide to what Bitcoin is and our explainer on blockchain.
The problem every forerunner hit: money without a trusted middleman
A digital coin is a file, and files can be copied. Paper money solves copying with physical security. A bank solves it with a ledger: your balance is a line in its books, and when you pay, the bank moves the amount from your line to someone else’s. Spending the same money twice is impossible because one party sees every transaction in order.
That is the double-spending problem, and for most of the history of digital money the only answer was a trusted central party. The white paper names the cost of that answer in one line. In a system run by a mint, it says, “the fate of the entire money system depends on the company running the mint”, with every payment passing through it, much like a bank.
Two separate groups worked on pieces of this puzzle from the early 1980s. Academic cryptographers wrote papers on digital cash, timestamping and cost functions. A mailing list called Cypherpunks, which Arvind Narayanan and Jeremy Clark describe in their 2017 history of Bitcoin’s ideas for ACM Queue as activists who wanted to change society through cryptography and opposed the power of governments and central institutions, discussed the same ideas in a more practical and political key. Back, Dai, Szabo and Hal Finney all posted there.
Narayanan, a Princeton computer scientist, and Clark give the thesis this lesson follows. In their words, “nearly all of the technical components of bitcoin originated in the academic literature of the 1980s and ’90s”. They add that the point is not to diminish what Nakamoto did. The sections below test that claim, piece by piece.
David Chaum, eCash and why DigiCash failed in 1998
David Chaum, an American cryptographer, is the person Narayanan and Clark call the father of digital cash. His work set the target for everyone who followed: cash you can send over a network that, like a banknote, does not tell the bank who you are.
Blind signatures: a bank signs a coin it cannot see
Chaum’s 1981 paper on untraceable email defined a pseudonym as a public key, a name that is just a number you control. In the 1980s he added blind signatures. A user prepares a coin, hides its serial number, and has the bank sign it; the bank debits the account but never sees the number. Later the coin is spent, the shop deposits it, and the bank can check its own signature without linking the coin to the person who withdrew it. Narayanan and Clark call blind signatures the key technical idea behind his digital cash, set out in a 1985 paper in Communications of the ACM.
The bank stays at the centre of this design. It issues every coin and checks every deposit against a list of serial numbers already spent. Chaum solved privacy. He did not try to remove the bank, and in his system the bank is what stops double spending.
DigiCash, Mark Twain Bank and the Chapter 11 filing
Chaum founded DigiCash in Amsterdam at the end of the 1980s (sources give 1989 or 1990) to sell the system, called eCash, to banks. Several banks tested it. In the United States the one that offered it to customers was Mark Twain Bank of St. Louis.
The numbers stayed small. According to a November 1998 American Banker article reposted to a cryptography mailing list, Mark Twain ended its three-year eCash experiment in September 1998, after it had been bought by Mercantile Bancorp. It had about 5,000 eCash customers, and a Mercantile executive said they held “significantly less” than $100,000 in total. The same article reported that DigiCash, by then based in Palo Alto, California, had filed for Chapter 11 bankruptcy protection the week before.
Why did DigiCash fail? The usual story, which Narayanan and Clark sum up and then complicate, is that it needed banks to sign on and too few did. The record fits that much: a system built around a bank stops when the bank walks away. What survived was the idea. Chaum’s pseudonyms, public keys standing in for identities, are how Bitcoin addresses work today, and Narayanan and Clark describe Bitcoin as the most successful version of that idea.
Who invented blockchain technology? Haber and Stornetta’s chain of 1991
The closest ancestor of the data structure people call a blockchain is a paper about notaries. In 1991 Stuart Haber and W. Scott Stornetta, researchers at Bellcore in New Jersey, published “How to time-stamp a digital document” in the Journal of Cryptology. Their problem: a file can be edited and re-dated at will, so how can anyone prove that a contract, a lab notebook or a patent draft existed in a given form on a given day?
The answer they gave avoids trusting the time-stamping service blindly. A document is reduced to a short fingerprint, a hash. Each new time-stamp certificate includes information from the one before it, so the certificates form a chain. To back-date one document, a dishonest service would have to rewrite every certificate after it, and those are already in other people’s hands. The paper’s abstract sets the goal of making back-dating and forward-dating infeasible even if the service colludes with a user.
In a paper dated March 1992 and published in 1993 with Dave Bayer, a mathematician at Barnard College, Columbia University, the two men grouped documents into batches using Merkle trees, so that one hash could stand for many documents. That is the same trick a Bitcoin block uses to summarise its transactions, and the white paper cites it. Narayanan and Clark write that Bitcoin’s ledger structure was borrowed, with minimal modifications, from Haber and Stornetta’s papers of 1990 to 1997, and they note that Josh Benaloh and Michael de Mare reached similar ideas independently in 1991.
The white paper describes its own timestamp server in words that track this work closely: “A timestamp server works by taking a hash of a block of items to be timestamped and widely publishing the hash”. It cites Haber and Stornetta three times for that passage, papers dated 1991, 1993 and 1997, plus a 1999 timestamping paper by Henri Massias, Xavier Serret Avila and Jean-Jacques Quisquater.
Surety and a hash in the New York Times
Haber and Stornetta turned the idea into a company. In a message of 19 June 1994 to the Cypherpunks list, reposted by Tim May that August, Haber wrote that Bellcore had spun off Surety Technologies to bring digital time-stamping into wide use. Other accounts date the company or its commercial service to 1994 or 1995.
The publication trick is older than the company. In the same message Haber said that he and Stornetta closed their hash trees once a week and printed the root in the public notices of the Sunday New York Times, and had been doing so for over two years, which points to 1992. Vice reported in 2018 that Surety’s weekly hash had appeared since 1995, so the start date depends on the source. The method does not: one number summing up every document stamped that week, printed where nobody could quietly change it. Anyone holding an old newspaper could check that the service had not rewritten its records.
Some writers call Surety the first blockchain. That is a framing, and Narayanan and Clark’s account shows its limits. Haber and Stornetta mentioned financial uses only in passing; their chain still had one company adding the records, and its security rested on publication, not on anyone competing to write the next entry. What Bitcoin took from them was the data structure. The way to secure it without a trusted stamper came from elsewhere.
There is one more twist in the answer to who invented blockchain: Nakamoto never used the word. Search the nine pages of the white paper and “blockchain” does not appear once; the closest phrase is “a chain of blocks”, in the section that works out an attacker’s odds. Narayanan and Clark made the same point in 2017 and added that the term still has no standard technical definition.
Hashcash in 1997: a stamp that costs computing time
The second piece is a way to make something expensive to produce and cheap to check. Adam Back, a cryptographer active on the Cypherpunks list, released Hashcash in 1997 as a defence against spam and abuse of anonymous remailers. The date itself is a small puzzle: his announcement on the list is dated 28 March 1997, while his 2002 paper says May 1997.
The mechanism fits in a few lines. Before sending an email, the sender’s computer searches for a value that, hashed together with the recipient’s address, gives a result whose first bits are all zero; the more zero bits required, the longer the search. Finding it takes many attempts; checking it takes one. Back called this a partial hash collision. A few stamps cost an ordinary sender little; millions of them cost a spammer real hardware time. His paper describes Hashcash as a way to “throttle systematic abuse of un-metered internet resources such as email”.
Back was not first to the idea and said so. In the 2002 paper he notes that when he first published Hashcash he did not know of earlier work by Cynthia Dwork and Moni Naor, who in 1992 had proposed making senders of junk email pay in computation. The term itself came later still: according to Narayanan and Clark, “proof of work” was coined in 1999 by Markus Jakobsson and Ari Juels. Our glossary entry on proof of work explains how the idea works in mining today.
Hashcash was not money. A stamp could be used once, for one recipient. It could not be handed on, and nothing stopped the same stamp from being shown twice in different places. Narayanan and Clark put it bluntly: Hashcash has no protection against double spending. Bitcoin’s white paper borrows the costly puzzle and nothing else, saying it needs “a proof-of-work system similar to Adam Back’s Hashcash”.
Back also played a small part in how the story connects. In his first email to Wei Dai, on 22 August 2008, Satoshi wrote that “Adam Back (hashcash.org) noticed the similarities” and pointed him to Dai’s b-money page.
b-money in 1998 and bit gold: money made of proof of work
Hashcash made costly tokens. Two essays asked the next question: could such tokens be money, recorded on a ledger that nobody owns?
Wei Dai’s b-money
Wei Dai posted b-money to the Cypherpunks list in 1998; he gave that year when Satoshi asked, and the white paper lists it as its first reference. The essay describes two protocols. In the first, every participant keeps a copy of how much money each pseudonym owns. Anyone can create money by broadcasting the solution to a previously unsolved computational problem, and payments are signed messages broadcast to all.
Dai called the first version impractical, because it needs a broadcast channel that is both synchronous and impossible to jam. In the second, a subset of participants, the servers, keep the accounts and put up deposits they lose if they cheat. He admitted the servers must be trusted to a degree. b-money was never built.
Satoshi took it seriously. The August 2008 email asked Dai for the year of publication so the paper could cite it correctly; Satoshi had guessed 2006. On 10 January 2009, after the first software release, Satoshi wrote to Dai again: “I think it achieves nearly all the goals you set out to solve in your b-money paper”.
Nick Szabo’s bit gold
Nick Szabo had already written in 1994 about smart contracts, the idea that a program could enforce an agreement (our glossary entry on smart contracts takes it from there). His bit gold essay is harder to date. The post on his blog sits under a December 2005 address, the page itself is headed 27 December 2008, and Narayanan and Clark list it under 2008. Szabo opens it by saying only that he hit upon the idea “a long time ago”. Later accounts place the idea in the late 1990s; we found no primary source that fixes the year.
The design reads close to Bitcoin. A participant takes a public challenge string and runs a costly function over it; the resulting bits are the proof of work. The proof is time-stamped by several independent services, and ownership is kept in a distributed title registry, a chain of signatures from one owner to the next. Each new string takes its challenge from the last one created, so the strings link into a chain. Szabo’s motive was the one this path keeps returning to: conventional money depends on trusting a third party, and gold, the alternative, cannot travel over a network.
He also saw a flaw in his own scheme. Because the value of bit gold tracked the cost of producing it, a sudden leap in hardware speed could flood the supply. The white paper does not cite bit gold.
What both essays left open
Narayanan and Clark name the gap. In both proposals, time-stamping servers sign off on the creation and transfer of money. If those servers disagree, they write, there is no clear way to settle it. And anyone can run many servers under different names, the Sybil problem, so a vote among servers is only as safe as the gatekeeper deciding who may vote. Neither essay contained a consensus method that stops double spending without someone trusted at the gate.
Hal Finney’s RPOW, 2004
Hal Finney, a programmer and long-time Cypherpunk, built the one working system in this family. His Reusable Proofs of Work, proposed in 2004 according to Bitcoin Magazine, let a user turn a Hashcash-style proof into a token that could be passed on. The trick was a server that recorded who owned each token and swapped a spent token for a fresh one.
To answer the obvious objection, that the operator could cheat, Finney ran the server on an IBM 4758 secure coprocessor and let users check remotely that it ran the published code. As the Satoshi Nakamoto Institute’s page on RPOW puts it, RPOW kept ownership registered on a trusted server. Finney later became, by Bitcoin Magazine’s account, the first person to receive a bitcoin transaction from Satoshi, in early 2009.
e-gold: the digital currency that worked and was shut down
One more precedent belongs here, even though it shares no code with Bitcoin and the white paper never mentions it. e-gold, launched in 1996 by Douglas Jackson, an oncologist, and Barry Downey, an attorney, according to a 2014 Pacific Standard history of the case, was an online payment system whose units were claimed to be backed by gold held in reserve. Accounts were kept by the company. It was simple and it grew.
It also drew criminals. A federal grand jury indicted E-Gold Ltd, its affiliate Gold & Silver Reserve Inc. and three directors on 24 April 2007. The indictment release said users had only to give a valid email address to open an account, an allegation at that stage. On 21 July 2008 the Justice Department announced that the companies and Douglas Jackson had pleaded guilty to conspiracy to launder money and to running an unlicensed money transmitting business; Downey and Reid Jackson pleaded guilty to District of Columbia charges for operating without a licence.
The plea terms read like a list of what US rules expect from a payment business today. The companies agreed to a $1.75 million money judgment, to register as money services businesses, to verify customers’ identity and report suspicious activity under supervision by the IRS Bank Secrecy Act division, and to hire an auditor to check that transactions were fully backed by gold. The lesson of e-gold is structural: a company holding everyone’s accounts is a single point that prosecutors, regulators and courts can reach.
That is the background against which Bitcoin was designed. DigiCash failed when its bank left. e-gold was stopped through its operators. Both were run by an identifiable company. Bitcoin, whose white paper went out on 31 October 2008, three months after the e-gold pleas, had no company to sign up and none to charge.
What Satoshi added in 2008: the assembly
Nakamoto posted the paper to the Cryptography mailing list on 31 October 2008. The announcement listed its main properties, among them “No mint or other trusted parties” and new coins made from Hashcash-style proof of work. Read the white paper’s sections 2 to 4 in order and the borrowings line up. Transactions are announced publicly, citing Dai. A timestamp server chains hashes of blocks, citing Haber, Stornetta and the Massias team. Then comes the step that is new: the timestamp server is made peer to peer by using proof of work instead of a newspaper. Whoever finds the next valid block gets to extend the chain, and the longest chain, the one with the most computing work behind it, is the valid history. The paper calls proof of work “essentially one-CPU-one-vote”.
That last move answers the gap in b-money and bit gold. Nobody needs to decide who the servers are, because the vote is weighted by computing power, which cannot be faked by inventing names. And it answers Hashcash’s weakness: the puzzle solutions are no longer the money. Narayanan and Clark stress this point: in Bitcoin the solutions are used to secure the ledger, and the coins are entries in it.
Then the incentive. Each block pays its finder new coins plus the fees in the block. Miners spend on hardware and electricity because the coins have value; the coins have value because the ledger is secure; the ledger is secure because miners compete to extend it. Narayanan and Clark describe this circular dependence as the part none of the forerunners had: the authors of Hashcash, b-money and bit gold did not include a consensus algorithm to stop double spending, and the timestamping and fault-tolerance researchers did not think of paying nodes to be honest.
Their verdict comes in one line: “Nakamoto’s genius, then, wasn’t any of the individual components of bitcoin”, but the way they were fitted together. Satoshi did not claim otherwise. The paper cites its sources, and its own summary of the problem is one these pages have met five times already. Chaum and Szabo are absent from its references, a fact worth knowing and no evidence of anything more.
What is still argued about is the share of recombination and invention. Szabo’s bit gold contains a chain of proofs, Dai’s b-money a public ledger and minted money. Whether the incentive loop is a large step or a natural one is a judgment, and historians of the subject answer it differently.
Who solved what, from 1981 to 2008
The table sums up each forerunner. Where sources give two dates, both are shown.
| Year | Who | Piece of the puzzle | What was missing | Cited in the white paper |
|---|---|---|---|---|
| 1981 and 1985 | David Chaum | Pseudonyms as public keys; blind signatures for private digital cash | A bank issues every coin and stops double spending | No |
| 1989 or 1990 to 1998 | DigiCash (Chaum) | eCash sold to banks; Mark Twain Bank trial with about 5,000 users | Banks did not adopt it; Chapter 11 in 1998 | No |
| 1991 and 1993 | Stuart Haber, W. Scott Stornetta (and Dave Bayer) | Hash-linked timestamps, then Merkle trees to batch documents | One stamping service; no money, no open competition to write | Yes, three papers |
| 1992 | Cynthia Dwork, Moni Naor | Paying in computation to send email | Not money; unknown to Back in 1997 | No |
| 1996; pleas in 2008 | e-gold (Jackson, Downey) | A gold-backed online currency used at scale | A company held every account; guilty pleas in July 2008 | No |
| 1997 (March or May) | Adam Back, Hashcash | Partial hash collisions: costly to make, instant to check | Single-use stamps, no protection against double spending | Yes (2002 paper) |
| 1998 | Wei Dai, b-money | Money minted by solving problems; a ledger kept by all or by servers | No way to settle disagreements; never built | Yes |
| 2005 post (idea earlier) | Nick Szabo, bit gold | Chained proofs of work, title registry of owners | Same consensus gap; supply tied to hardware cost | No |
| 2004 | Hal Finney, RPOW | Reusable proof-of-work tokens, working software | Relied on one trusted server | No |
| 2008 | Satoshi Nakamoto | Proof of work to choose the chain, plus the block reward and fees | Identity unknown | Author |
How to read “X invented the blockchain” claims
The relay matters beyond history. Every few months a company or a press release credits someone with inventing the blockchain, or a new project presents a known idea as its own. A few checks help.
- Ask which part is meant. A chain of hashes dates from 1991; a ledger kept by many parties appears in essays of 1998; the open competition to write the next block appears in 2008. A claim can be true for one and false for the others.
- Look for the trusted party. In DigiCash it was the bank, in Surety the stamping company, in RPOW the server, in e-gold the operator. A design that still has one has not solved the problem Bitcoin set out to solve, whatever it calls itself.
- Check the references. The white paper lists eight. A project that cites nobody is asking for more trust, not less.
- Separate the word from the thing. “Blockchain” is also used for shared databases run by a handful of known firms; our guide to public and private blockchains explains how far those are from Bitcoin’s open design.
For US readers there is one practical echo. The e-gold plea set out obligations that any business moving money for customers in the United States still faces: registration as a money services business, identity checks and suspicious-activity reports, with the IRS among the supervisors. They are close to the checks a reader meets today when opening an account with a US crypto exchange. None of this is advice on what to buy; it explains why a payment business that holds customer accounts asks who you are, and why Bitcoin’s design tried to do without one.
The story of money in this path runs from shells and coins to bank deposits and, here, to a currency with no issuer. Our crypto history timeline carries it on from 2009, and a later lesson in this path turns to tokenomics, the rules that set how many coins exist and who gets them.
