pull down to refresh

The Mischievous Little Solo Beef Block

A few days ago a few of us here noticed that another solo Block had been found.
As a Jedi master that I am, I sensed the block coming and managed to post about it first (#881884), and also named it "Beef Block" as the last four letters of the Block's Hash spell out beef. Furthermore, two other fellow stackers also noticed the block (#882477 and #883059). These extra posts, added with some interesting discussion both under @0xbitcoiner's post and in the Barcelona Bitcoin Only telegram groupchat peaked my interest. Thus, I wanted to write about this mystical little solo beef block.

So, let's dive into this mysetrious little solo beef block.

First of all, this was no regular solo block (not that solo blocks are regular, sadly), as this one wasn't publicly claimed by any solo miners, as is customary. So far we have had a couple of Bitaxe blocks, the Apollo Bit fully self hosted block (own ASIC, own node, own pool) and also the unforgettable Telehash Block by the Bitcoin Park guys (historic moment!).

The Coinbase OP_RETURN

At first, it just looks like any other CkPool block, as the Coinbase OP_RETURN, (the thing that pools use to signal who mined the block) had a clear "ckpool" written on it.
But when you check out the actual Coinbase OP_RETURN of the solo CK Pool that everyone uses to solo mine (apart from Public Pool .io), you see that these don't match!

A question arises: what's going on?

The next step is then to explore the outputs.
When the a solo block is found, there is no pool fee to be paid and all the rewards go straight to the miner's wallet. A great example is the Bitcoin Park Telehash block which only has one output and an extra opreturn:
But on the solo CK pool blocks, all solo blocks need to pay a flat 2% fee straight out of the coinbase. The last block found by them is a good example:
It's worth noting that CK pool dev has an on chain footprint going all the way back to 2016, and that he usually uses the same output address for that 2% dev fee. I won't dox him much further, if you want to see that info, put some PoW ;)
Then, what type of outputs does this marvellous little solo beef block follow? And if it has a 2% fee, does it go to the same address as the solo CK pool?
Well, it follows the solo CK pool style of having 2 outputs, one for the miner's address and one with the 2% flat fee to a different address. But the address is definitely not the one used by CK Pool, and he would shortly after confirm on twitter that this block didn't originate from his solo pool.
The Coinbase outputs of the mesmerizing solo little beef block (Mempool link)
Confirmation on Twitter by CK Dev (Twitter link)

What's the answer, Master Jedi?

Well, by the looks of it, this pool payout addresshas also been active since around mid 2014, and most of it's inflows (if not all) come from mining. Over the years, the Address was active recieveing coins and moving them around till around 2020, when it went quiet for almost 4 years.
This is quite interesting, and we can see that this payout address has had coinbases with all sorts of pool related OP_RETURNS. From "Bitfury/BIP100" and "Hashmine .io" to"Kano" and "bebop". But there's always a "ckpool" tag in front of it.
Intriguingly enough, Checksum, co-founder of Bitcoin Mining company Pow.Re, suggested on twitter that it could be a secret pool that we aren't invited to.
Checksum's theory (twitter link)
Personally, I truly have no clue what it could be, as there seems to be no reason to this madness.
On one end, we have the pool payout being super irregular and happening in bursts. One in 2015-16, with some random blocks till 2020. Then 4 years of silence, and the sudden reappearance, with quite some hashrate (4 blocks in less than a month at the end of 2023, and now 5 blocks in 5 months).
Furthermore, the miner payout addresses keep changing, with some early blocks from the 2014 and 2015 era having 3 payout addresses (Miner, and 2 pools?). And if you follow some of those addresses, they received payments from other blocks that have different OP_RETRUN messages in the coinbases.
Thus, I feel like there's definitely someone doing something in the blockchain, and they've been doing it for a gooood while. More than a Decade now! Perhaps it's some sort of OG big miner using this as his stealth/testing private pool?
Who knows what this masquerading little solo beef block is hidding!
With all of that, I hope you enjoyed it.
May the Hash be with you!
this territory is moderated
50 sats \ 1 reply \ @OT 14 Feb
Is CKpool software open source?
reply
I believe so.
I think this is the Github: https://github.com/golden-guy/ckpool-solo
reply
Love this storyteller :), good PoW and thanks
reply
*piqued not peaked.
reply
Yeah, wrote this at 2AM CET time, I knew one mistake would slip through.
Proceeds to speaks in multiple European languages: Pero no me importa, weil ich ja mehrere sprachen spreche i no em preocupa gens ni mica fer errades tant petites. ;)
reply
at least he was phonetically consistent
reply
1653
reply
Stealth nation-state miner?
reply
I must have missed it or I don't understand but why does it have to be a hidden pool? What is the issue with single miner using ck software hypothesis? 🤔🤔
reply
I think you're right.
After some clicking through Arkham's intel platform for the spend tx of this miner's previous block reward from block 881,324.
It went to likely exchange addresses:
  • 3HkLtD... was later consolidated straight into the cryptodotcom cold wallet - so that's with 99.99% certainty a deposit address for that exchange. Note that you wouldn't be able to withdraw more than $100k per day from that platform as a retail user (link)
  • 1HYF36... is 2 transactions away from the coinsquare hot wallet, safe to assume that it's either a change address that then sent to a coinsquare deposit address (17p7kx...), or that it's a coinsquare deposit address itself. However, coinsquare has low limits for retail - much lower than the 2.5-3 BTC that was sent there - CAD 30k (link), so this could give some hints about what kind of entity this is.
It looks like there's nothing curious on 1/30 in terms of outflows from coinsquare in the range of $50k-$350k worth... mostly the usual suspects: wintermute, galaxy digital, B2C2, and other (untagged but behaving like) trading desks / arbers.
I think that it's unlikely that it's a "hidden pool", more likely that it's some entity that simply cashed out their block reward. Let's see what happens with this next reward...
Final note: whomever they are, if they are not a pool then they should really not reuse addresses 😬
reply
Thanks, I wasn't aware of Arkham's offering in regards to cointracking.
So the "hidden pool" hypothesis seems less likely, but this begs the question: "Who or what is this?"
We'll have to stay put.
reply
Arkham simply tags addresses just like what bitinfocharts has been doing for years. Both the former's data and UI are more comprehensive than the latter, so it makes sense to use that platform for on-chain sleuthing. You'll have to do most of the tracking yourself or through another tool though.
Re: this miner. If they keep on reusing the address, or keep on applying the same spending patterns, it's likely that we'll learn more about the operation, eventually. Part of me hopes we'll never know. For pools, providing transparency is important - both for their miners as everyone else. But for true solo setups, I wouldn't mind seeing a lot more of these unexplained origins.
reply
Great post, thanks for sharing, excellent analysis!
My guess is Blockstream Mining?
reply
Hadn't thought of it, it's an option.
This could be like their testing, secondary, or solo mining pool.
It could also very well be someone else. A country perhaps? North Korea? Iran?
reply