The document that founded Bitcoin had no launch, no stage, and no audience. It was an email. On October 31, 2008, someone signing as Satoshi Nakamoto sent nine pages to a cryptography mailing list, with a free email address in the header. One of the first responses was from a skeptic saying it wouldn't scale.
It's worth reading what's there because much of what is said today is not. The title is "Bitcoin: A Peer-to-Peer Electronic Cash System." Not an investment, not a store of value, not digital gold. The first sentence of the abstract proposes a version of electronic cash that allows payments to be sent directly from one party to another without going through a financial institution. It's a technical sentence about a technical limitation.
The first page is fairer to the current system than most texts about Bitcoin. It acknowledges that the trust-based model works well enough for most transactions and then lists the cost: no payment is truly irreversible because the institution needs to mediate disputes, and a certain percentage of fraud is accepted as inevitable.
The problem is specific. A digital file can be copied, and that's what prevents a file from being money. If I send a number that represents ten reais, nothing stops me from sending the same number to five other people at the same minute. All receive the same thing. This is the double-spending problem.
The known solution was a central register, and the document describes it by its old name: the mint. Each coin returns there after each transaction and is reissued; only what comes out of there is trustworthy. It works—and returns to the arrangement exactly the intermediary one wanted to escape: the fate of the entire system depends on the company operating the counter. It's the conclusion of the previous module arriving by another path.
Satoshi was not the first to try. The document's eight references are almost all earlier: Wei Dai's b-money from 1998; Adam Back's Hashcash, which already used proof of work to make sending spam costly; Haber and Stornetta's 1991 work on timestamping a document; and a 1957 probability book. The pieces had been on the table for over ten years. The fit was missing.
The fit fits in one sentence: if the problem is knowing which payment came first, publish the order. Not the identity of who paid, not anyone's balance—the order. Every transaction is publicly announced, and the network agrees on a single history of the sequence in which they arrived. The second attempt to spend the same coin no longer needs an arbiter because it is visibly the second.
The expensive part is missing, and the document does not hide it: if writing in this register were free, anyone could rewrite it. The answer is proof of work—writing costs, and rewriting the past costs redoing everything that has been done since then. This is the subject of Lesson 4.
One definition is worth keeping: an electronic coin is a chain of digital signatures. Each owner transfers it to the next by signing the hash of the previous transaction along with the recipient's public key. There is no "bitcoin" object anywhere—there is a chain of authorizations that anyone can verify back to the origin.
Notice what the text does not do. It does not talk about price, does not promise appreciation, and does not claim it will succeed. Section 11 is called "Calculations" and is about the probability of the idea itself failing. And the document is precise even about what a successful attack could achieve: neither creating value out of nothing nor taking money that was never theirs, only undoing a payment they themselves just made. The word "blockchain" does not appear even once in the nine pages, neither together nor separate.
In the next lesson, this solution in motion: a complete cycle, from someone pressing "send" until the payment becomes final.