Bitcoin Network Observations

Bitcoin is an open peer-to-peer network that allows for a variety of behaviors among network participants. I’ve been monitoring the Bitcoin network for a few years now and started documenting my observations. The goal is to educate and inform about some of the weird activity happening in the Bitcoin network.

For more observations, have a look at the forum of the Bitcoin Network Operations Collective.

Observations

June 24, 2025

Notes on 'DoS due to inv-to-send sets growing too large' from May 2023

In October 2024, the Bitcoin Core project disclosed a Denial-of-Service due to inv-to-send sets growing too large, which I authored, for Bitcoin Core …

March 12, 2025

Invalid mining jobs by AntPool & friends during forks

Looking deeper into @boerst’s recent observation about invalid mining jobs by AntPool & friends to discuss his hypothesis about …

January 16, 2025

Fifteen OFAC-sanctioned transactions missing from blocks

My miningpool-observer project aims to detect when Bitcoin mining pools are not mining transactions they could have been mining. Over the past few …

September 16, 2024

Block Template Similarities between Mining Pools

Different mining pools sending out the same or a similar block template to miners is an indicator for proxy pooling. Knowing about proxy pools is …

April 2, 2024

Invalid F2Pool blocks 783426 and 784121 (April 2023)

My notes on the two bad-blk-sigops: too many sigops invalid blocks, 783426 and 784121, mined by F2Pool in April 2023.

March 18, 2024

ViaBTC's mutated blocks without witness data

I noticed multiple ERROR: AcceptBlock: bad-witness-nonce-size errors in the debug log of my Bitcoin Core node. These indicate that a block my node …

January 29, 2024

An overview of recent non-standard Bitcoin transactions

This blog post provides an overview of non-standard transactions that mining pools included in the last 117000 Bitcoin blocks.

November 20, 2023

Six OFAC-sanctioned transactions missing

My project, miningpool-observer, aims to detect when Bitcoin mining pools are not mining transactions they could have been mining. Over the past few …

September 28, 2023

Invalid MARAPool block 809478

Notes on the invalid Bitcoin mainnet block at height 809478 mined by experimental, in-house MARAPool mining pool software on September 27, 2023.

March 28, 2023

LinkingLion: An entity linking Bitcoin transactions to IPs?

This post describes and discusses the behavior of an entity I call LinkingLion. The entity opens connections to many Bitcoin nodes using four IP …

November 16, 2022

Inbound Connection Flooder Down (LinkingLion)

Over the past few months, I’ve repeatedly observed very short-lived P2P connections with fake user agents being made to my Bitcoin Core node in …

August 24, 2022

P2TR spending transactions missing from F2Pool and AntPool blocks (2021)

My miningpool-observer project aims to detect when mining pools don’t mine transactions they could have mined. Right after taproot activation, …

July 13, 2020

Following the Blockchain.com feerate recommendations

Transactions sent with Blockchain.com wallets make up for about a third of all Bitcoin transactions. A methodology to identify these transactions is …

May 4, 2020

The daily BitMEX broadcast at 13:08 UTC

At around 13:00 UTC every day, BitMEX, a cryptocurrency exchange and derivative trading platform, broadcasts multiple megabytes of large transactions …

April 27, 2020

The stair-pattern in time-locked Bitcoin transactions

Some of the regularly used Bitcoin wallets, for example, the Bitcoin Core wallet and the Electrum Bitcoin Wallet, set the locktime of newly …