Stop 1 of 12 · Section 1
Introduction
Online payments depend on banks and payment companies acting as trusted third parties. Because those payments can be reversed, merchants have to be wary of customers and accept a certain amount of fraud as unavoidable. The paper proposes a payment system based on cryptographic proof instead of trust, so two willing parties can transact directly.
Key idea Replace trust in an intermediary with proof that anyone can check.
Think about it Which of the payments you make today could be reversed by someone else?
Stop 2 of 12 · Section 2
Transactions
An electronic coin is defined as a chain of digital signatures. Each owner passes it on by signing a hash of the previous transaction together with the next owner's public key. The signatures prove the chain of ownership — but they can't show that an owner didn't also spend the same coin somewhere else.
Key idea The hard problem isn't proving ownership. It's preventing double-spending.
Think about it Why can't the person receiving a coin detect a double-spend on their own?
Stop 3 of 12 · Section 3
Timestamp Server
The solution starts with a timestamp server: take the hash of a block of items and publish it widely. Each timestamp includes the previous one in its hash, so the timestamps form a chain, and every new one reinforces those before it.
Key idea Publishing the order of events makes history hard to rewrite quietly.
Think about it Who decides the order of events in a system with no central clock?
Stop 4 of 12 · Section 4
Proof-of-Work
To run that timestamp chain without a central server, nodes search for a value — a nonce — that makes the block's hash begin with a required number of zero bits. Finding it takes a lot of work; checking it takes a single hash. The majority decision is the longest chain, the one with the most proof-of-work behind it, and the difficulty adjusts so blocks keep arriving at a steady average pace.
Key idea One CPU, one vote: influence comes from work done, not from the number of identities.
Think about it Why would "one IP address, one vote" fail in an open network?
Stop 5 of 12 · Section 5
Network
The network runs in six steps. New transactions are broadcast to all nodes. Each node collects them into a block and works on finding its proof-of-work. The first node to find it broadcasts the block. Other nodes accept it only if every transaction in it is valid and not already spent — and they show acceptance by building the next block on top of it.
Key idea Nodes always treat the longest valid chain as the correct one.
Think about it What happens when two nodes find a block at nearly the same moment?
Stop 6 of 12 · Section 6
Incentive
By convention, the first transaction in each block creates new coins owned by the block's creator. That rewards nodes for supporting the network and puts coins into circulation without a central issuer. Transaction fees add to the reward, and once a predetermined number of coins exists, the incentive can move entirely to fees. An attacker with a lot of computing power should find it more profitable to follow the rules than to undermine the system that pays them.
Key idea Make honesty the most profitable strategy.
Think about it What changes for miners when new coins stop being created?
Stop 7 of 12 · Section 7
Reclaiming Disk Space
Once a coin's latest transaction is buried under enough blocks, the spent transactions before it can be discarded. Transactions are hashed into a Merkle tree, and only the root goes into the block header, so old branches can be pruned without breaking the block's hash. The paper estimates a block header at about 80 bytes — roughly 4.2 MB per year.
Key idea Hashes let you keep the proof without keeping everything.
Think about it When old data is pruned, what do you lose — and what can you still prove?
Stop 8 of 12 · Section 8
Simplified Payment Verification
You can verify payments without running a full node. Keep a copy of the block headers of the longest chain, and get the Merkle branch that links a transaction to its block. Blocks built on top of it show the network accepted it. This is reliable while honest nodes control the network, but weaker if an attacker overpowers it — so businesses that receive frequent payments will probably still want their own nodes.
Key idea Light clients trade some security for far less data.
Think about it When is checking headers alone good enough for you?
Stop 9 of 12 · Section 9
Combining and Splitting Value
Handling every cent as a separate coin would be clumsy, so transactions can have several inputs and outputs. Usually there's either one input from a larger earlier transaction or several inputs combining smaller amounts — and at most two outputs: one for the payment, and one returning change to the sender.
Key idea Coins aren't fixed denominations. They are split and merged as needed.
Think about it Why does a payment often create a "change" output back to you?
Stop 10 of 12 · Section 10
Privacy
Banks keep privacy by limiting who can see transactions. Here every transaction is public, so privacy comes from keeping public keys anonymous: anyone can see that someone sent an amount to someone else, but not who they are. Using a new key pair for each transaction helps. Some linking is unavoidable, because a transaction with several inputs reveals that they had the same owner.
Key idea A public ledger with pseudonymous participants.
Think about it What could someone learn about you if all your addresses were linked together?
Stop 11 of 12 · Section 11
Calculations
The paper models an attacker trying to build an alternate chain faster than the honest one. Treated as a binomial random walk, the attacker's chance of ever catching up falls exponentially with the number of blocks they are behind. The section includes short C code and tables showing how many blocks it takes to push that probability below a chosen level.
Key idea Every additional block makes a payment exponentially harder to reverse.
Think about it Why do people wait for several confirmations before treating a large payment as final?
Stop 12 of 12 · Section 12
Conclusion
The paper sums up a system for electronic transactions that doesn't rely on trust. The network is robust in its unstructured simplicity: nodes work all at once with little coordination, don't need to be identified, and can leave and rejoin at will, accepting the proof-of-work chain as the record of what happened while they were gone. They vote with their computing power, accepting valid blocks by building on them.
Key idea A few simple rules, enforced by everyone, instead of a trusted centre.
Think about it Which parts of today's Bitcoin were already in these nine pages — and which came later?
Tip: use the ← and → keys to move along the trail.