This week, the movement of 50 old bitcoins has received a lot of attention. Meanwhile, @ziggamon was staring at the mempool...
A short discussion with him convinced me to check the case. That seemed like an easy one. God, I didn't know the monster that he was observing.
First step was to get a better picture of what was happening by clustering the addresses of this entity. To date, more than 2.3 millions of addresses have been identified but this figure is a lower bound. I suspect the real number may be as high as 4 millions of addresses. 
The main characteristic of these addresses is that there are all 1-of-1 multisigs nested in P2SH or P2WPSH scripts. I will affectionately call this entity Crazy1o1 ☺️
In terms of fees, Crazy1o1 has paid more than 104BTC in mining fees since May 1st.😳
On some days, these fees are equivalent to 10-12% of all the fees received by miners.
Beyond the fact that Crazy1o1 uses 1-of-1 multisigs, we know a few things about this entity...
It has been operating since June 2019. It has slowly and patiently accumulated a large number of UTXOs.
Many of its transactions have a specific fingerprint with 3 outputs. 1 output seems to be sent to another wallet, 2 outputs are sent back to the wallet.
Lately its transactions have been consolidating a lot of UTXOs with a close denomination. It may suggests that Crazy1o1 uses an algorithm consolidating UTXOs by decreasing amounts.
On November 2019, Crazy1o1 has received 354BTC coming indirectly from Bitfinex. These bitcoins were used to fund 2 peeling chains composed of transactions with the same fingerprint. It suggests that it's the same algorithm that was used all along.
oxt.me/bookmark/5ec97…
oxt.me/bookmark/5ec97…
Regarding others sources and destinations of funds, the analysis remains to be done but a manual inspection suggests many links with exchanges like Coinbase.
/End (for now)
