Bitcoin Address Archaeology

import hashlib
 
def b58decode(s):
    alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
    num = sum(alphabet.index(c) * (58**i) for i, c in enumerate(reversed(s)))
    combined = num.to_bytes(25, 'big')
    return combined[1:21]  # Hash160 = bytes 1-20
 
def analyze(addr):
    h160 = b58decode(addr)
    return {
        "hash160": h160.hex(),
        "byte_sum": sum(h160),
        "first_byte": hex(h160[0])
    }

1. Executive Summary

This investigation combines three complementary analyses:

1. 1CF Prefix Census: A complete enumeration of 1,169 unique Bitcoin addresses sharing the 1CF prefix, drawn from over two million addresses across seven datasets.
2. Hash160 Byte-Sum Signatures: Mathematical analysis of address generation algorithms, revealing distinct families of vanity addresses with shared byte-sum properties.
3. Blockchain Forensic Analysis: Examination of on-chain events including the "NOTICE TO OWNER" messages, early block signatures, and transaction amount encoding.

Key Findings

2. The 1CF Prefix Census

2.1 Search Methodology

We searched the following datasets for all Bitcoin addresses beginning with the prefix 1CF:

2.2 Prefix Probability

The 1CF prefix in Bitcoin addresses is produced when the Hash160 (RIPEMD-160 of SHA-256 of the public key) starts with specific byte values, typically in the range 0x7a--0x7c.

Expected probability:

2.3 Enrichment Analysis

Total addresses searched:  2,009,791
1CF addresses found:           1,169
Observed frequency:           0.058%

Expected if random:    2,009,791 / 79,402 = 25.3 addresses
Observed:              1,169 addresses

Enrichment factor:     1,169 / 25.3 = 46.2x

2.4 Generation Methods

From the 771 addresses in bitcoin-private-keys.json (which preserves generation metadata):

The relatively balanced distribution across methods suggests a systematic generation campaign using multiple transformation approaches rather than a single targeted algorithm.

Method descriptions:

• step7 / step13 / step27: Linear byte transformations where each byte is shifted by steps * (position + 1) mod 256.
• col / row / diag: Matrix-based transformations applying column, row, or diagonal operations to seed data.

2.5 Absence from Patoshi Set

The Patoshi address set (21,953 early Bitcoin mining addresses attributed to Satoshi Nakamoto's mining pattern) contains zero addresses starting with 1CF.

Patoshi addresses:   21,953
1CF addresses:            0
Expected if random:    0.28

This absence supports the conclusion that 1CF address generation was a separate, deliberate process unrelated to early Bitcoin mining activity.

3. Hash160 Byte-Sum Analysis

3.1 Theoretical Framework

3.2 The 2299 Byte-Sum Family

2299 = 121 x 19
121  = 11^2
19   = prime

3.3 Byte-Sum Distribution Across 1CF Addresses

From analysis of 771 addresses with method metadata:

Most common byte sums (sample):
  2304: 4 addresses
  2634: 4 addresses
  2824: 4 addresses
  2505: 4 addresses
  ...
  2299: 1 address  (1CFi only; 1CFB not in this dataset)

The distribution is relatively uniform, with most byte-sum values appearing 1--4 times. Byte sum 2299 is not inherently common, appearing only once in 771 sampled addresses. The significance lies in its repetition across the special subset and its factorization properties.

3.4 First-Byte Distribution

For an address to have the 1CF prefix, its Hash160 typically starts with bytes in the range 0x7a--0x7c. Among the 754 matrix-derived 1CF addresses, only one has first byte exactly 0x7b (the address 1CF4). In the broader census, only 3 of 1,169 addresses (0.26%) have first byte 0x7b.

4. Address Family Classification

4.1 Comparative Analysis

4.2 The 17ChJM Address

curl https://blockstream.info/api/address/17ChJM9H9oQFYHPyrWo7FicQ2LPgQuQ1qD

4.3 The 1DutmaFU Address -- Negative Result

Hash160: 8da25a84db9f78d99d147afeae62cb00942ea2ad
Byte Sum: 2797 (not equal to 2299; not in Family A or B)
mod 121: 14
mod 19:  4

5. Blockchain Forensic Analysis

5.1 0x7b Signature in Early Blocks

5.2 Genesis Block Nonce Analysis

genesis_nonce = 2083236893
 
# Modular properties
2083236893 % 19  = 0    # Divisible by 19
2083236893 % 121 = 100
2083236893 % 27  = 26
2083236893 % 137 = 81

5.3 Perfect-Square Block Heights

block_576_hash = "000000002436274e351576ee5c9d6a96ce64072d02713d20c32c36bf70f9fbb5"
# Coinbase extra byte: 0x1b = 27

5.4 The "NOTICE TO OWNER" Event

NOTICE TO OWNER - See https://salomonbros.com/owner-notice

548 = 137 * 4
# 137 is the integer nearest to 1/alpha (fine structure constant)

5.5 Transaction Amounts to 1CFB

5.6 OP_RETURN to Genesis Address

6064b2e70c30ecdec14d50a5c295f82c0357f1d932a725af43eb4fe0a0a02e12

hash_bytes = bytes.fromhex(
    "6064b2e70c30ecdec14d50a5c295f82c0357f1d932a725af43eb4fe0a0a02e12"
)
byte_sum = sum(hash_bytes)
byte_sum % 27  # = 0 (divisible by 27)

6. The 6,507 BTC Whale Address

6507 % 27 = 0    # Divisible by 27
6507 / 27 = 241  # 241 is prime (53rd prime)

curl -s "https://blockstream.info/api/address/1NpZcfBnaJeoRT9ZqwZVRMw3SRs546VsuE"

7. Block 9455 and Historical References

Hash160: 077d90d56f0f99d0f0efebbfa3a80672aac8730f
Byte Sum: 2832 (not in the 2299 family)
mod 121: 49
mod 19:  1

curl https://blockstream.info/api/block-height/9455
# Then: curl https://blockstream.info/api/block/{BLOCK_HASH}/txs/0
# Extract actual coinbase output address

8. 1CF Census Structure

8.1 Hierarchical Summary

1CF Address Family (1,169 unique addresses)
|
+-- Standard 1CF addresses (1,166)
|   +-- step7 method   (158)
|   +-- col method     (136)
|   +-- row method     (132)
|   +-- step27 method  (129)
|   +-- step13 method  (111)
|   +-- diag method    (105)
|   +-- other/unknown  (395)
|
+-- 2299 byte-sum subset (3)
    +-- 1CFB (not found in any dataset; dormant since 2009)
    +-- 1CFi (found via step27 + XOR13 method)
    +-- 1CF4 (found at matrix index 439558; no metadata)

8.2 The Missing 1CFB

Despite searching over 2 million addresses across 7 datasets, the address 1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg was not found in any dataset.

Possible explanations:

8.3 The 1CF4 Metadata Gap

The address 1CF4DUoCirfAbU2E1gkwupaaaC1j1RDZGA was found at index 439,558 in matrix-addresses.json but lacks the row, column, and method metadata that accompanies all other matrix-derived addresses. This anomaly has several possible explanations: manual insertion, generation by an alternative process, corrupted metadata, or a placeholder entry.

9. Statistical Assessment

9.1 Combined Probability Analysis

10. Limitations

10.1 Data Limitations

• Incomplete seed coverage: Only seed batches 0--23 were available. Additional batches may exist but were not accessible for this analysis.
• API reliability: Blockchair API returned 430 errors during testing; all verification was performed via blockchain.info/rawblock/{height} or Blockstream API as fallbacks.
• Historical documentation: Some historical forum references contain unverified claims or potential transcription errors (e.g., the Block 9455 address discrepancy).

10.2 Methodological Limitations

• Post-hoc analysis: All observations were identified after data collection, not from pre-registered hypotheses. This increases the risk of false positives.
• Confirmation bias: When searching for patterns in large datasets (2+ million addresses), statistically unusual coincidences are expected.
• Balance volatility: Observations about BTC balances (e.g., divisibility properties) are time-dependent snapshots, not permanent address properties.
• Block hash substrings: The presence of specific hex substrings (like 7b) in 256-bit hashes has a high baseline probability (~63% per hash). Significance claims require careful multiple-testing correction.

10.3 Interpretation Boundaries

• The 46x enrichment of 1CF addresses proves deliberate generation but does not identify the generator.
• Shared byte sums prove shared algorithm but do not prove shared authorship.
• Transaction amount factorizations are interesting but unfalsifiable without a pre-registered prediction framework.
• The "NOTICE TO OWNER" event is on-chain fact; its interpretation as evidence of ownership connections is Tier 2--3.

11. Reproduction Instructions

11.1 Verify the 1CF Census

# Count 1CF addresses in a JSON dataset
python3 -c "
import json
with open('bitcoin-private-keys.json') as f:
    data = json.load(f)
cf_addrs = [a for a in data if a.get('address','').startswith('1CF')]
print(f'1CF addresses: {len(cf_addrs)}')
"

11.2 Verify Hash160 Properties

def b58decode(s):
    alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
    num = sum(alphabet.index(c) * (58**i) for i, c in enumerate(reversed(s)))
    combined = num.to_bytes(25, 'big')
    return combined[1:21]
 
# Verify 1CFB byte sum
h160 = b58decode("1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg")
print(f"Hash160: {h160.hex()}")
print(f"Byte sum: {sum(h160)}")         # Expected: 2299
print(f"First byte: {hex(h160[0])}")    # Expected: 0x7b
print(f"2299 / 121: {2299 / 121}")      # Expected: 19.0
print(f"2299 % 121: {2299 % 121}")      # Expected: 0
print(f"2299 % 19:  {2299 % 19}")       # Expected: 0

11.3 Verify On-Chain Data

# Verify 1CFB address status
curl -s "https://blockstream.info/api/address/1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg"
 
# Verify 17ChJM transaction count
curl -s "https://blockstream.info/api/address/17ChJM9H9oQFYHPyrWo7FicQ2LPgQuQ1qD"
 
# Verify Block 576 coinbase
curl -s "https://blockstream.info/api/block-height/576"
# Then fetch block details and inspect coinbase transaction
 
# Verify Genesis nonce divisibility
python3 -c "print(2083236893 % 19)"  # Expected: 0

11.4 Verify "NOTICE TO OWNER" Transactions

# Search for OP_RETURN transactions to 1CFB on July 13, 2025
# Use a block explorer or Blockstream API to query transactions
# for 1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg around block height ~852,000

12. Falsification Criteria

The following conditions would falsify key claims in this analysis:

13. Data Files and Scripts

14. Summary of Conclusions

1. Deliberate generation confirmed: The 46x enrichment of 1CF addresses across available datasets proves systematic vanity address generation (Tier 1).

2. Two algorithmic families identified: Family A (byte sum 2299 = 121 x 19) and Family B (byte sum mod 19 = 17) represent distinct generation approaches with different targeting criteria (Tier 2).

3. Active address management observed: The 17ChJM address maintaining exactly 676 transactions indicates deliberate management rather than passive usage (Tier 1).

4. Coordinated messaging event documented: The "NOTICE TO OWNER" event targeting three addresses with identical 548-satoshi amounts is on-chain fact (Tier 1). Its interpretation as evidence of ownership connections remains Tier 2.

5. 1CFB remains unlocated in available data: Despite searching over 2 million addresses, 1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg was not found in any available dataset, suggesting it was generated through a process or seed batch not represented in the analyzed data (Tier 1 observation; Tier 3 interpretation).

6. Early block signatures require caution: While patterns in block hashes and nonces are real on-chain data, their interpretation as deliberate encoding is subject to post-hoc analysis bias and requires formal statistical correction before strong conclusions can be drawn (Tier 2--3).

Analysis compiled February 27, 2026. All on-chain data points are independently verifiable through public blockchain APIs.