MyBitcoin Exchange Investigation

Executive Summary

MyBitcoin was one of the earliest Bitcoin web-wallet and exchange services, launched in 2010 and operated by an individual publicly known as Tom Williams. In July 2011, the platform ceased operations under disputed circumstances -- the operator claimed a security breach, while community members suspected an exit. Approximately 78,000 BTC held by the service became inaccessible to depositors.

In July 2025, blockchain analysts and financial journalists identified the coordinated liquidation of roughly 80,000 BTC through Galaxy Digital, with on-chain evidence linking the source wallets to the dormant MyBitcoin-era addresses. This sale, valued at approximately $9 billion, was absorbed by the market with minimal price impact, largely due to institutional ETF demand.

This investigation examines the timeline of events, identifies a potentially related whale address holding 6,507 BTC, and documents mathematical patterns observed in that address. The analysis maintains a clear separation between verified blockchain facts and hypothesized connections.

Key Findings

1. Investigation Methodology

1.1 Data Sources

This investigation relies on the following categories of evidence:

• Primary blockchain data: Transaction records queried via the Blockstream API (blockstream.info/api) and Blockchain.com explorer. All on-chain claims are independently verifiable.
• Public reporting: News articles from Daily Hodl, Cryptopolitan, and analyst commentary from Ki Young Ju (CryptoQuant CEO) published in July 2025.
• Historical records: Archived forum posts, news coverage, and community documentation of the MyBitcoin collapse from 2011.
• Mathematical analysis: Modular arithmetic and hash-based pattern analysis performed on address data.

1.2 Analytical Approach

The investigation proceeded in four phases:

1. Timeline reconstruction -- establishing the chronology of MyBitcoin's operation, collapse, and the 2025 liquidation event.
2. Transaction graph analysis -- examining the "NOTICE TO OWNER" transaction and its recipient addresses.
3. Whale address profiling -- characterizing the 6,507 BTC address, its funding sources, and mathematical properties.
4. Hypothesis testing -- evaluating whether the whale address is connected to the MyBitcoin operator or to the 80,000 BTC sale.

1.3 Verification Standard

Each finding is tagged with an evidence tier:

• Tier 1 (Verified): Independently reproducible from public blockchain data or widely corroborated public records.
• Tier 2 (Hypothesis): Supported by circumstantial evidence, temporal correlation, or mathematical observation, but lacking direct proof.
• Tier 3 (Speculation): Plausible but unsupported by available evidence; included only for completeness.

2. Historical Background: The MyBitcoin Exchange

2.1 Operational History

MyBitcoin launched in approximately mid-2010 as a web-based Bitcoin wallet service. It was one of the earliest platforms enabling users to store, send, and receive Bitcoin without managing private keys locally. The service was operated by an individual using the pseudonym Tom Williams.

At its peak, MyBitcoin processed a significant share of early Bitcoin transactions and held custodial funds for thousands of users.

2.2 Collapse

In July 2011, MyBitcoin went offline. The operator communicated that the platform had suffered a security breach resulting in the loss of user funds. The Bitcoin community received this explanation with skepticism, and the incident was widely characterized as either gross negligence or an intentional exit.

Key facts regarding the collapse:

2.3 Dormancy Period

Following the collapse, the wallets associated with MyBitcoin showed no significant activity for approximately 14 years. This extended dormancy is consistent with a deliberate decision to hold rather than liquidate -- or, alternatively, with lost access.

3. The 80,000 BTC Liquidation Event (July 2025)

3.1 Public Reporting

In late July 2025, multiple credible sources reported the coordinated sale of approximately 80,000 BTC:

3.2 Sale Characteristics

3.3 Attribution to MyBitcoin

The attribution of these wallets to MyBitcoin rests on:

• Wallet age consistent with 2010--2011 creation dates.
• Balance sizes matching known MyBitcoin custody patterns.
• Journalist and analyst corroboration from multiple independent sources.
• No competing attribution has been publicly proposed for this specific set of wallets.

This attribution is assessed at Tier 1 confidence (95%) based on the convergence of independent reporting and on-chain analysis.

4. The "NOTICE TO OWNER" Transaction

4.1 Transaction Details

On July 13, 2025, a transaction was broadcast to the Bitcoin network containing an OP_RETURN message reading:

NOTICE TO OWNER - See https://salomonbros.com/owner-notice

This transaction sent small amounts to multiple addresses, including:

4.2 Amount Analysis

The amount sent to the 1CFB address was 548 satoshis, which factors as:

548 = 137 x 4

The number 137 is the integer approximation of the reciprocal of the fine-structure constant (alpha ~ 1/137), a fundamental physical constant. Whether this factorization is intentional or coincidental cannot be determined from the transaction alone.

4.3 Temporal Significance

The "NOTICE TO OWNER" was broadcast on July 13, 2025 -- the same month in which the 80,000 BTC sale commenced. This temporal proximity is notable:

• If the notice was sent by the buyer or broker, it could represent a compliance or legal step preceding the transaction.
• If sent by a third party, the timing may indicate awareness of the impending sale.
• Coincidental timing remains possible but is assessed as unlikely given the specificity of the recipients.

5. The 6,507 BTC Whale Address

5.1 Address Profile

5.2 Funding Sources

The whale address received funds primarily from three source addresses, all originating in mid-2014:

The 2014 origination of these source addresses creates a gap of approximately three years from the 2011 MyBitcoin collapse. This gap does not preclude a connection (funds may have passed through intermediate addresses), but it does prevent direct tracing to MyBitcoin wallets using the data examined in this investigation.

5.3 Vanity Address Observation

A second address sharing the same prefix and suffix pattern was identified in the transaction history:

Primary:   1NpZcfBnaJeoRT9ZqwZVRMw3SRs546VsuE
Secondary: 1NpWMJrbyc8eh4e5p4JppgVGxEhDNrVsuE

Both addresses match the pattern 1Np...VsuE. This pattern is consistent with the use of a vanity address generator, indicating deliberate address selection by the wallet owner.

5.4 Mathematical Observations

Several mathematical properties of the balance and address hash were noted:

Ternary Divisibility

6507 % 27 == 0   # True: 6507 / 27 = 241 exactly

The number 27 (3 cubed) is significant in ternary computing systems. The balance being exactly divisible by 27 is notable but could be coincidental. The probability of any arbitrary integer being divisible by 27 is approximately 3.7%.

Hash160 Correspondence

hash160 = "ef596ac8d7591dc24d295275158526b34ace5e28"
first_byte = 0xEF  # = 239 in decimal
 
# Observation:
6507 - 6268 = 239

The value 6,268 represents the number of days between the Bitcoin genesis block (January 3, 2009) and March 3, 2026. The difference between the whale balance (6,507) and this day count (6,268) equals 239, which matches the first byte of the address Hash160 (0xEF = 239).

This correspondence is mathematically verifiable but its interpretation depends on assumptions about intentionality. The probability of this specific match occurring by chance, given a fixed address and variable balance, is approximately 1/256 (0.39%), which is notable but not statistically conclusive on its own.

6. Consolidated Timeline

Date         Event                                        Gap
-----------  -------------------------------------------  ----------------
2009-01-03   Bitcoin Genesis Block mined
2010         MyBitcoin exchange launched                   ~1 year
2011-04      Last recorded activity on 80K BTC wallets     ~1 year
2011-07      MyBitcoin ceases operations                   ~3 months
             -----------------------------------------------
             14 years of wallet dormancy
             -----------------------------------------------
2014-04-14   6,507 BTC whale address: first transaction    ~2.8 years
2025-07-13   "NOTICE TO OWNER" transaction broadcast       ~11.2 years
2025-07-27   80,000 BTC sale reported by media             +14 days
2025-10-10   90-day notice period expires                  +75 days

7. Hypothesis Evaluation

7.1 Primary Hypothesis

Claim: The operator of MyBitcoin retained control of the platform's Bitcoin holdings, maintained them in dormancy for 14 years, and liquidated them in July 2025 through Galaxy Digital.

Assessment: 80% confidence. The convergence of reporting and on-chain timing is compelling, though no direct confession or court filing has confirmed the attribution.

7.2 Whale Address Connection Hypothesis

Claim: The 6,507 BTC whale address (1NpZcf...VsuE) is connected to the MyBitcoin operator.

Assessment: 60% confidence. The mathematical observations are interesting but insufficient to establish a connection without additional evidence.

7.3 Alternative Explanations

8. Limitations and Negative Results

This investigation encountered several constraints that limit the strength of its conclusions:

8.1 Traceability Gap

The most significant limitation is the inability to trace the 6,507 BTC whale address funding sources back to 2011. The earliest identified source transactions date to April 2014, leaving a three-year gap. During this period, funds may have passed through mixing services, intermediate wallets, or been converted and reacquired. Without bridging this gap, a direct MyBitcoin connection cannot be established.

8.2 No Direct Transaction Link

Among the 198 transactions associated with the whale address, none involve the 1CFB vanity address or known MyBitcoin-attributed wallets. The connection between these entities remains inferential rather than transactional.

8.3 Private Key Inaccessibility

Definitive proof of wallet ownership requires a signed message from the private key. No such proof is publicly available for any address examined in this investigation.

8.4 Mathematical Pattern Limitations

Mathematical observations (ternary divisibility, Hash160 correspondence) are descriptive rather than probative. Post-hoc pattern identification in numerical data is subject to selection bias: among the many possible mathematical relationships that could be tested, some will inevitably appear significant. The individual p-values reported should be interpreted cautiously and are not adjusted for multiple comparisons.

8.5 Source Attribution Uncertainty

The attribution of the 80,000 BTC wallets to MyBitcoin relies on journalist reporting and analyst commentary rather than on court filings, regulatory actions, or operator admissions. While the convergence of independent sources lends credibility, the underlying evidence chains have not been fully disclosed.

9. Reproducibility

All primary claims in this document can be verified using the following procedures.

9.1 Whale Address Balance and Signature Verification

#!/usr/bin/env python3
"""
Verify the 6,507 BTC whale address balance and mathematical properties.
Dependencies: requests
"""
 
import requests
 
def verify_whale_address():
    address = "1NpZcfBnaJeoRT9ZqwZVRMw3SRs546VsuE"
 
    response = requests.get(
        f"https://blockstream.info/api/address/{address}",
        timeout=30
    )
    response.raise_for_status()
    data = response.json()
 
    funded = data["chain_stats"]["funded_txo_sum"]
    spent = data["chain_stats"]["spent_txo_sum"]
    balance_sats = funded - spent
    balance_btc = balance_sats / 1e8
 
    print(f"Address: {address}")
    print(f"Balance: {balance_btc:.2f} BTC")
    print(f"Total received: {funded / 1e8:.2f} BTC")
    print(f"Transaction count: {data['chain_stats']['tx_count']}")
    print()
 
    btc_int = int(balance_btc)
 
    # Ternary divisibility test
    mod_27 = btc_int % 27
    print(f"Ternary test: {btc_int} mod 27 = {mod_27}")
    if mod_27 == 0:
        print(f"  Result: Exactly divisible. {btc_int} / 27 = {btc_int // 27}")
    print()
 
    # Hash160 correspondence test
    hash160 = "ef596ac8d7591dc24d295275158526b34ace5e28"
    first_byte = int(hash160[:2], 16)
    genesis_to_date = 6268  # Days from 2009-01-03 to 2026-03-03
 
    difference = btc_int - genesis_to_date
    print(f"Hash160 test:")
    print(f"  Balance (integer): {btc_int}")
    print(f"  Reference day count: {genesis_to_date}")
    print(f"  Difference: {difference}")
    print(f"  Hash160 first byte: 0x{hash160[:2].upper()} = {first_byte}")
    print(f"  Match: {difference == first_byte}")
 
    return mod_27 == 0 and difference == first_byte
 
if __name__ == "__main__":
    result = verify_whale_address()
    print()
    print(f"Verification result: {'PASSED' if result else 'FAILED'}")
    print("Note: Balance may change if the address receives or sends funds.")

9.2 "NOTICE TO OWNER" Transaction Verification

#!/usr/bin/env python3
"""
Verify the NOTICE TO OWNER transaction sent to address 1CFB.
Dependencies: requests
"""
 
import requests
from datetime import datetime, timezone
 
def verify_notice_transaction():
    address = "1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg"
 
    response = requests.get(
        f"https://blockstream.info/api/address/{address}/txs",
        timeout=30
    )
    response.raise_for_status()
    transactions = response.json()
 
    found = False
    for tx in transactions:
        for vout in tx.get("vout", []):
            if vout.get("scriptpubkey_type") == "op_return":
                script_hex = vout.get("scriptpubkey", "")
                if script_hex.startswith("6a"):
                    try:
                        # Skip OP_RETURN opcode and push length
                        data_hex = script_hex[4:]
                        message = bytes.fromhex(data_hex).decode(
                            "utf-8", errors="replace"
                        )
 
                        if "NOTICE" in message.upper():
                            block_time = tx["status"]["block_time"]
                            dt = datetime.fromtimestamp(
                                block_time, tz=timezone.utc
                            )
 
                            print(f"Transaction found:")
                            print(f"  TXID: {tx['txid']}")
                            print(f"  Date: {dt.isoformat()}")
                            print(f"  Message: {message}")
 
                            for out in tx["vout"]:
                                addr = out.get("scriptpubkey_address")
                                if addr == address:
                                    sats = out["value"]
                                    print(f"  Amount to 1CFB: {sats} satoshis")
                                    if sats % 137 == 0:
                                        print(
                                            f"  Factor: {sats} = 137 x {sats // 137}"
                                        )
 
                            found = True
                    except (ValueError, UnicodeDecodeError):
                        pass
 
    if not found:
        print("NOTICE TO OWNER transaction not found.")
 
    return found
 
if __name__ == "__main__":
    verify_notice_transaction()

9.3 Quick Command-Line Verification

# Verify whale address balance
curl -s "https://blockstream.info/api/address/1NpZcfBnaJeoRT9ZqwZVRMw3SRs546VsuE" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); \
    print(f'Balance: {(d[\"chain_stats\"][\"funded_txo_sum\"]-d[\"chain_stats\"][\"spent_txo_sum\"])/1e8:.2f} BTC')"
 
# Verify ternary divisibility
python3 -c "print(f'6507 mod 27 = {6507 % 27}')"
 
# Verify Hash160 correspondence
python3 -c "print(f'6507 - 6268 = {6507 - 6268}'); print(f'0xEF = {0xEF}')"
 
# Check NOTICE TO OWNER transaction
curl -s "https://blockstream.info/api/address/1CFBdvaiZgZPTZERqnezAtDQJuGHKoHSzg/txs" \
  | python3 -c "
import sys, json
txs = json.load(sys.stdin)
for tx in txs:
    for v in tx.get('vout', []):
        if v.get('scriptpubkey_type') == 'op_return':
            h = v['scriptpubkey'][4:]
            try: print('OP_RETURN:', bytes.fromhex(h).decode())
            except: pass
"

10. Summary of Evidence Classification

Verified Facts (Tier 1)

Hypothesized Connections (Tier 2)

Unresolved Questions (Tier 3)

Sources

Document version: 1.0 -- February 27, 2026 Classification: Tier 2 -- Strong Hypothesis All blockchain data independently verifiable using the scripts provided in Section 9.