Skip to content

Analyze suspicious consolidation of coinjoin-like transactions #21

@petrs

Description

@petrs

The 5037e6f97793309ceae87f526a8bb83b651b64f8a87e2936c8f6c0f22d29b545 transaction consolidates 4 inputs which are itself large consolidations of outputs from coinjoin-like transactions.

These coinjoin-like transactions have WW2-like structure, but are left with suspiciously-many unspent outputs (e.g., 70e7cbbe816aa538b801600681e6213260eaf2849e111da82dbe98c303d14bc3. Outputs that were spent are very frequently V1_P2TR whereas unspent are typically V0_P2WPKH. Additionally, spent outputs are typically sequential.

Hypothesis: these transactions seems not to be standard coinjoins with many different users, but are possibly from dedicated WW2 coordinator with very few real users (and these users possibly use modified clients with V1_P2TR address only).

Unclear why V1_P2TR outputs are sequentially after each other.

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    analysisCode for analysis of existing data

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions