The First Bitcoin Miner: What the Debug Log Reveals

↓ Jump to the video and timestamps

Alex Waltz came on the show this week, and by the time we were done I was genuinely annoyed that this ground had been sitting uncovered for sixteen years. Not annoyed at Alex. Annoyed that it took this long for anyone to go line by line through a file that has been publicly downloadable the entire time.

The received wisdom on Hal Finney is that he tweeted "running bitcoin," connected to Satoshi's node, and that's the story. People have been citing that tweet as settled history for years. Alex's forensic work shows the real story is messier, more interesting, and far more consequential than the shorthand suggests. He dug through Hal's debug log file, mapped the IRC channel usernames against the source code, correlated blockchain time gaps with Patoshi pattern resets, and cross-referenced everything against Satoshi's private emails to Hal.

What he found is a picture of Bitcoin's first 72 to 96 hours that had never actually been assembled from primary sources before.

I pushed a lot of the framing in this conversation because I think the conclusion Alex reached matters beyond the archaeology. The chaos of those first days (the bugs, the crashes, the network halting over and over because essentially one person was running the whole thing) is the strongest argument I've seen that Bitcoin was one guy with a laptop, not a coordinated state project. Alex put it plainly: "This is some fucking guy with a laptop like you and me." He's right. And that's worth understanding precisely.

Key takeaways

• Hal Finney wasn't alone when he joined the network. His debug log shows three nodes in the IRC channel at Block 49: his own, a node with a Tor prefix, and a clearnet node operated by the channel's @ operator, almost certainly Satoshi running two setups simultaneously to bootstrap the network.
• Satoshi ran two nodes to make the network look alive. The forensic evidence points to Satoshi operating both a clearnet node and a Tor node in the first days so early joiners like Hal would have peers to connect to and mining could begin immediately.
• The network halted at least eight times in the first 170 blocks. Time-gap analysis combined with extra-nonce (Patoshi) pattern data shows mining stopped every time the presumed Satoshi nodes went offline, because there was no one else on the network.
• The "running bitcoin" tweet came after a bug fix, not the first connection. Hal's node crashed on the initial install. Satoshi had to push version 0.1.1. The famous tweet marks the moment he finally got it working, not his first attempt.
• Dustin Trammell may have mined before Hal. Trammell published cryptographic proof that he controlled the keys that mined blocks 76 and 309, while Hal's wallet shows block 78 as his first mined block, putting Trammell potentially ahead by two blocks, though block 76's coins don't appear confirmed on-chain.
• The NSA-origin theory doesn't survive contact with this evidence. The bugs, crashes, failed connections, and dependency on two willing strangers to keep the network alive point to one person building in the open. You cannot manufacture dysfunction that organic.

Before the Debug Log (What Everyone Thought They Knew)

For years, "Hal Finney tweeted running bitcoin" has functioned as a complete sentence. People cite it, nod, and move on as if the story is finished. Alex's starting point was realizing that almost nobody had actually gone looking for what that sentence meant in terms of primary source material.

He'd been doing Bitcoin archaeology threads for a couple of years, thirty days of Bitcoin facts, historical threads, the kind of research that builds up context over time. When he finally decided to dig into the Hal Finney period specifically, he expected to find a body of substantive work that had already covered the ground. Instead he found, in his words, "zilch, nothing, just people claiming certain things."

The public record from that period is thin. Satoshi announced the Bitcoin client on the Cryptography mailing list. Hal was essentially the only person who responded with genuine interest. There's a gap between the Genesis Block on January 3, 2009 and Block 1, which landed around January 8 or 9 depending on timezone.

Five to six days of a network that wasn't really a network yet. And between those two dates, almost no one had looked carefully at what actually happened.

Alex decided to look. What he found first was the debug log file, a record Hal's node kept of everything it did when he first tried to connect. It had been publicly available, referenced in passing here and there. Nobody had read it carefully.

What the Debug Log Actually Says

When a Bitcoin node started up in version 0.1, it needed to find peers before it could do anything. Satoshi's solution was an IRC channel, a bare-bones group chat called #bitcoin on freenode. Each node joining the channel would automatically register a username constructed from its IP address and port number, converted through Base58 encoding (the same encoding that makes Bitcoin addresses look the way they do). That deterministic construction is critical: because the usernames aren't truly random, you can work backwards from them.

Hal's debug log shows three usernames in the channel when his node connected at Block 49. One is Hal's own (verifiable because his IP address was publicly known and the math checks out). The second has an X prefix, which the version 0.1 source code applies to nodes connecting via Tor, because there's no IP address to encode. The third has an @ symbol in front of it. On IRC, @ means channel operator.

Who would be the operator of the #bitcoin channel if not Satoshi? Alex went further: scrolling up in the debug log, you can also see the clearnet IP of the operator node. Run that IP through the same Base58 encoding the code uses and the username matches. No speculation required. The file shows it.

So when Hal joined at Block 49, there were two other nodes already present: a clearnet node operated by whoever set up the channel, and a node running through Tor. Jeremy Rubin had previously annotated the early Bitcoin source code in a GitHub repository that Alex found useful for working through exactly how the username construction worked, and reading the version 0.1 source directly confirmed the logic. That's the foundation. Three nodes, two of which were there before Hal arrived, one of which is masked by Tor.

Block 49 and the Emails That Corroborate It

Block 49 is where Hal's node enters the picture, and the private correspondence between Hal and Satoshi is what pins down the timing.

Hal had been following Satoshi's work since the whitepaper appeared on the Cryptography mailing list in October 2008. When Satoshi actually launched the client and announced it on the same list, Hal was essentially the only person who expressed real interest. Satoshi sent him a private email: here's the software, if you want to try it. Hal replied that he'd take a look over the weekend.

Alex cross-referenced the email timestamps against the blockchain record. The email exchange happened on what was a Thursday in California, PST. By the time Hal got to it over the weekend, the network was at Block 49. The debug log shows his node requesting block headers up to that point, meaning that's exactly where the chain was when he connected.

The email timeline and the on-chain record land in the same place. Two disclosure events gave researchers access to Hal's private Satoshi correspondence. Before he died in August 2014, Hal shared some of the emails with a journalist. After his death, a CoinDesk reporter obtained additional emails, and Hal's wife authenticated them. Taken together, those emails give enough timestamped material to reconstruct the sequence.

When Hal connected at Block 49, his node immediately crashed. This wasn't a Tor-related issue. It was a bug in version 0.1 that Satoshi's own testing hadn't caught. Satoshi pushed version 0.1.1 to fix it. Hal got that, got his node running, and then sent the tweet: "Running bitcoin."

The famous post wasn't his first attempt. It was the confirmation that the bug fix worked.

Dustin Trammell and the Cryptographic Proof

At some point while Alex was deep in this research, he remembered a tweet from Dustin Trammell, a Bitcoin-adjacent figure who had been around since very early days. Trammell had claimed, with a cryptographic proof attached, that he might have been the second human being on the Bitcoin network and may have beaten Hal to mining a block.

The proof works like this: in Bitcoin, you can sign arbitrary data with the private key that controls a given address. If that address mined a specific block, signing a message with that key proves beyond any reasonable doubt that you controlled it at the time. Trammell posted two such proofs.

Based on Alex's reconstruction (and these block numbers need to be treated as his best reading of the evidence, cross-checked against Trammell's published proof and Hal's wallet screenshot), Trammell's proofs cover block 76 and block 309. Block 76's coins don't appear confirmed on-chain today, which Trammell acknowledged, though the cryptographic proof itself verified. Block 309 is visible on-chain and can be inspected. Hal's wallet screenshot, which he shared with a journalist near the end of his life, shows block 78 as his first mined block.

If that ordering holds (Trammell at 76, Hal at 78, Trammell again at 309), then Dustin Trammell was the first person outside Satoshi to mine a Bitcoin block, by two blocks. The margin is small enough that it can't be called settled, but the cryptographic proof for block 309 is on-chain and undeniable.

Alex also confirmed that Trammell shared his IP address with Satoshi in their private correspondence, which rules him out as the operator of the Tor node.

I said on tape that I want to get Dustin on the show to talk through this. That stands. His role in those first days is historically underappreciated, and the cryptographic proof he published is exactly the kind of primary source work this period of Bitcoin history deserves.

Eight Network Halts and the Tor Node Thesis

This is where Alex's work gets genuinely new. He took the timestamps from the first 170 blocks (up through the first Bitcoin transaction, from Satoshi to Hal) and mapped the time gaps between them. Eight instances showed anomalously long inter-block times: one gap of 24 hours and 12 minutes between blocks 14 and 15, one of 8 hours and 34 minutes, one of 2 hours and 45 minutes, and several in the 30-to-44-minute range.

A network mining at the target pace shouldn't produce gaps like that. It should average around 10 minutes per block. Then he layered in the Patoshi pattern data.

The Patoshi pattern is the work of researcher Sergio Demian Lerner, who identified a quirk in how the extra nonce (a secondary counter in the block coinbase) behaves in early Bitcoin mining. Because of a bug in Satoshi's implementation, the extra nonce doesn't reset when a block is found. It only resets when the node is shut down and restarted. That makes it an accidental uptime counter.

By charting extra nonce values against block numbers, you can identify which blocks were likely mined by the same node during a continuous session, and where session resets (node restarts) occurred. When Alex overlaid the extra nonce resets from the Patoshi pattern against his time-gap analysis, the alignment was nearly perfect. Almost every instance of an anomalously long gap between blocks corresponded to a point where the Patoshi pattern showed a node reset.

The mining stopped because whoever was running the dominant nodes shut them down. When they came back, blocks started appearing again.

There is one clear exception: the window around Block 49, where the average inter-block time is close to 10.7 minutes. That's when Hal was on the network. Two nodes actually mining means the network moves at something like its intended pace.

The Tor node thesis follows directly. We know from the debug log that at Block 49 there were three nodes: Hal's, the clearnet operator node, and the Tor-prefixed node. We know from the halt analysis that the network stopped and started in ways that correlate almost exactly with a single entity going offline and coming back. We know the "do not mine unless connected to a peer" rule in version 0.1 meant you needed at least one other node connected before your miner would run, which meant Satoshi needed to have two nodes running to ensure that any early joiner would immediately have a peer.

The email from Satoshi to Hal after those early days lands as the bow on it. Satoshi wrote that Hal was keeping the network alive, and explained that he himself couldn't receive incoming connections from where he was. Version 0.1 running over Tor cannot accept incoming connections. "From where I am" reads as Satoshi being away from his clearnet setup and connecting via Tor for privacy.

My read on tape: "the thesis is essentially that to bootstrap the network in the early days, Satoshi had a clearnet node and a node running through Tor that were connected and mining blocks so that when other individuals join the network like Hal and Dustin, it looked like there was activity already." Alex confirmed it. The evidence is circumstantial in places but it fits together with very few gaps, and the alternative explanations require far more coincidence.

One more thing on the "do not mine unless connected to a peer" rule, because it gets misread sometimes: this was coordination logic, not an anti-pre-mining measure. As I said on tape, "it was more coordination to make sure there weren't no forks." If two nodes started mining independently before finding each other, they'd produce conflicting chains. The rule was simple engineering. There was no pre-mining conspiracy to dismiss here, just Satoshi solving a bootstrapping problem with the tools he had.

What This Tells Us About Who Satoshi Was

The NSA theory, or any variant of the "sophisticated state actor" theory of Bitcoin's origin, does not survive contact with what Alex found.

Think through what you'd have to believe. A government intelligence program ships a client with a bug that crashes on first connection, requires an emergency patch to fix, fails to maintain consistent uptime across the first few days, and relies entirely on two willing strangers on the internet (one of whom almost didn't bother) to keep the network alive long enough to matter. Eight times in the first 170 blocks, the whole thing just stops. Eight times.

If Hal Finney had decided not to look at Satoshi's email over that weekend, or if Dustin Trammell hadn't bothered to download the client, the question of whether Bitcoin would have survived its first week is a real one. That's not how a coordinated program operates. That's how a person with a laptop operates.

Alex put it best: "If you'd give me a million dollars and you would say, construct the chaos like this, I don't think you could do it." The dysfunction is the proof of authenticity. You cannot manufacture that level of organic failure on purpose.

Could Bitcoin have died in the cradle if Hal and Dustin hadn't shown up? Probably yes. Alex referenced the old video of the lone dancer at a hillside rave, the narrator's point being that the second person to join is as important as the first. Without Hal and Dustin, Satoshi was just a guy running two nodes and mining blocks in an empty room.

What they did, showing up and trying to get it working despite nothing working, was indispensable. Their participation is historically underappreciated.

Alex's Film and Raising Bitcoin's Storytelling Standard

I want to close on this because I feel strongly about it and I said so on tape.

The production quality on Alex's "First Bitcoin Miner" film is genuinely excellent. The B-roll of the camera tracking toward his laptop, the lighting, the pacing (he told me some shots took two weeks of retakes to get four seconds of footage right) all reflect obsessive standards. He says his minimum on takes is fifty. The result is a piece of Bitcoin educational content that competes aesthetically with anything being produced at a professional level.

Alex has two more projects coming. A short film about verifying Bitcoin Core's PGP keys (already filmed, looking for sponsors, with some notable Bitcoin community cameos) and a longer feature called "Satoshis Don't Exist" that he's been building since 2023. Both are self-funded out of pocket.

I've been saying for a while that the Bitcoin world gets outspent on storytelling and aesthetics by Coinbase and others who are selling something worse. Alex's film is the counter-example. It proves that an independent Bitcoiner with a camera and a light and obsessive standards can produce something that sets a new bar.

If you're working at a Bitcoin company and you're listening to this: reach out to Alex. The story of what Bitcoin is and where it came from deserves to be told with this level of care. We need more of it.

You can find Alex's work at alexwaltz.com (waltz, like the dance) and on X/Twitter. If you haven't watched the film, watch it before you listen to this episode a second time. It'll change how you hear the conversation.

About Alex Waltz

Alex Waltz is an independent Bitcoin researcher and filmmaker. He has spent years doing Bitcoin archaeology, tracing the historical record of Bitcoin's early days through primary source material including source code, forum posts, on-chain data, and correspondence. His film "The First Bitcoin Miner" reconstructs the first 96 hours of Bitcoin's network history using Hal Finney's debug log, the Patoshi pattern, and Satoshi's private emails. He is currently in production on a short film about Bitcoin Core PGP verification and a feature project called "Satoshis Don't Exist." His work is at alexwaltz.com.

Sources mentioned

• Hal Finney's debug log file, referenced in Alex's article and film; described as still publicly downloadable at time of recording
• Bitcoin version 0.1 source code, the basis for Alex's username-construction analysis; Jeremy Rubin's annotated GitHub repository of early Bitcoin source code was cited as a helpful secondary reference
• Hal Finney's private correspondence with Satoshi Nakamoto, shared before his death with a journalist, and additional emails authenticated by his wife and reported by CoinDesk after his death in August 2014
• Hal Finney's "Running bitcoin" tweet, the public record on X/Twitter
• Satoshi Nakamoto's announcement of the Bitcoin client on the Cryptography mailing list, public record
• Sergio Demian Lerner's Patoshi pattern research, the foundational analysis of early Bitcoin mining attribution
• Dustin Trammell's account of his earliest days on the network, including a cryptographic signature proving he controlled the address that received Satoshi's coins in January 2009
• Hal Finney's Bitcoin wallet screenshot, shared with a journalist and cited in the published correspondence record
• Alex Waltz's "First Bitcoin Miner" film (YouTube)

Watch the conversation

Timestamps

• 0:07 - Intro
• 0:47 - What sent Alex down this path
• 4:21 - Block 1 timing and why the genesis block isn't the start
• 5:42 - How the IRC channel worked and what the debug log shows
• 9:00 - Block 49 and the email timeline with Hal
• 14:00 - The "do not mine unless connected to a peer" rule
• 19:00 - Dustin Trammell's cryptographic proof
• 28:00 - The Patoshi pattern and extra nonce explained
• 42:00 - Eight network halts and the Tor node thesis
• 55:00 - What this tells us about who Satoshi was
• 1:04:00 - Alex's upcoming films and Bitcoin's storytelling standard

Sponsors

• Bitkey: The easiest way to secure your bitcoin off the exchange. No seed phrases, two-of-three multisig, new model includes a full screen so you can verify transactions and addresses before signing. Code TFTC for 10% off. bitkey.world
• CrowdHealth: Crowdfunded healthcare, not insurance. Marty's family has been on it for five years. As a family of five, roughly $700/month. You pay $500 for a regular health event, the crowd covers the rest. Pregnancy: you pay the first $3,000. Code TFTC for $99/month for your first three months. joincrowdhealth.com/tftc
• Aven: A Bitcoin-backed line of credit up to $1M without selling a sat. No rehypothecation, custodied by BitGo, fixed rates for up to 10 years, 2% unlimited cash back. Rates from 7.99% APR. aven.com/bitcoin
• Unchained: Collaborative multisig custody. You hold two keys, they hold one, two keys always required to move funds. Secures over $12 billion in bitcoin across more than 12,000 clients. Includes trading from vault, Bitcoin IRAs, loans, and inheritance solutions. Code TFTC10 for 10% off a new vault. unchained.com/tftc