Bitcoin Network Observations

Bitcoin is an open peer-to-peer network that allows for a variety of behaviors among network participants. I’ve been monitoring the Bitcoin network for a few years now and started documenting my observations. The goal is to educate and inform about some of the weird activity happening in the Bitcoin network.

Recent observations

Image for LinkingLion: An entity linking Bitcoin transactions to IPs?

March 28, 2023

LinkingLion: An entity linking Bitcoin transactions to IPs?

This post describes and discusses the behavior of an entity I call LinkingLion. The entity opens connections to many Bitcoin nodes using four IP address ranges and listens to transaction announcements. This might allow the entity to link newly broadcast transactions to node IP addresses. The entity …

Image for Inbound Connection Flooder Down (LinkingLion)

November 16, 2022

Inbound Connection Flooder Down (LinkingLion)

Over the past few months, I’ve repeatedly observed very short-lived P2P connections with fake user agents being made to my Bitcoin Core node in a high succession. This morning around 7:00 am UTC, these abruptly stopped.

Image for P2TR spending transactions missing from F2Pool and AntPool blocks (2021)

August 24, 2022

P2TR spending transactions missing from F2Pool and AntPool blocks (2021)

My miningpool-observer project aims to detect when mining pools don’t mine transactions they could have mined. Right after taproot activation, it caught that F2Pool and AntPool didn’t mine P2TR (Pay-to-Taproot) spending transactions. This post is a write-up of this observation.

Image for Following the Blockchain.com feerate recommendations

July 13, 2020

Following the Blockchain.com feerate recommendations

Transactions sent with Blockchain.com wallets make up for about a third of all Bitcoin transactions. A methodology to identify these transactions is described and used. Insights about the wallet-usage are derived from the resulting dataset. The privacy implications and possible improvements are …

Image for The daily BitMEX broadcast at 13:08 UTC

May 4, 2020

The daily BitMEX broadcast at 13:08 UTC

At around 13:00 UTC every day, BitMEX, a cryptocurrency exchange and derivative trading platform, broadcasts multiple megabytes of large transactions into the Bitcoin network. This affects the transaction fees paid during European afternoons and US business hours. The transaction size could be …

Image for The stair-pattern in time-locked Bitcoin transactions

April 27, 2020

The stair-pattern in time-locked Bitcoin transactions

Some of the regularly used Bitcoin wallets, for example, the Bitcoin Core wallet and the Electrum Bitcoin Wallet, set the locktime of newly constructed transactions to the current block height. This is as an anti-fee-sniping measure and visible as a stair-like pattern when plotting time-locked …