Bitcoin Network Observations

Bitcoin is an open peer-to-peer network that allows for a variety of behaviors among network participants. I’ve been monitoring the Bitcoin network for a few years now and started documenting my observations. The goal is to educate and inform about some of the weird activity happening in the Bitcoin network.

Recent observations

Image for Invalid F2Pool blocks 783426 and 784121 (April 2023)

April 2, 2024

Invalid F2Pool blocks 783426 and 784121 (April 2023)

My notes on the two bad-blk-sigops: too many sigops invalid blocks, 783426 and 784121, mined by F2Pool in April 2023.

Image for ViaBTC's mutated blocks without witness data

March 18, 2024

ViaBTC's mutated blocks without witness data

I noticed multiple ERROR: AcceptBlock: bad-witness-nonce-size errors in the debug log of my Bitcoin Core node. These indicate that a block my node received is invalid and not accepted. It turned out that these are ViaBTC’s blocks, broadcast by their mining pool software, where transaction …

Image for An overview of recent non-standard Bitcoin transactions

January 29, 2024

An overview of recent non-standard Bitcoin transactions

This blog post provides an overview of non-standard transactions that mining pools included in the last 117000 Bitcoin blocks.

Image for Six OFAC-sanctioned transactions missing

November 20, 2023

Six OFAC-sanctioned transactions missing

My project, miningpool-observer, aims to detect when Bitcoin mining pools are not mining transactions they could have been mining. Over the past few weeks, it detected six missing transactions spending from OFAC-sanctioned addresses. This post examines whether these transactions were intentionally …

Image for Invalid MARAPool block 809478

September 28, 2023

Invalid MARAPool block 809478

Notes on the invalid Bitcoin mainnet block at height 809478 mined by experimental, in-house MARAPool mining pool software on September 27, 2023.

Image for LinkingLion: An entity linking Bitcoin transactions to IPs?

March 28, 2023

LinkingLion: An entity linking Bitcoin transactions to IPs?

This post describes and discusses the behavior of an entity I call LinkingLion. The entity opens connections to many Bitcoin nodes using four IP address ranges and listens to transaction announcements. This might allow the entity to link newly broadcast transactions to node IP addresses. The entity …

Image for Inbound Connection Flooder Down (LinkingLion)

November 16, 2022

Inbound Connection Flooder Down (LinkingLion)

Over the past few months, I’ve repeatedly observed very short-lived P2P connections with fake user agents being made to my Bitcoin Core node in a high succession. This morning around 7:00 am UTC, these abruptly stopped.

Image for P2TR spending transactions missing from F2Pool and AntPool blocks (2021)

August 24, 2022

P2TR spending transactions missing from F2Pool and AntPool blocks (2021)

My miningpool-observer project aims to detect when mining pools don’t mine transactions they could have mined. Right after taproot activation, it caught that F2Pool and AntPool didn’t mine P2TR (Pay-to-Taproot) spending transactions. This post is a write-up of this observation.

Image for Following the Blockchain.com feerate recommendations

July 13, 2020

Following the Blockchain.com feerate recommendations

Transactions sent with Blockchain.com wallets make up for about a third of all Bitcoin transactions. A methodology to identify these transactions is described and used. Insights about the wallet-usage are derived from the resulting dataset. The privacy implications and possible improvements are …

Image for The daily BitMEX broadcast at 13:08 UTC

May 4, 2020

The daily BitMEX broadcast at 13:08 UTC

At around 13:00 UTC every day, BitMEX, a cryptocurrency exchange and derivative trading platform, broadcasts multiple megabytes of large transactions into the Bitcoin network. This affects the transaction fees paid during European afternoons and US business hours. The transaction size could be …

Image for The stair-pattern in time-locked Bitcoin transactions

April 27, 2020

The stair-pattern in time-locked Bitcoin transactions

Some of the regularly used Bitcoin wallets, for example, the Bitcoin Core wallet and the Electrum Bitcoin Wallet, set the locktime of newly constructed transactions to the current block height. This is as an anti-fee-sniping measure and visible as a stair-like pattern when plotting time-locked …