The question, as someone in my Twitter DM’s articulated it, was this: “Do you think that Paul Le Roux is bitcoin creator Satoshi?”
In one sense, they’d all come to the right place. I spent five years tracking Paul Calder Le Roux, a South African programmer who built a global drug and arms dealing empire, and transformed himself into one of the 21st century’s most prolific and pursued criminals. I’d obsessively catalogued his life, from his early history as an encryption coder; through his creation of an online prescription drug business worth hundreds of millions of dollars; to his diversification into smuggling, weapons, and violence; to his 2012 capture by, and cooperation with, the Drug Enforcement Agency.
Along the way he had, among other endeavors, simultaneously fed the American opioid epidemic; built his own base operations in Somalia, protected by an armed militia; run gold and timber extraction operations in a half-dozen African countries; laundered millions of dollars through Hong Kong; plotted a coup in the Seychelles (later abandoned); bought off law enforcement in the Philippines, where he was based; trafficked methamphetamine out of North Korea; and overseen a team of engineers building missile guidance systems for Iran and drones for drug delivery.
I’d traveled into the Manila underworld and found former employees, including ex-military mercenaries who’d worked as Le Roux’s enforcers. I’d distilled hundreds of interviews and tens of thousands of pages of records into a 400-page book, The Mastermind, detailing Le Roux’s epic rise and fall.
These questions about Satoshi, however, filled me with a special kind of dread. I’d traveled down the Satoshi rabbit hole before and returned empty handed. “I’ve got a secret theory that Paul invented bitcoin,” I’d written in 2016 to Mathew Smith, Le Roux’s cousin. Smith, along with over a hundred other Le Roux–connected people I interviewed, from employees to cops, had seen or heard nothing to support my theory. By the time I finished the book, in late 2018, I’d largely discarded it. “I wasted countless hours trying to determine if there was any connection” between Le Roux and Satoshi, I wrote in the final manuscript. “As far as I could tell, there wasn’t.”
There was some relief in this. I’d seen the ignominy when people went Satoshi hunting in the past. The siren song of bitcoin’s progenitor had been calling out to journalists since Satoshi seemed to exit the cryptocurrency world in 2011, leaving behind a technology that—even today, after all the hype cycles—promises to shape the future of everything from money to contracts. Whoever Satoshi was, the person (or persons) was sitting on a fortune, roughly a million bitcoins that analysts estimated Satoshi had mined at the currency’s inception in 2009. (At current prices that stash would be worth more than $10 billion.) There had been many attempts to unmask the creator, unresolved.
But now the messages about Le Roux kept coming, driven by 4chan and Hacker News threads churning over a tantalizing new clue—a footnote in one filing in a multibillion-dollar federal lawsuit in Florida.
This is where things started to get weird. The defendant in the lawsuit is an Australian computer scientist named Craig Wright. As followers of the Satoshi saga will know, Wright was the man outed in late 2015 by WIRED and Gizmodo as a likely candidate to himself be Satoshi Nakamoto. Both publications later walked back the stories after it appeared that documents they’d relied upon had been faked and manipulated.
Wright at first declined to address whether he was Satoshi, then attempted to prove he was. He failed to convince most of the bitcoin community, which came to view him as a fraud, pointing to easily discredited proofs he offered in a PR-staged coming-out ceremony. Today he aggressively asserts that he is Satoshi. His company nChain—backed by former online gambling mogul Calvin Ayre—has created an alternative to bitcoin called “Bitcoin Satoshi Vision.”
The lawsuit drawing Paul Le Roux into this morass was filed in 2018 by Ira Kleiman, the brother of Dave Kleiman—Wright’s friend, fellow computer security guru, and business partner who died in 2013. Represented by the powerful law firm Boise Schiller, Ira Kleiman asserts that his brother and Wright mined hundreds of thousands of bitcoins together. Upon Kleiman’s death, Wright is alleged to have transferred Kleiman’s share to himself and his businesses, depriving Kleiman’s estate of digital currency that is today worth billions.
Now to the footnote: This April, Wright’s lawyers filed a motion asking the judge in the case to seal Wright’s responses to certain deposition questions. Wright claimed that the disclosure of these answers, which involved people whom the pair had supposedly helped law enforcement apprehend, could “endanger him and other persons” and “implicate national security concerns.” The names of these people were redacted, as were the footnotes elaborating on Wright’s answers. But his lawyers appeared to have made a mistake, failing to black out a footnote containing links to a news article and a Wikipedia page about one Paul Calder Le Roux.
By the time news of the footnote jumped from message boards to the bitcoin news universe to my inboxes, this sliver of connection—truly, a reed of evidence so slender it could barely be grasped—had magically grown into speculation that Le Roux was Satoshi. Craig Wright must have known Le Roux, the story went, and known that he was the man behind bitcoin—perhaps even collaborated with him. Then, realizing by 2015 that Le Roux was held incommunicado in US custody, Wright began setting himself up as Satoshi, while he and Calvin Ayre set to work cracking the encryption on Satoshi/Le Roux’s stash of original bitcoins. Or something like that. Frankly, it was hard to follow.
Exhausting as the whole thing seemed, ultimately it was a fear of embarrassment that drove me back down the Satoshi hole. What if Le Roux was Satoshi, I began to wonder, and after all my years researching him, someone else proved it? Which outcome was worse: joining the ranks of the humbled speculators or failing to solve the internet’s greatest mystery with the answer right in front of my face? I opened up the Le Roux archive I’d built for the book and started poking around.
Over a few days, I found myself uncovering surprising correlations I’d missed or discounted the first time. After a couple more, I’d built a spreadsheet mapping the evidence for and against the proposition. Within weeks, I’d poured over every piece of writing credibly attributed to Le Roux or Satoshi, and found myself perplexed at the growing size of the “for” column on my spreadsheet. I called up experts, ran my evidence by them, and found no one who could really shoot it down. After a month, I was able to convince a colleague with deep cryptocurrency knowledge, someone who’d followed every twist and turn of the Satoshi saga, that Le Roux was the odds-on solution to the mystery of who created bitcoin.
And then, just as I was ready to go out and publicly place my bet on Paul Le Roux, to make the case for him from everything I’d found, I started to wonder about what I hadn’t.
Paul Le Roux had the technical skills to create bitcoin—that much I’d concluded the first time around. He was an autodidact coder, fluent in a range of languages but particularly in C++, the language of bitcoin’s software. He was knowledgeable in both encryption and networking, with a wide-ranging intelligence that enabled him to develop expertise across an extraordinary number of domains—albeit many of them illegal. “He was such a talented and gifted software developer,” Shaun Hollingworth, a fellow encryption programmer, had once told me. “One of the brightest I have met in a 30-year career in this industry.”
Most relevant to Satoshi was Le Roux’s experience building and disseminating his own software—software that in many ways paralleled bitcoin. In the late 1990s, while working programming jobs by day, he spent nights and weekends coding a complex piece of disk encryption software called Encryption for the Masses, or E4M. In 1999, he announced E4M on a cryptography mailing list, launched a web site at e4m.net to release the open source code, and began patiently answering technical questions and taking suggestions. A more famous successor to E4M called TrueCrypt—which Le Roux has never been directly tied to, but which several of my sources believe he was likely involved in—surfaced in the same manner.
The creation of bitcoin mirrored this approach. Satoshi appears to have worked on the project for years before emerging out of the ether to announce it on the Cryptography mailing list in October 2008, with his now famous white paper. He then released the software on an accompanying web site, bitcoin.org, and spent years patiently answering technical questions and taking suggestions.
When I began trying to compare their writing, Le Roux and Satoshi’s styles seemed to generally line up. Satoshi is widely believed to have been a native English speaker from a British commonwealth country—given his usage and spellings of words like colour—but also occasionally (and inexplicably) employed American syntax. Le Roux was raised in both Zimbabwe and South Africa, resided in Australia for years, but also spent formative time in the US in his early twenties. Some of his relatives recall that he occasionally even put on what seemed to be an American accent.
As I traveled further into the writings, subtler connections seemed to jump out at me, things I’d overlooked years before. There were the emails Satoshi was known to have sent, before releasing bitcoin, to two creators of previous digital currency initiatives. In them he described the project and inquired about the proper way to credit them for their work. This matched correspondence I’d been forwarded from Le Roux to the author of an encryption protocol he planned to use for E4M a decade earlier. The language was different, but the essence felt identical. When I talked to Adam Back, the first of the two digital currency gurus to have received an email from Satoshi, he agreed. “I mean it’s neutral tone—focused to the point of curtness,” he said, after I’d sent him the Le Roux email for comparison. “It just gets right down to it. ‘I’m using your work and I want to cite it correctly.’ It’s pretty similar actually.”
There was, too, a Satoshi forum post describing how “strong encryption became available to the masses,” eerily recalling the moniker of Le Roux’s E4M software. There was an obscure bit of code, buried in the first edition of the bitcoin software, mapping out a basic interface for some kind of online poker application. Le Roux, I knew, had dabbled in the online gambling business for years and had even built his own casino software. (His cousin Mathew told me, years before any of this, that Le Roux was somehow connected to the gambling mogul Calvin Ayre and mentioned trying to obtain a passport for Ayre.) Could the stray code in bitcoin’s software be a hint at the connections that lay underneath?
As I found myself up late into the night, conducting line by line comparisons of software licenses, the skeptical region of my brain told me this was all an exercise in crude pattern matching. But the part that craves a perfect narrative had taken the wheel, and the story was gaining momentum. When I started examining Satoshi’s philosophical and practical motivations for creating bitcoin—namely a distaste for government control, a distrust of the banking system, and a desire for a new way to transact digitally—Le Roux seemed almost scarily perfect. “The one thing about Satoshi is that he did seem to have the weird anti-government bent, these kind of weird economic ideas,” Matthew Green, a researcher at Johns Hopkins who studies encryption and helped create a privacy-oriented cryptocurrency protocol, told me.
In online forums and in the E4M release notes, Le Roux too chafed at government controls—as one might expect from a man who went on to create his own international criminal cartel. Indeed, his experience left him awash in motives to build a digital currency. In the mid-1990s, while living in Australia, he’d complained on one message board that “banks [here] report on everything you do, including cash transactions over a certain amount.” He then became intimately familiar with the inner workings of the global financial world. A copy of Le Roux’s résumé I obtained from a court case (but which was never released publicly) showed that he’d spent years as a contract programmer, hired to implement protocols for international bank transfer systems for banks like Dutch giant ABN AMRO and the Commonwealth Bank of Australia, among other projects.
Soon, he would encounter that system’s digital limitations: As Le Roux’s online pill network grew into a behemoth in the mid-2000s, he faced a constant challenge collecting and moving the millions of dollars flowing in from its customers. He developed elaborate schemes to avoid being shut down by online credit card processors and built a web of shell companies and trusts to avoid detection by banks. He even mused to his cousin about starting a bank of his own, in Manila, to try to circumvent the system entirely. (Instead he transferred tens of millions of dollars into gold, stored in safe houses across Africa and Southeast Asia.)
Everything was adding up. But I needed another kind of confirmation, evidence that Le Roux had ever shown an active interest in digital currency. I contacted a source who had overseen the facilities housing Le Roux’s projects in the Philippines, many of which were quixotic technical endeavors like drones and missile guidance software, developed by programmers (C++ programmers, no less) Le Roux recruited from Eastern Europe. Had Le Roux ever talked about bitcoin, I asked him? “He had a group of Romanian programmers in an office” in Manila, the source messaged back. “They were discussing online currency. This was in 2007-2008 before bitcoin was released.”
When I inquired with another former high-level employee of Le Roux’s, he mentioned something else Le Roux said in the same time frame. “If you want to make money—real money—you need to do like the North Koreans who print it,” he recalled Le Roux saying. “Or just make your own currency.”
Skills, motives, and interest aside, there was something else that kept pushing me toward something like belief in the theory. The fact that Satoshi had remained a mystery at all was due to his extraordinary dedication to anonymity. I knew from my own experience that the tradecraft required to withstand a decade worth of attacks on that anonymity was rare. It was also an ability that Paul Le Roux had cultivated his whole life.
He’d spent years obscuring his identity as his business grew increasingly criminal. He’d sent his employees detailed instructions on the use of encryption, burner emails, and untraceable proxies. He’d built his own encrypted email servers, out of reach government surveillance. He’d operated under multiple identities—some of Le Roux’s trusted employees didn’t even know his real name—and carried a fistful of fake passports.
One of those identities was the source of a tenuous but alluring connection to Satoshi: a diplomatic passport from the Democratic Republic of Congo. Le Roux, hoping to protect himself with a cloak of state immunity, had schemed for years to obtain diplomatic passports. He’d finally gotten one from the DRC, issued in the name “Paul Solotshi Calder Le Roux.” Solotshi-Satoshi: The two aliases had the ring of connection, as online commenters had noted back when I published a copy of the passport in 2016.
Perhaps Le Roux had reused a variation of his bitcoin alias? I’d discounted the “Solotshi coincidence” at the time, partly because I’d actually interviewed one of two employees who’d traveled into the DRC with $100,000 in cash strapped to their chests, payment for a corrupt official. Le Roux, the employee told me, hadn’t even picked the moniker “Solotshi.” It was likely a Congolese name, selected by the official to add legitimacy to the passport.
Reconsidering the passport now, however, I wondered if I’d been thinking about it backwards. What if this random Congolese name had in fact spawned Satoshi, not the other way around? Perhaps when Le Roux had searched for a name to launch his new project anonymously, he’d just tweaked the one off his treasured diplomatic passport to make it sound fully Japanese. I looked again at the date on the passport: It was issued in August 2008, two weeks before Satoshi first contacted Adam Back.
This was when the narrative momentum toward Satoshi began to become unstoppable in my mind. Just as Le Roux’s story seemed to fit with Satoshi’s arrival, and with his methods, so too could it explain the mystery of his departure. Satoshi disappeared from the bitcoin forums in December 2010, shortly after WikiLeaks—over Satoshi's public objections—began accepting donation in bitcoin. “WikiLeaks has kicked the hornet’s nest, and the swarm is headed towards us,” Satoshi famously posted in one of the final public missives. It made sense to be concerned about the negative attention focused on the fledging currency. But why would Satoshi disappear entirely from the forums?
Le Roux would have had more reason than most to fear the attention that WikiLeaks might bring. By that point he knew from paid moles inside the US embassy in Manila that the American government was on his trail. And the end of 2010 was a busy time for Le Roux: That same month, he arranged the murder of three of his employees, including his top deputy, and helped dump the bodies at sea.
Satoshi was last heard from in mid-2011. (A forum post initially attributed to Satoshi had appeared in 2014, but it is now widely viewed in the community as the product of a compromised email address that once belonged to Satoshi.) Bitcoin's creator had handed off most of the responsibilities by then to, among others, Gavin Andresen, a Massachusetts software developer. “I’ve moved on to other things,” Satoshi wrote to another bitcoin developer. “It’s in good hands with Gavin and everyone.” When Andresen wrote to Satoshi in April that he planned to give a talk at the CIA explaining bitcoin, Satoshi stopped responding for good. If there was one figure more inclined than anyone to shut things down at the first mention of the CIA, it would have been Paul Le Roux.
By this point in my examination, I was walking around with Satoshi’s timeline running through my head in a loop, like some cryptocurrency earworm. When a stranger at a friend’s birthday party innocently asked me what I was up to, I launched into an exegesis on the mystery. “You see, Le Roux’s 2012 arrest would clear up one of the most intriguing questions surrounding Satoshi,” I said, as my listener inched his way toward the bar. “Why has no one ever moved or spent the 1 million bitcoins mined at the beginning?”
It was true, though, if you thought about it: The assumption has always been that Satoshi must have been a figure or group with no need or desire for money, or that they had taken the stash’s private keys to the grave. Le Roux offered a third option. In September 2012, Satoshi’s coins would have been worth around $12 million, a marginal amount to Le Roux at a time when it would have been nearly impossible to exchange that amount of bitcoin for hard currency. And then, without notice, Le Roux was locked away, captured in a sting operation and unable to access the private keys to a fortune that would be useless to him for years anyway.
I’m a journalist, of course, and I wasn’t just going to be swayed by the robustness of a column on a spreadsheet. So I dutifully turned to address the cons I’d noted along the way. There was, for instance, the academic-sounding language in the original bitcoin white paper, which didn’t fit with Le Roux’s self-taught, distinctly non-academic and informal style. But white papers are often issued in the commercial world as well, and Le Roux was clearly steeped in academic cryptography work, dating back to his release of E4M.
There were smaller, niggling questions too: In one of the many previous attempts to identify Satoshi, a reporter noted that the writings almost universally employ two spaces after a period—a relatively ingrained habit for any writer. In all the Le Roux writings I’ve seen, by contrast, he uses one. Satoshi wrote “sourcecode” where Le Roux called it “source code.” But then I found a smaller set of Satoshi writings that did use a single space after a period. Perhaps Satoshi sometimes wrote messages in an editor that autocorrected spaces in one direction or another. Or perhaps Le Roux did.
I noted some mild philosophical differences between them, like Satoshi once suggesting offhandedly that bitcoin could be a solution to spam. Le Roux, in the service of his online pill network, was at the time among the planet’s most prolific spammers. But Le Roux also contained multitudes—I’d heard from a relative that he long secretly dreamed of being a travel writer, for God’s sake. At the very least he wasn’t above proposing a solution to a problem he himself created.
None of it stacked up against the ways in which Le Roux and Satoshi seemed to mesh, the ways that being the same person seemed to explain so much about them both. That included perhaps the weirdest recent twist of Le Roux’s story, his connection to a hacker from a notorious group UGNazi named Mir Islam. A serial swatter and general purveyor of online mayhem who was imprisoned for credit card fraud, Islam was housed with Le Roux for months at the same facility in New York. After Islam was moved to another facility, Le Roux was caught plotting with him by phone (with the help of a paralegal) to reopen his businesses in the Philippines. Islam was released in May 2018. Then, as far as the authorities were concerned, he disappeared.
In the fall of 2018, however, Islam contacted me via secure chat and told me that he had indeed moved to Manila and was at work on “crypto projects” he’d discussed with Le Roux. He now referred to Le Roux as his "father.”
We conversed for several weeks, and Islam told me that he was laying the groundwork for Le Roux’s eventual release. I noted that he should be cautious operating in Le Roux’s circles in the Philippines. “The wrong people there will kill you for nothing,” I said.
“Yes, people will kill for nothing,” he said. “But that works both ways.”
Two days later, he and another former UGNazi member were discovered dumping the body of the other man’s American girlfriend into a Manila canal. (Islam is currently awaiting trial for murder and has given shifting accounts of the bizarre events.)
Looking back at our conversation, there was something that caught my eye in Islam’s comments, an assertion that I’d never understood “the real reason why Paul did everything he did,” as Islam put it. “It wasn’t for fame nor was the end goal about just money.”
“So what was the reason?” I asked him.
“To prove he could do it, and boredom,” he said. “There’s a lot of things you haven’t figured out yet.”
A month into my full Satoshi immersion, I was still idly scanning through the same lists of domain registration and forum posts I’d looked at three times already. I felt as if I was on the brink of sealing up the case, of finding that last piece of evidence that would drop perfectly into place. But it never came. So I called Gregory Maxwell, a respected bitcoin core developer and the cofounder of the blockchain company Blockstream. He patiently tolerated my rehashing of the Satoshi matter. “I sometimes am a little irritated by the public drama about it,” he said. “Because, fundamentally, the whole design and concept of bitcoin is that it doesn’t matter who Satoshi is.”
Still, he volunteered to run a comparison between some of the code in Le Roux’s E4M and the original bitcoin software. The two programs used “different (and somewhat unusual) formatting style[s],” Maxwell emailed me afterward—like using tabs to indent instead of spaces, or separating functions in different lines. E4M, he said, contained more extensive comments explaining the reasoning behind Le Roux’s choices than Satoshi included in bitcoin. On a number of highly technical fronts, Maxwell found that the two code bases diverged in their approach to certain computing and cryptography questions—how random numbers are generated, for instance—common to both E4M and bitcoin.
Ultimately, though, Maxwell was left without clear evidence in either direction. “I don't see anything that stands out as saying these couldn’t have been written by the same person (especially separated by a decade),” he wrote. “Nor do I see any similarity that wouldn’t also be true for many other authors and codebases. At a minimum, however, if they were written by the same person that person’s styles changed a lot (either due to time or intentionally hiding them).” Read one way, Maxwell was tacitly supporting the idea that Le Roux was a possible Satoshi. But it was the phrase “wouldn’t also be true” that stopped my narrative momentum cold.
I suddenly realized that Maxwell had, in that single phrase, exposed the grand logical fallacy underlying all the “evidence” I’d amassed in my spreadsheet. Namely, that because Le Roux so clearly could be Satoshi, he was therefore more likely to be. Missing from that equation was a calculation of all possible people who could also be Satoshi. There were untold numbers of programmers who were adept at C++ and hated government, who felt a responsibility to credit other coders and used the phrase “encryption for the masses,” who had reasons to stay anonymous and expressed some interest in digital currencies. To prove anything about Le Roux via my technique, I’d have to disprove dozens, perhaps hundreds, of equally likely candidates.
What my narrative was lacking—just as it had been the first time, years ago—was any single fact that couldn’t be explained away by coincidence. There was no document tying Le Roux’s email to the bitcoin forum. No sign that Le Roux, who maintained countless identities and emails, ever once used the services .gmx or vistomail—home to Satoshi’s two known email addresses. No Satoshi IP address that pointed to Le Roux’s Manila headquarters. Not even a suggestion by Le Roux, who ran one of the world’s largest pharmaceutical networks, that a single one of his thousands of online storefronts accept bitcoin as a way out of his payment troubles. I could spend more weeks, months, years looking for those proofs, and I might never find them. Because if he wasn’t Satoshi, they didn’t exist.
Once the narrative was pierced, I started to see dozens of flaws, in the same way I’d once seen nothing but connections. Even the logical inferences that I’d once matched up so carefully seemed to fall apart on further reflection. Why would Le Roux bother having Mir Islam restart his businesses, when he had $10 billion waiting for him on the outside? And what was the real significance of that footnote, the supposed lawyer error that landed us here in the first place?
There was something supremely odd in Craig Wright’s mention of Le Roux, to be sure. But why believe him at all? He’s been accused in the case of forging and then withdrawing evidence submitted to the court. Wright declined to comment for this article, as did both his and Kleiman’s lawyers. As for Ayre, he said of Le Roux through a spokesperson, “I have not met this guy and never heard his name until I saw it in an article in the last week.” My law enforcement sources on the Le Roux case claimed to never have heard of either man, in any Le Roux context.
That, in the end, was the problem with starting a search with a conclusion already in mind. I could—I almost inevitably would—cherry pick the facts that aligned in its service. Because it would be so satisfying to discover that Le Roux really had done it all—that he’d been the criminal to end all criminals. I knew that feeling: When I’d started reporting on Le Roux, nobody believed a criminal kingpin was behind E4M and TrueCrypt, either. And what could be a more delectable end to the mystery of bitcoin’s origins—at least for someone like me, who doesn’t own any—than to discover that the figure behind it was, as Adam Back mused to me, “a Breaking Bad-type Satoshi.”
But the thrills of speculation—of lining up the stories to see that they match—are easier than the slogs of forensic proof. Even in the time it took me to write this story, another Satoshi suspect had emerged: an Irish cryptographer who’d spent time in Japan. I asked my bitcoin-expert colleague again how he viewed Le Roux as Satoshi. “I still think he’s the odds-on favorite,” he said. “Even if those odds are like 2 percent. I’m basically convinced as I can be without proof.”
It’s often said that there is really only one way to verify Satoshi, and that’s for the person or persons behind the name to come forward and then use Satoshi’s private keys to move, spend, or cryptographically sign the original blocks of bitcoins. Paul Le Roux is scheduled to be sentenced in federal court this August, and if he is Satoshi, it’ll be anywhere from three years to life before he’d be able to do any of that. But would it really convince anyone now? An alternate explanation would instantly emerge—the keys had been stolen or lost, or the presumptive Satoshi had worked some trickery. “It doesn’t matter what the truth is, it’s not going to be as grand as what people imagine,” Laszlo Hanyecz, one of the early bitcoin developers who communicated with Satoshi for years, told me recently. “To be realistic, I guess we are never going to know. Even if the person, people, whatever—even if Satoshi comes back, it’s going to be like Jesus. Nobody is going to believe him, right?” After a decade of false prophets, we've fooled ourselves too many times.