A developer has recompiled bitcoin.exe, the first Bitcoin client released by Satoshi Nakamoto in January 2009, byte for byte from the original source code. According to Journal du Coin, which reported on the project on 25 October 2026, the resulting file carries the same SHA-256 fingerprint as the original. The result proves that the 2009 executable was indeed built from the published code, with no hidden program. It says nothing about Satoshi's identity.
What the GitHub repository rebuilt
The project takes the form of a GitHub repository. It starts from the source code published with the first version and has a single goal: to produce a bitcoin.exe identical to the one distributed in 2009. According to the repository's readme, the first attempt takes about 6 minutes.
At the end, the script displays "MATCH". The rebuilt file, a program of 6,440,960 bytes, has the same SHA-256 as the original. Here, SHA-256 serves as a digital fingerprint: two identical fingerprints mean two identical files. The rebuilt .rar archive also reproduces the fingerprints published by the Satoshi Nakamoto Institute.
How does a reproducible build work?
Compiling means turning source code into an executable program. The result depends on the tools used: two machines with different setups never produce the same file. A reproducible build therefore consists of recovering the author's exact toolchain.
For Bitcoin 0.1, the task was a heavy one. The repository had to gather packages hunted down in archives from 2006 to 2008, right down to the exact snapshot Satoshi used. Without Windows XP, it replays the build on Linux with Wine, a piece of software that imitates the 32-bit Windows of the time.
The method does not require taking the developer at his word. The fingerprints of every file are published, and anyone can rerun the build to check the result for themselves.
What the executable reveals about Satoshi Nakamoto's machine
The binary retains internal traces that name each library used, along with its version. The most telling is MinGW GCC 3.4.5, whose build path appears in the file. The readme for version 0.1.5 mentioned two possible compilers, MinGW and Visual C++ 6.0. The binary settles the question in favour of MinGW.
The operating system rests on a more indirect clue. A test of the Berkeley DB database fails in a very specific way that only Windows XP system files produce. It is the strongest clue put forward by the repository. Satoshi had in fact written as much on 8 January 2009 when announcing his client: "Windows only for now."
The archive gives away its own details too. Its headers retain dates set by hand, down to the minute. Satoshi packaged his software with a copy of WinRAR that was already more than three years old, which the repository tracked down. According to Journal du Coin, the executable was finished on 10 January 2009.
Established result, hypothesis and unknowns
| Claim | Status | What it rests on |
|---|---|---|
| The distributed bitcoin.exe was built from the published source code | Established | Same SHA-256, a build anyone can rerun |
| No hidden program in the executable | Established | The file matches the published code exactly |
| MinGW GCC 3.4.5 compiler | Established | Build path written into the binary |
| Machine running Windows XP | Strong hypothesis | Behaviour of a Berkeley DB test |
| Launch-day package | Not verifiable | No verified copy has survived |
| Satoshi's identity | Unknown | The repository says nothing about the user |
What we do not know yet
The rebuilt bitcoin-0.1.0 is not the one from 8 January 2009. The archive corresponds to the update of 10 January, because no verified copy of the launch package has survived. The first-day file therefore escapes verification.
Nor is the rebuild entirely independent. The script copies three timestamps read from the original file. It thus repeats one of Satoshi's actions without rediscovering it on its own.
Finally, the human mystery remains intact. Satoshi's computer appears in no document, and the repository says nothing about its user. Knowing a compiler and an operating system points to no one.
What is at stake in this identity is not only historical. According to Journal du Coin, Bitcoin's creator holds the equivalent of 71 billion dollars in BTC. The earliest bitcoins do not sleep forever either: the same outlet reports that 100 BTC from the Satoshi era came out of sixteen years of dormancy "last October", without specifying the year. Nothing in the repository links these movements to a person.
Why verification matters for the security of a bitcoin wallet
In 2009, nobody checked the file delivered by Satoshi. It took seventeen years to establish that the executable matched the published code. The lesson still holds: public source code guarantees nothing about the installed program until someone verifies that it was built from it.
The tampered Ledger affair, already covered by 2clics, shows the cost of a modified device. Since 9 October 2026, hundreds of owners of Ledger devices bought from CryptoBilis, an authorised reseller in Indonesia, Malaysia and the Philippines, have seen their crypto disappear. Bitquery counts 102 million dollars siphoned from 324 wallets, a figure Ledger has neither confirmed nor disputed.
The modus operandi lies in distribution, not in the code. According to Ledger, a "highly organised criminal group" opened genuine devices to graft components onto them, before putting them back into circulation through resellers in Southeast Asia. The manufacturer says the chip, the operating system and its servers remained intact.
A phishing campaign is now exploiting the affair, according to an alert from the security firm SlowMist. An email promises a fake Ledger firmware update, then asks for the 24 words of the recovery phrase.
Security reflexes for a bitcoin wallet
The guidelines published by Ledger after the affair follow the same logic as the reproducible build: trust only what can be verified. For a bitcoin holder in Switzerland or anywhere else, they come down to a few points:
- download your wallet software through the publisher's official channel, such as shop.ledger.com for Ledger Wallet;
- update the firmware only in the official application, confirming each step on the device's screen;
- never start an update from a link received by email;
- enter your recovery phrase only on the device itself, never on a computer, a phone or a web page.
