Bitcoin Was Created by the NSA

Introduction

Ask who really made Bitcoin and you will eventually meet the claim that the answer is the National Security Agency. The story is seductive because it starts from facts that check out. The NSA did design the SHA-256 hash function that Bitcoin uses to secure its blockchain and mint new coins. NSA cryptographers did publish a paper in 1996 titled "How to Make a Mint: The Cryptography of Anonymous Electronic Cash." And the person who launched Bitcoin, "Satoshi Nakamoto," has never been identified. Stack those together and the outline of a conspiracy appears: a spy agency wrote the recipe, supplied the cryptography, and hid behind a pseudonym to seed a currency it could one day monitor or switch off.

This entry steelmans that case as strongly as the record allows, then follows the evidence. The short version is that each individual fact is real, but the inference connecting them to Bitcoin's authorship is not supported by anything beyond coincidence.

The strongest version of the claim

SHA-256 is an NSA design. This is not a rumor. The SHA-2 family of hash functions, which includes SHA-256, was designed by the United States National Security Agency and first published in 2001. Bitcoin's proof-of-work and its addressing depend on SHA-256. A cryptocurrency that stakes its entire security model on an algorithm from the world's most capable signals-intelligence agency is, at minimum, an uncomfortable dependency. If the NSA understood some structural weakness in SHA-256 that the public did not, the argument goes, it would hold a hidden lever over the whole system.

The NSA studied anonymous digital cash before Bitcoin existed. In 1996, NSA cryptographers Laurie Law, Susan Sabett, and Jerry Solinas wrote "How to Make a Mint: The Cryptography of Anonymous Electronic Cash," which was published in the American University Law Review in 1997. The paper surveys how one might build an untraceable electronic money system. To a proponent this reads like a design document that resurfaced, transformed, more than a decade later as Bitcoin.

The creator is a ghost. Satoshi Nakamoto published the Bitcoin whitepaper on 31 October 2008, launched the network in January 2009, and vanished from public involvement by late 2010, leaving roughly a million untouched coins. Major investigations by Newsweek, Wired, The New Yorker, and, in 2026, The New York Times have all named candidates, and every named person has denied it or been legally disproven. A creator who covers his tracks that thoroughly, the theory says, looks less like a lone hacker and more like a professional. Some proponents even claim "Satoshi Nakamoto" can be read as "central intelligence."

Taken on its own terms, this is a coherent suspicion. It deserves a real answer rather than a wave of the hand.

What is actually true

Strip the narrative down and three anchor facts survive scrutiny. First, the NSA authored SHA-256; that is stated plainly in the cryptographic literature and reflected in the standards record. Second, the 1996 NSA paper exists and is exactly what its title says. Third, Satoshi Nakamoto's identity is genuinely unknown. A good fact-check does not deny any of these. The question is what they imply.

What the evidence shows

SHA-256 is public, standardized, and royalty-free — the opposite of a secret weapon. After the NSA designed it, SHA-256 went through the National Institute of Standards and Technology's public process and became a Federal Information Processing Standard, FIPS 180-2, approved in August 2002. The design was published, opened to public review, and released under a royalty-free license. It is now embedded in TLS, software signing, password systems, and countless other technologies worldwide. Cryptographers have studied it intensively for two decades and found no exploitable backdoor. Using an NSA-designed public standard no more makes Bitcoin an NSA project than using AES or TCP/IP makes every website a government product. If NSA authorship of a widely adopted standard proved control, the agency would "own" most of the modern internet.

Bitcoin is open-source, and its ledger is traceable, not surveillance-proof for its users. Every line of Bitcoin's code has been public since launch and has been read, forked, and audited by thousands of developers. A hidden backdoor in an openly inspected codebase is extraordinarily hard to sustain. More damning for the honeypot theory: Bitcoin is pseudonymous, not anonymous. Every transaction is recorded permanently on a public blockchain, and a whole industry of chain-analysis firms now de-anonymizes flows for law enforcement. If you wanted to build the perfect covert surveillance currency you would not build one whose entire transaction history is published forever for anyone to trace. Bitcoin is close to the opposite of the untraceable cash the 1996 NSA paper actually described.

The 1996 paper is a literature survey, and it lacks Bitcoin's core invention. "How to Make a Mint" reviews existing cryptographic digital-cash schemes, most of which — like David Chaum's DigiCash ecash, conceived in 1982 and commercialized before going bankrupt in 1998 — relied on a trusted central issuer such as a bank. The paper contains no proof-of-work, no decentralized consensus, and no solution to double-spending without a trusted third party. Those are precisely Bitcoin's innovations. The document points backward to Chaum-style centralized cash, not forward to a trustless distributed ledger.

Bitcoin's own citations trace an independent cypherpunk lineage. The whitepaper is not a mystery about where its ideas came from; it lists them. It cites Wei Dai's 1998 "b-money" and Adam Back's Hashcash, the 1997 proof-of-work system. Its intellectual family tree runs through the 1990s cypherpunk mailing list: Chaum's ecash, Back's Hashcash, Dai's b-money, Nick Szabo's 1998 "bit gold," and Hal Finney's 2004 Reusable Proofs of Work. Finney, a lifelong cypherpunk, received the first Bitcoin transaction from Satoshi in January 2009. This is a public, documented, decade-long civilian conversation about digital money, and Bitcoin sits squarely inside it. Satoshi even emailed Back and Dai while writing the paper.

The absence of evidence is itself telling. There is no leaked memo, no internal repository, no whistleblower, and no corroborated witness placing the NSA anywhere near Bitcoin. Edward Snowden's 2013 disclosures exposed vast, closely guarded NSA programs; nothing in that trove, or any leak since, mentions a Bitcoin project. A secret this consequential, kept perfectly for over fifteen years across an agency of tens of thousands, would be unprecedented.

Why the theory persists

The theory endures because it is built from true premises and an unfalsifiable structure. You cannot disprove a secret by pointing to the lack of a leak; a believer can always say the leak has not happened yet. The genuine mystery of Satoshi's identity leaves a vacuum that any sufficiently powerful actor can be poured into. And the underlying anxiety is real: governments worldwide are exploring central bank digital currencies, and fear of a programmable, cancelable, cashless future gives the story emotional traction that no citation trail can fully dislodge.

Verdict

Unsubstantiated. The load-bearing facts — NSA-designed SHA-256 and a 1996 NSA paper on digital cash — are true but do not connect to Bitcoin's creation. SHA-256 is a public standard, Bitcoin's code is open and its ledger traceable, and the whitepaper's citations document an independent cypherpunk origin. Satoshi's anonymity is a real mystery, but a mystery is not evidence. Nothing in the record ties the NSA to Bitcoin, and the design choices point the other way.