What you’re about to read is the result of months of dedicated on-chain investigation, tracing thousands of transactions across Bitcoin’s earliest history, reconstructing dormant wallet clusters, following the original mining rewards, and comparing those movements with institutional transactions, corporate filings, and capital raises. What happened during this period changed Bitcoin forever, because some of the oldest and most historically significant supply in existence suddenly became active, moved through institutional channels, and ultimately changed hands on a scale the market had never experienced before.
Nine months ago, I sat down with an on-chain investigator from OnChain School to trace approximately 80,000 Bitcoin that had suddenly moved out of eight wallets nobody had touched since 2011. At the time, I called it one of the biggest systemic risks to Bitcoin that nobody was talking about, and I stand by that assessment because coins from this period represent a type of supply that the market had effectively treated as permanently dormant for more than a decade. I tried to warn everyone that what we were seeing could extend far beyond those eight wallets, with potentially hundreds of thousands of dormant Bitcoin becoming active and creating an enormous source of supply for the market. What followed was also one of the most difficult periods of my career.
My YouTube and TikTok accounts faced enforcement actions, and shortly afterward I lost my X account, where I had built an audience of approximately 200,000 followers.
Back then, I was the most influential XRP account on Twitter, having already contributed several major investigations to the crypto space. For years, I was able to publish this research without facing anything remotely comparable. It seemed the system was willing to leave me alone until I started digging deeply into Bitcoin and questioning the origin, concentration, and movement of its earliest supply.
The problems really started when I decided to share the on-chain investigation I am about to present, and it began gaining so much traction that my account eventually ranked #8 globally in the Bitcoin category on Twitter, ahead of major players in the industry, including Michael Saylor.
And this is where the nightmare really began. During the same period, I received a security warning directly from Google stating that government-backed attackers were attempting to steal my password. At the same time, the 80,000 BTC investigation was spreading rapidly, while I was facing enforcement across several of the platforms where I had spent years building my audience.
The consequences were not limited to losing my reach and the platforms I had spent years building. Between the revenue lost after losing access to those audiences and the substantial legal fees I incurred trying to defend and recover my accounts, the financial damage is now approaching seven figures. The personal and financial cost of what followed this investigation has been enormous.
What I did not have back then was the second half of the story: what happened to those Bitcoin after they left the original wallets, who facilitated their sale, and most importantly, who was on the other side of the trade. We now know that Galaxy Digital facilitated the sale of more than 80,000 BTC on behalf of what the company described as a Satoshi-era investor, but the identity of the buyer was never publicly disclosed.
I went back into the data because what happened after July 2025 deserves much more attention than it received. Once you place the movement of these dormant coins next to Galaxy Digital’s confirmed sale and Strategy’s publicly disclosed capital raises and Bitcoin purchases, a very unusual timeline begins to emerge.
On July 4, 2025, we identified what appears to be only one part of a much larger movement of dormant Bitcoin. The eight wallets widely reported by the media controlled slightly more than 80,000 BTC, but our investigation identified multiple separate tranches of approximately 80,000 dormant BTC, pointing to a combined amount potentially reaching into the hundreds of thousands of Bitcoin, or millions. These coins originated from Bitcoin’s earliest years and had remained virtually untouched for more than a decade, which makes the scale of the activity far more significant than the single 80,000 BTC transaction that received public attention. The 80,000 BTC sold through Galaxy Digital therefore represents the tranche we can publicly trace and document, rather than necessarily the full extent of the dormant supply we identified.
The eight addresses associated with the movement were
1f1miYFQWTzdLiCBxtHHnNiW7WAWPUccr, 1BAFWQhH9pNkz3mZDQ1tWrtKkSHVCkc3fV, 1ucXXZQSEf4zny2HRwAQKtVpkLPTUKRtt, 14YK4mzJGo5NKkNnmVJeuEAQftLt795Gec, 1CPaziTqeEixPoSFtJxu74uDGbpEAotZom, 1P1iThxBH542Gmk1kZNXyji4E4iwpvSbrt, 1KbrSKrT3GeEruTuuYYUSQ35JwKbrAWJYm 12tLs9c9RsALt4ockxa1hB4iTCTSmxj2me.
The address 1f1miYFQWTzdLiCBxtHHnNiW7WAWPUccr for example, received its Bitcoin through multiple transactions on April 4, 2011, including several small inputs and one significantly larger transfer of approximately 3,558 BTC. The MetaSleuth trace shows these separate inputs converging into the same address, illustrating how the position was originally accumulated during Bitcoin’s earliest years. This is important because the roughly 10,000 BTC that eventually sat dormant in this wallet did not suddenly appear in 2025, but the on-chain history traces its accumulation back to 2011, before remaining untouched for roughly fourteen years.
The Spent Output Age Bands data shows why this event was historically significant. When approximately 80,000 BTC that had remained dormant for more than a decade suddenly moved, the 10+ year age band produced a spike unlike anything previously recorded in Bitcoin’s history. There had been other major movements of ancient supply, including the visible spike in 2024 associated with the redistribution of Bitcoin connected to Mt. Gox, but even that event was not remotely comparable in this specific age cohort. The July 2025 movement stands almost vertically above the historical baseline, confirming that this was not simply another large whale transaction, but an unprecedented activation of Bitcoin supply that had effectively remained outside the liquid market for more than a decade.
The MetaSleuth analysis above maps the eight dormant Bitcoin addresses involved in the July 4, 2025 movement, with each wallet transferring approximately 10,000 BTC into a new address within hours of the others. The eight wallets collectively moved slightly more than 80,000 BTC. The fact that eight similarly sized positions moved within the same narrow time window is important because it strongly suggests coordinated control rather than eight unrelated early holders independently deciding to move approximately $1 billion each on the same day. This 80,000 BTC cluster is the tranche that can be traced through the subsequent transactions discussed below, and it provides the on-chain foundation for following what happened to these dormant coins afterward.
The origin of these coins is important because the eight wallets shown above are consolidation wallets, in yellow, not the original source of the Bitcoin. Looking only at those addresses can therefore give an incomplete picture of the age of the holdings. When we trace the transactions backward through the consolidation process, we find that the Bitcoin feeding these wallets had last moved on April 2, 2011, when Bitcoin was still trading for less than one dollar. The coins were subsequently consolidated into the addresses shown above and ultimately remained dormant for approximately fourteen years before moving again in July 2025. We are not simply measuring the age of the final wallet addresses, but we are tracing the underlying Bitcoin through its transaction history to establish when those coins were last economically active.
The initial movement did not prove that a sale was taking place. Arkham Intelligence suggested at the time that the owner could simply have been upgrading wallet security by moving Bitcoin from legacy addresses into modern SegWit addresses, which was a completely reasonable interpretation because an on-chain transfer only demonstrates that ownership controls moved the coins, not that the beneficial owner changed.
Native SegWit addresses, which begin with “bc1,” are generally more efficient and offer technical advantages over older legacy addresses, so moving dormant Bitcoin from addresses beginning with “1” into native SegWit wallets could reasonably be interpreted as a wallet modernization or security-related migration. However, Final 4 immediately breaks that pattern. Unlike the other destination wallets, Final 4 begins with “1,” meaning it is still a legacy P2PKH address rather than a native SegWit address. If the purpose of these coordinated movements was simply to upgrade all of the old wallets to native SegWit, this exception does not fit that explanation.
The transaction history confirms the provenance of this 10,000 BTC position. The consolidation wallet received approximately 10,000 BTC from an address tracing back to April 2, 2011, before the position remained dormant for roughly fourteen years and was finally moved again on July 4, 2025.
The origin of these Bitcoin is relatively easy to trace on-chain because the transaction history eventually leads directly back to coinbase mining rewards from 2010, placing the coins within the very earliest period of Bitcoin’s existence. At the time, each block rewarded miners with 50 BTC, and the MetaSleuth analysis shows multiple 50 BTC tranches originating directly from coinbase transactions between September 2010 and February 2011. These individual mining rewards were later moved and progressively consolidated into larger balances, eventually contributing to the enormous positions identified in our investigation. This provenance is important because it establishes that we are not simply dealing with Bitcoin purchased cheaply on an exchange years later, but the transaction paths shown here originate directly from early mining rewards, when Bitcoin’s network was still in its infancy and only a relatively small population of miners was participating.
This part of the investigation was relatively simple because there were only a limited number of transactions separating the 80,000 BTC wallets from their original source. By tracing each transaction backward, we were able to follow the coins through the consolidation wallets, then through a small number of intermediate addresses, until the trail eventually reached coinbase mining rewards from 2010 and early 2011. At that time, Bitcoin miners received 50 BTC for every block mined, which is exactly what appears on the left side of the board: individual 50 BTC rewards that were gradually moved through early addresses and consolidated into increasingly larger positions.
The important point is that the wallets holding approximately 10,000 BTC were not the original source of these coins; they were simply the final consolidation wallets. Following the history further back shows that at least the transaction paths reconstructed here originated from very early Bitcoin mining rewards, with relatively few on-chain steps separating the original mined coins from the enormous balances that eventually remained dormant until July 2025.
But this is where the biggest part of the mystery begins. Once we move beyond the initial consolidation of the wallets above and start tracing the remaining funds, which represent the majority of the Bitcoin we identified, the transaction history begins showing a strange and unusually structured pattern. The Bitcoin is repeatedly divided, recombined and routed through multiple intermediate addresses THOUSANDS OF TIMES, before eventually forming the large balances we identified. This level of transaction organization is particularly interesting considering that the activity occurred in 2011, when Bitcoin infrastructure was still extremely primitive and the sophisticated blockchain analytics, automation and transaction-management tools available today simply did not exist. None of this tells us who controlled these wallets, but the deliberate structure and repetition of these early movements is unusual enough that we need to follow this part of the trail much deeper.
Here you can see a large balance is systematically divided across multiple addresses and then reconsolidated before continuing through the chain. Instead of simply moving Bitcoin from one wallet to another, the funds follow a highly organized sequence of splits and merges, creating multiple layers between the original coins and their eventual destination. This type of pattern is implemented to make the origin and subsequent flow of the funds significantly more difficult to trace, particularly as additional layers are introduced. The ownership trail therefore becomes considerably more complex, which is especially relevant when we consider that these transactions were being executed in 2011, during Bitcoin’s earliest years.
This transaction below shows the basic mechanics of a peel structure very clearly: one balance enters the wallet, but two outputs leave it. The wallet receives approximately 9,990 BTC, and when those coins move, the transaction separates the balance into two outputs: one large output carrying almost the entire position forward and a much smaller output sent to a different address. The process can then be repeated, with the large remainder entering another wallet and again producing two outputs. Each repetition effectively “peels” a small amount away from the main balance while the bulk of the Bitcoin continues through the chain, creating an increasingly complex trail of addresses and transactions to follow.
This transaction shows the peel pattern at the individual wallet level. The address receives 2,667.71 BTC and, at the exact same timestamp, sends 2,625.07 BTC to one address and 42.64 BTC to another. The amounts add up exactly to 2,667.71 BTC, showing how one incoming balance was immediately split into two separate outputs.
The next image confirms the peel pattern continues through thousands of BTC. The address receives approximately 2,625.066 BTC, then spends it roughly 26 minutes later, splitting the balance into approximately 2,583.2955 BTC and 41.77 BTC. The larger amount continues forward while another portion is peeled away, and when this process is repeated across multiple addresses, these individual splits add up to thousands of Bitcoin being systematically routed through the same pattern.
At this point, tracking every individual transaction becomes increasingly difficult because the funds are repeatedly split, peeled, recombined and routed through a growing network of addresses. The structure is consistent with an attempt to obscure the provenance and ownership trail. This teaches us an important lesson: focusing exclusively on the famous “Satoshi wallets” is just a distraction from the much larger question of how early Bitcoin supply was actually distributed. What our investigation demonstrates is that a relatively small number of coordinated or centralized players controls a far larger share of the early Bitcoin supply than the visible Satoshi-era wallets would suggest.
It is also important to highlight when these dormant coins began moving. Bitcoin was already trading above $100,000 and near its all-time highs, meaning this enormous amount of ancient supply was becoming active during one of the strongest periods of market liquidity and demand. At the time, I published a video titled' ‘'This Will End The Bullrun’’ warning that the movement of these 80,000 BTC was a serious risk to the markets, that original analysis can be watched here:
There is another unusual detail in the destination address itself. Bitcoin addresses are normally generated from cryptographic keys, so their characters should appear effectively random. Yet this address contains the visible sequence “fu*k” inside bc1qwq5geath93h0lnfsrmnwnfuck2f9ypv4ewyl4j. A sequence like this can occur randomly, but users can also deliberately generate vanity addresses by repeatedly generating keys until an address containing a desired pattern appears. The presence of a readable word does not prove who created the wallet or why, but it raises the possibility that this address was intentionally generated rather than simply being an ordinary random destination, adding another unusual detail to an already highly structured series of movements.
The same anomaly appears in Final 3. Inside the native SegWit address bc1qmnjm0l0kdf3m3d8khc6cukj8deakg8m588z24g, the sequence “deak” appears clearly near the end. By itself, four readable characters can occur randomly, so this is not proof of intentional encoding. However, when another destination from the same coordinated 80,000 BTC movement contains “fuck,” the presence of a second readable sequence becomes worth documenting. Vanity-address generation can deliberately produce specific character patterns, so these addresses raise the question of whether at least some of the destinations were purposefully generated rather than ordinary random SegWit addresses, potentially functioning as a hidden message embedded directly into the addresses themselves. As these coins were ultimately being prepared to enter and be sold into the markets, the possibility of intentionally encoded messages makes these destination addresses even more unusual.
An important detail is that the activity appears first on the Bitcoin Cash side of the forked coins. The screenshot shows the corresponding BCH address receiving approximately 10,000 BCH on July 4, 2025, before another transaction appears on July 5. Because holders of Bitcoin before the 2017 fork also received the corresponding BCH, activity involving these forked coins can provide another signal that the private keys controlling these extremely old holdings had become active. This matters because the event was therefore broader than simply moving dormant BTC between Bitcoin addresses; the associated Bitcoin Cash was also being accessed and moved.
Until this point, we knew where the coins came from and how they had been structured for more than a decade. What happened next is where the investigation changes completely, because for the first time we can follow these dormant coins into the institutional financial system.
🔒 The most important part of this investigation starts here. Continue reading to unlock the full research and discover where the 80,000 BTC went and who facilitated the $9 billion sale. Your subscription directly supports my independent investigative work while allowing sensitive research like this to remain protected behind the paywall rather than being immediately distributed across public platforms.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.