Miner’s deal

November 13, 2015

I’ve been working full time on Bitcoin related products for the last 2 years and every day I’m more fascinated by things I figure out, however some of them are mostly speculation and not really facts for now.

My take on this graph

On November 12th, 2015 between 17:17 to 19:17 EST this spike happened deep in bitcoin network, The things I get from seeing these graphs are as follows (from bottom-up):

Looking at the % Transaction Inputs vs Outputs, it shows that the number of inputs in the transactions were way higher than the number of outputs. This also happens when there’s spam attacks going on to fill up the mempool. Or when there are lots of Bitcoin ,that was splitting into chunks before, are being gathered together again.

Looking at Bytes Per Transaction proves the above statement.

Looking at Transaction Fees (satoshis) Paid Per Kilobyte shows that on that period the transaction fees (a.k.a miner’s fee) were really low. So basically low fee transactions specially with too many inputs would be categorized as low priority and with the recent patches on Bitcoind, some nodes might actually reject these transactions and prevent them from propagation. This is how transaction priority is calculated:

priority = sum(input_value_in_base_units * input_age)/size_in_bytes This could also be because there are too many P2SH (a.k.a multisig) transactions were happening, but because of the results from % Transaction Inputs vs Outputs, probability of this is low. Or also lots of P2SH inputs on lots of transactions ?



Looking at Transactions Accepted vs Rejected for that period shows that there were high ratio of accepted transactions. This usually means everything’s super great, however with the recent ongoing malleability attacks and spam attacks here or there, this is suspicious. It could be that right at that time the attacker stopped his attacks and then started again. <- I doubt this one, just a guess It could be that either it was a miner(s) doing the transactions and including them in their mined blocks or miner(s) are accepting someone else’s low priority transactions in return for maybe a fee.



Proof?

Ok let’s see if we can find something:

There are some almost full blocks on that time period, but it’s not anything weird these days.

Let’s go deeper in block 383283 (mined by Unknown).

While just going through the transactions, I saw some pattern like transactions such as 16~25 inputs and 20~21 outputs (e.g, abdc70074bbcf4c32bff29b0e5d6beebc062e6fabbac837fa489fa088aa7ebe9)

and with the help of blockseer, I saw that there’s definitely a pattern going on there.

Not sure if it’s related or not, after traversing up this weird intertwined tree, I got one address labeled as NUCLEUS MARKET.

let’s continue in the blocks. yup more and more of these transactions and most of them with high amounts of Bitcoin. Some examples:

Most of them have 21 outputs, some 20. These transactions most probably are a generated by a tumblr, bitcoin laundering service or maybe just some automated scripts.

Some examples of their transaction size vs transaction fee:

40000 / 2.9 Kb (2941 Byte) = 13333 satoshi/Kb 50000 / 3.5 Kb (3528 Byte) = 14285 Satoshi/Kb

So these are exactly the transactions that made the dump in Transaction Fees (satoshis) Paid per Kilobyte graph.

Now on Block 383284 (Mined by Antpool)

There is not even one transaction which follow the 21-output transaction characteristics (yeah I went through 2632 transactions manually to be sure!)

There are some huge P2SH transactions though: 3e3d5817092b91c88cab80fb9e142a0ef46728090414c088c1f610d0d4792480, 7709609eb5ea042cc4e60e260a11e51bfb8c5f1fda037a94155634ad90400325

and also 87 inputs to 2 outputs: 639deafdcb68bd314765fa4580cad83b397eb7d30c3cb033ce74b0874afd3f19

and a lot more big transactions that is coming from BTCChina (don’t ask how I know, I just figured that out and I’m pretty sure.) AntPool and BTCChina, Eh? probably a deal to include their transactions.

Block 383285 (Mined be AntPool)

My guess is that there would be no 21-output like transactions. let’s see…

found one! 54dfa0a554dc1b43d8a38b2f0ac272feb20da5ad7ecf42216fa01138d104008f

and another one: 40162707f99cc0f1dc4f35c9dc372a9df5c7bc0677ec68acc708bac8434fde68

one more, my guess was totally wrong: 96219ae83845e43e87778e22e58f21d84e9385a023abe2500dc921ee7e843829

Another huge 28-inputs, 3-outputs P2SH transactions: 83a3b1b5f9433dad608a3cde601bf43cea8985cc229982c5f80fc0126adf053f

By experience I’d say this P2SH transaction was generated by BitGo, and probably is for an exchange that is using them as their Multisig HD wallet.

Here is a localbitcoins transaction in that block: 21635217b344560004b96f79e5c2939fefb114c69132cf21a3b2840432402158

There seems to be not that many of 21-output like transactions, I’m gonna stop checking this block and go to next ones, cause it seems like AntPool has its own partners. but this would make my initial assumptions weaker I guess.

Block 383286 (Mined be BitFury)

12~13-inputs 501-outputs FAUCETBOX.COM transactions: 5a43e3fd6b4e9c16df9a80891961101c6b9e2f230ce1da5b323faf5f81e60fc7, e1a2ca799d27409e88256aee65c072ae4deaa24a84a96303611cd4391b85d79d

There are a lot more of these faucetbox transactions, mostly have 500+ outputs, and apparently Faucetbox and bitfury have a deal, just by checking the fees that are really low.

83519 / 18.7 = 4466 Satoshi/Kb 80580 / 17.9 = 4501 Satoshi/Kb

Note: by Bitcoinfees estimation, if transaction has 5000 Satoshi/Kb it would take more than 60 minutes to confirm.

21-output transactions yeeey:

46dbb437e45abc2d4bdc32eef60c5eead0b26d4730340fa1246a592f9b3489b0,

nope I guess that was all. whoever is behind 21-output like transactions is, has a deal with the miner that was named Unknown. So I guess I ended up empty handed on that subject.

Some huge transactions (500+inputs) with medium to low fees, that are most probably in contract with Bitfury to get confirmed, not sure about the identity though:

20e24e1cd0feb4bbc926fbc500cc1465674d015d69eb100d8922a80e0a6746f4, 6198d7a0ec113ab5a83a8fc2a2fc9024b7d26c4cd34df4fa2e84b4fc6eba63b1

So My plan when I started writing this post was to figure out why that jump happened on the graphs, but somehow ended up just figuring out some random stuff about each block and miner/”company” relationship.

I haven’t slept in the last 48 hours, so feel free to call out my bullshit anywhere here.

would be happy to discuss any of the assumptions and hear yours.

Cheers

Share this: Facebook

Reddit

Twitter

LinkedIn

Print

