Fee.org or Coinbase: Who Is the 850K BTC Whale?
In the last few days, there were 107 new accounts popped up in the Bitcoin rich list, each with a 8000 BTC balance, and altogether 850K BTC, worth about 2.9 Billion USD. Figure 1 shows some of the new BTC accounts. From the patterns of these accounts’ creation and transactions, it’s very likely they are controlled by the same identity. Who is the whale behind this huge amount of bitcoin?
From the web, there are mainly two suggestions about the identity of this whale, one is fee.org, and the other is Coinbase. Which one is correct, and what went wrong with the other suggestion? PeckShield researchers dug further into this topic.
Figure 1: Some of the newly created addresses with 8000 BTC balances
Bitcoin is pseudo-anonymous, so many times we cannot tell who is the owner of a particular address, but there are still ways to do analysis. For example, there is one rule used by most researchers called “Common Spending”, says that all input addresses in one transaction belong to the same owner, since he/she needs to have all the private keys to put these inputs into a transaction. For example, all input addresses in Figure 2 belong to the same owner. This rule only applies to inputs, not outputs, and it’s not 100% accurate (one exception being CoinJoin transactions), but it’s accurate most of the times, and it’s the basic principle used in most Bitcoin address clustering algorithms. There are other rules but may have side effects, such as “One Time Change” tends to collapse unrelated clusters into one.
PeckShield researchers utilized “Common Spending” rule, deleted the noise generated by CoinJoin transactions, and produced a group of address clusters with all known Bitcoin addresses, a total of more than 650M. There are 15 clusters each with 1M+ addresses, and two of them have 10M+ addresses. Out of the two, one cluster has 13,811,833 addresses, which is the cluster we will look into today.
Figure 2: Multiple input addresses within this transaction belong to the same owner
Some of the addresses within this super cluster, for example, 3KJJumhLiHdLb9htSV1imjpDd5F8B6iFAr, sent BTC into one of the 8000 BTC addresses, and this 3KJ address is tagged as “fee.org” address on bitinfocharts.com website, similarly some related addresses within the cluster are also tagged as “fee.org” addresses on bitinfocharts site. There is one BTC donation address on fee.org website, 15wDJRfsyomAgvX2TdW32gdYtAWZtAd1ps, which is also included in the super cluster. Because of it, and the “Common Spending” rule, bitinfocharts tagged this cluster and its addresses as “fee.org” addresses. The problem is that, in all its lifetime, 15w address received about 17 BTCs, which matches the behavior pattern of a private foundation address, but other addresses tagged as “fee.org” by bitinfocharts don’t. For example, one address,1KVAHsKYTGwerk6RSMBotfQMrau26nfwWm, sent a whopping 66K BTCs to 101 addresses in a single transaction, a behavior typically reserved for exchange addresses. Also, the main business of fee.org is not Bitcoin related, so there is no way it can have 10M+ addresses and a balance of 850K BTCs.
We believe all of the 15 clusters with 1M+ addresses belong to exchanges. So, a more reasonable explanation would be, this super cluster also belongs to an exchange, and fee.org is one of its customers, owning one or more addresses assigned by this exchange. By mistake, bitinfocharts tagged all the addresses belong to this exchange and its customers to “fee.org”.
There are hundreds of exchanges all over the world, but only a few can have a balance of 850K BTCs. Considering Coinbase has posted a notice at its blog, that they would do account maintenance for seven days starting from 11/29, and the timing matches the creation and transactions of these 8000 BTC accounts, we believe the exchange is Coinbase. Also, fee.org is an American organization, and Coinbase has the most American customers among all exchanges, it’s reasonable to assume that fee.org may be a Coinbase customer.
Another thing worth pointing out, PeckShield data shows that, the current total balance of this super cluster is only about 65 BTCs. So although it has 13M+ addresses, Coinbase’s main addresses with large balances are still not included in the cluster. The 107 8000 BTC addresses that we believe belong to Coinbase, since they don’t have “Common Spending” behavior so far, they are not included in the cluster yet, maybe in the future. This shows the limitation of address clustering algorithms, and they are still in the stage of “it’s an art, not a science”.
In summary, we believe the whale is Coinbase. Due to the mislabelling of bitinfocharts.com, some people believed the whale was fee.org, and we have contacted bitinfocharts for this matter. At the same time, these account creations and transactions are regular account maintenance by Coinbase, so crypto investors should not be alarmed by its volume.
About us
PeckShield Inc. is a leading blockchain security company with the goal of elevating the security, privacy, and usability of current blockchain ecosystem. For any business or media inquires (including the need for smart contract auditing), please contact us at telegram, twitter, or email.
