On July 4th, 80,000 bitcoins believed to be connected to a long-dormant whale moved on-chain for the first time since 2011. The transfers, valued at over $8B, sparked widespread attention, raising questions, speculation, and concerns across the community. Much of the commentary was based on specious reasoning, and we aim to clarify what is known with certainty and offer our perspective on what may be unfolding.
Spamming Messages Ahead of Transfers
In the days leading up to the July 4th transfers, unusual activity was seen on July 2nd, when messages were broadcast to long-term bitcoin holders using the OP_RETURN data field. These messages appeared to warn the recipients that their bitcoins had been seized, that ownership proof would require an on-chain transaction, and directed them to the “Salomon Bros” website, which displayed a notice claiming that the wallet had been abandoned and control had been taken over by their client. The sequence of messages read as follows:
- LEGAL NOTICE: We have taken possession of this wallet and its contents
- Not abandoned? Prove it by an on-chain transaction using private key by Sept 30
- NOTICE TO OWNER: see www.salomonbros.com/owner_notice
Some of the addresses associated with the “July 4th Whale” that moved bitcoins also received a sequence of numbers—4 8 15 16 23 42—an iconic and repeating theme from the TV show Lost, meant to reinforce the concept of destiny and control.
Legal Notices Sent to Numerous Addresses
Blockchain data reveals that the 8 addresses linked to the July 4th Whale were not the only recipients of the legal notice messages. The sender appears to have broadly disseminated these messages to numerous high-balance addresses that had remained dormant for years, including one associated with the Mt. Gox hack, which holds 80,000 bitcoins. Notably, many of these addresses did not move their funds in response. This suggests a pattern of indiscriminate messaging by the sender. This is one example of the message sender spamming addresses: link
This leads us to believe the message sender was bluffing, hoping to scare the recipients into moving their bitcoins. If they really had taken control of “abandoned” private keys, they would have moved all bitcoins in the message destination addresses, not just some of them.
"Lost" Messages Appear to be Unrelated Spam
What about the mysterious “Lost” numbers? These messages appear to come from one single address and weren’t sent to every one of the July 4th Whale addresses. The blockchain further reveals that the sending address is involved in numerous spam and low-quality transactions—BRC-20s, OP_RETURN messages, and Runestones. We don’t know the purpose of these transactions, but even the Lost numbers went to other addresses not associated with the July 4th Whale. These Lost messages and the legal notice messages were sent on separate days, too, leading us to believe there’s a high probability they aren’t related and likely just a coincidence. Link to the “Lost” message sender’s address: link
“Salomonbros.com” Website Prompts Intrigue
What about the mysterious Salomonbros.com website? First, we advise users not to visit the Salomonbros.com website. While it may be legitimate, the likelihood that it is not is high for the following reasons:
- The site features vague, outdated content, including boilerplate copy, stock imagery.
- The "Views and Research" section hasn't been updated in over two years.
- The individuals named as part of its “Advisory Board” appear to have once worked at Salomon Brothers many years ago, but no longer do, according to their LinkedIn profiles.
- One advisory board member has his name spelled incorrectly.
- The “legal notice” on the URL sent in the on-chain message has a notable inconsistency in dates. The website states that wallet owners must respond by October 5, 2025, while the on-chain message specifies a deadline of September 30, 2025.
- The legal language on the site is poorly written and lacks the polish typical of genuine legal notices.
- The claim that bitcoin in the wallet is "abandoned" and thus can be freely claimed by a third party has no known legal precedent under U.S. or international law
At best, the Salomon website appears to be a low-effort placeholder. At worst, it could be malicious, potentially part of a phishing operation. Our current assessment is that this could be an attempt to trick rightful owners into revealing personal information, potentially as part of a broader strategy to identify and exploit them in the future. A historical version of the website is available here: link
What the Whale Movements Suggest
Following the receipt of the on-chain messages, the July 4th Whale engaged in several on-chain transactions across both Bitcoin and Bitcoin Cash. The private keys associated with 80,000 bitcoins are also associated with a similar amount of bitcoin cash, which we can connect because their ownership dates to 2011, well before the 2017 hard fork (the addresses are different because of how Bitcoin Cash encodes addresses). Our assessment by looking at the on-chain activity demonstrates the competence (using both chains) and confidence (making large single balance transfers without sending test transactions) of an experienced user. There is no evidence that private keys had been compromised or that the wallet associated with these addresses was somehow exploited.
The timeline of events with the movement of coins follows as such:
- 0n 7/3, the user first sends 10,000 BCH onto a new address.
- An hour later, the user sends 10,000 BTC to a new P2PKH address using the same private key as the first BCH transaction.
- In successive transactions over the next 11 hours, the user sends 70,000 BTCs to new SegWit (P2WPKH) addresses. This is a different address format from the first BTC destination address.
- Following the movement of all their BTCs, the user signs 7 transactions, moving the remaining 70,000 BCH, which are confirmed in the same block.
The first transaction in the observed Bitcoin activity stands out as an anomaly - the whale opted to send funds to a legacy P2PKH address instead of a more modern SegWit format, which is where the subsequent transactions went. The reason for this choice remains unclear. It may simply have been a user error or oversight.
Despite this irregularity, we can link this address to others in the broader transaction set. Blockchain data shows that this address was initially funded by the same source as some of the other addresses back in 2011. Given this shared funding history, it seems unlikely that multiple whales are involved.
|
|