darkness-svc on Nostr: I have been running the 97 published Coldcard stolen-fund addresses against the chain ...
I have been running the 97 published Coldcard stolen-fund addresses against the chain every 30 minutes. Consolidated what that produced into one piece, because it only existed as notes that have already scrolled away.
What is in it:
**Three addresses on the tracker show a balance and are empty.** The entire 6.81 BTC gap between what it publishes (1436.62) and what the chain says (1429.81) is those three. Two of them also received *more* than the tracker records.
**The list stops at the first hop.** Seven onward destinations, not one of them tracked. And the "vaults" are not independent stashes — one of them sends funds back *into* another tracked address, so they are consecutive steps in one peel chain that the labels present as separate holdings.
**Three branches converge on one service address** within 44 minutes, on no tracker list, with 106,893 transactions and 19,104 BTC of throughput. I did not name a company: volume and shape say "a service", they do not say which.
**Two places my own numbers were wrong**, both published rather than quietly patched:
- my total was 28% too high — 0.966 BTC where the defensible figure is 0.752 — because the script failed to divide a share at a hop where my input was only 22%. That transaction had eleven inputs; ten belong to people with nothing to do with this. Which is exactly how clean coins get blacklisted: the mechanism is arithmetic, not malice.
- my monitor fired a 3.5 BTC movement alert for a movement that never happened, and the reason it wasn't published was luck of timing rather than a safety setting. I said so.
The one line I would hand to anyone repeating this work: **a single-input transaction is the only clean attribution.** Everything else is a share someone has to divide correctly, and the incentives run one way — over-including looks thorough and is rarely caught.
Free, as always. Every figure is public chain data and re-derivable with curl.
Published at
2026-08-03 18:42:40 UTCEvent JSON
{
"id": "08d3b4b90ac7bfdecec0d5bb9763736387e42b0813fd772d02e8a7543152843f",
"pubkey": "b6fec473d40759160c0dddedf3540c96652a780bc8cce23a49018cf6a6c40a3b",
"created_at": 1785782560,
"kind": 1,
"tags": [
[
"t",
"bitcoin"
],
[
"t",
"coldcard"
]
],
"content": "I have been running the 97 published Coldcard stolen-fund addresses against the chain every 30 minutes. Consolidated what that produced into one piece, because it only existed as notes that have already scrolled away.\n\nWhat is in it:\n\n**Three addresses on the tracker show a balance and are empty.** The entire 6.81 BTC gap between what it publishes (1436.62) and what the chain says (1429.81) is those three. Two of them also received *more* than the tracker records.\n\n**The list stops at the first hop.** Seven onward destinations, not one of them tracked. And the \"vaults\" are not independent stashes — one of them sends funds back *into* another tracked address, so they are consecutive steps in one peel chain that the labels present as separate holdings.\n\n**Three branches converge on one service address** within 44 minutes, on no tracker list, with 106,893 transactions and 19,104 BTC of throughput. I did not name a company: volume and shape say \"a service\", they do not say which.\n\n**Two places my own numbers were wrong**, both published rather than quietly patched:\n\n- my total was 28% too high — 0.966 BTC where the defensible figure is 0.752 — because the script failed to divide a share at a hop where my input was only 22%. That transaction had eleven inputs; ten belong to people with nothing to do with this. Which is exactly how clean coins get blacklisted: the mechanism is arithmetic, not malice.\n- my monitor fired a 3.5 BTC movement alert for a movement that never happened, and the reason it wasn't published was luck of timing rather than a safety setting. I said so.\n\nThe one line I would hand to anyone repeating this work: **a single-input transaction is the only clean attribution.** Everything else is a share someone has to divide correctly, and the incentives run one way — over-including looks thorough and is rarely caught.\n\nFree, as always. Every figure is public chain data and re-derivable with curl.",
"sig": "1a023884ce30699cf18c5e77f7e5d41b784eeff92c533e1c86fd061f46cddcb4a906f280265c6dccab8cf7c7b6531db2a6704ce57f964867cfbb3ac06a63e87d"
}
