HODL Ransom
Nancy Guthrie Case · FBI $152 Payment · All times Arizona (MST)
After both ransom deadlines passed, the FBI sent $152 in Bitcoin to a wallet address from the ransom notes — with a hidden message embedded in the transaction: "We are ready to pay. Contact us." The informant never responded. The money has never been touched. This page traces what happened to that $152 and the FBI's leftover funds on the chain.
How the message was hidden in the transaction ↓
Bitcoin transactions can carry up to 80 bytes of arbitrary data using an instruction called OP_RETURN. The FBI used this:
6a = OP_RETURN opcode · 3e = 62 bytes follow · ASCII decode → "We are ready to pay. Contact us. https://pastes.io/private-ne". The link returns 404 — dead or expired. Verified via mempool.space, Blockchair, and CyberChef.Money Flow — chronological
FBI · Funding wallet · Feb. 10, 2026
FBI Funding Wallet
bc1q34zcc3lr9e9sg8cuna7g8xeazm7j9ds622ktpv
The FBI held $66,379 in Bitcoin here. On Feb. 10, the FBI sent funds to 25 different addresses in one transaction — one of which went to the relay wallet below to stage the ransom funds.
INVESTIGATE
↓ FBI sent 0.00435221 BTC to relay wallet
FBI · Relay wallet · Feb. 10, 2026 · 3:16 PM & 3:43 PM AZ
FBI Relay Wallet
bc1qhcra7uqesgelwtm534anxvgarldd0hhpaa9hpy
The FBI received funds here from the funding wallet, then forwarded them to the sending wallet in two transfers about 90 minutes apart. Now empty.
UNIDENTIFIEDNOW EMPTY
↓ FBI forwarded funds to sending wallet in two transfers
FBI · Sending wallet · Feb. 10, 2026 · 5:12 PM AZ
FBI Sending Wallet
bc1qgrq5zg4gxajyr3dldj8sl0gax0krz09speyet9
The FBI received two transfers here, then used this wallet to send the $152 USD on Feb. 10 at 5:12 PM AZ. The entire balance was spent in that one transaction — split across the ransom address, a second FBI-controlled address ($148), and the hidden message. Not identified as a known exchange or service. Now empty.
UNIDENTIFIEDNOW EMPTY
↓ FBI sent the ransom deposit · Feb. 10 · 5:12 PM AZ
Why three outputs? Bitcoin transactions must account for 100% of the sending wallet's balance — any leftover must go somewhere. The FBI's wallet held ~$300; they sent $152 to the informant's ransom address and routed the remaining $148 to a second address under their control. A third output carried the hidden message — no money, just text embedded permanently in the transaction.
EMBEDDED MESSAGE · OP_RETURN · 0 BTC · same transaction
"We are ready to pay. Contact us. https://pastes.io/private-ne" LINK 404 DEAD
"We are ready to pay. Contact us. https://pastes.io/private-ne" LINK 404 DEAD
↓ 2 money outputs in the same transaction
Informant · Ransom Wallet · received Feb. 10, 2026
Informant's Ransom Wallet
bc1qud56tc0gpc6c50v3t0pc980z2e75jvr48plyrt
The FBI deposited $152 here on Feb. 10, 2026. The informant never responded and never touched the money — the only transaction in this wallet's entire history. Searched from Bitcoin's genesis block (Jan. 3, 2009) through Jun. 27, 2026.
Balance as of Jun. 27, 2026: $132.94 — still sitting there, untouched, 4+ months later.
The address was created fresh for this crime, with no prior blockchain history.
Balance as of Jun. 27, 2026: $132.94 — still sitting there, untouched, 4+ months later.
The address was created fresh for this crime, with no prior blockchain history.
⚠ NEVER TOUCHEDZERO PRIOR HISTORY$132.94 STILL HELD
FBI · Second output · Feb. 10–Mar. 2, 2026
FBI Second Address
bc1qz8sqz2pw38clqpj06n809eunarxg6p6k5x72u3
In the same transaction as the $152 deposit, the remaining $148 was routed to this second address under the FBI's control. On Mar. 2, 2026, the FBI transferred it to a cryptocurrency exchange deposit address. Now empty.
UNIDENTIFIEDNOW EMPTY
▼ FBI's leftover $148 — where it went on-chain (expand)
↓ FBI transferred $148 from second address to exchange
Exchange · Deposit address · FBI funds received Mar. 2, 2026 · 10:49 AM AZ
Exchange Deposit Address
3548M6Zb9Pixppji32BW7beCQBF8Fwikrm
4 transactions total, across two separate events — four years apart. Both times, money arrived here and was swept out within 17–18 minutes, pooled with hundreds of other incoming deposits. That pattern is consistent with how large cryptocurrency exchanges process customer funds.
Jun. 29, 2022: Someone sent $1,580 here. Eighteen minutes later it was swept — combined with other deposits totaling $140,764 — into a temporary routing address, then distributed to about 50 wallets. This predates the Guthrie case by four years.
Mar. 2, 2026: The FBI's leftover $148 arrived here. Seventeen minutes later it was swept alongside 171 other incoming deposits into another routing address.
The group of addresses this belongs to has over 60 million total transactions — the scale of a major global cryptocurrency exchange. This address is not flagged on any government sanctions list. Blockchain monitoring tool MistTrack shows only one known counterparty for this specific address — the FBI's change wallet — consistent with it being a dedicated deposit address for this operation.
Total traced through this address infrastructure: 10.35396123 BTC ($625,068 USD)
Jun. 29, 2022: Someone sent $1,580 here. Eighteen minutes later it was swept — combined with other deposits totaling $140,764 — into a temporary routing address, then distributed to about 50 wallets. This predates the Guthrie case by four years.
Mar. 2, 2026: The FBI's leftover $148 arrived here. Seventeen minutes later it was swept alongside 171 other incoming deposits into another routing address.
The group of addresses this belongs to has over 60 million total transactions — the scale of a major global cryptocurrency exchange. This address is not flagged on any government sanctions list. Blockchain monitoring tool MistTrack shows only one known counterparty for this specific address — the FBI's change wallet — consistent with it being a dedicated deposit address for this operation.
Total traced through this address infrastructure: 10.35396123 BTC ($625,068 USD)
LIKELY MAJOR EXCHANGENOW EMPTYFIRST USED: JUN. 2022NOT SANCTIONED
↓ Exchange pooled FBI's deposit with 171 others into internal wallet
Exchange · Internal wallet · Mar. 2, 2026 · 11:06 AM–2:47 PM AZ
Exchange Internal Wallet
bc1qs6fkx8u2aal3yuq2zmdec5wtcr4wtwt40qpmpn
Two transactions, ever. The exchange pooled 172 customer deposits here at 18:06 — including the FBI's wallet holding the remaining $148 — then sent everything out to 24 wallets 3.5 hours later.
TRAIL EXTENDEDNOW EMPTY
↓ Exchange sent to 24 wallets
Exchange · Outgoing distribution · Mar. 2, 2:47 PM AZ
Exchange Sent to 24 Wallets
bc1qs6fkx… → 24 recipients (see TX detail)
Largest share (output 7): bc1qvjy2cw3ugcuz964c8fuwcvg6peh25atvdc38ca → 3.2580724 BTC (~95% of total) — sent straight back to the same exchange cluster the money came from
Output 19: 3FDQCHaYh8HttswhM4fG7VyRUr82ghU6bh → 0.00028813 BTC — second small output to the same exchange cluster in the same transaction
⚑ Output 22 (UNSPENT): bc1qkm8jf9khsg55n6c4v0mj8lwrxklr75852xfcx0 → 0.07202283 BTC — still sitting, never moved
⚑ Output 8 (UNSPENT): 3GdMC6FYtqiwcJPqW4rjgmAhGLLWwq9TZg → 0.00749139 BTC — still sitting, never moved
The remaining 20 outputs were small amounts distributed to various wallets, all since spent.
Output 19: 3FDQCHaYh8HttswhM4fG7VyRUr82ghU6bh → 0.00028813 BTC — second small output to the same exchange cluster in the same transaction
⚑ Output 22 (UNSPENT): bc1qkm8jf9khsg55n6c4v0mj8lwrxklr75852xfcx0 → 0.07202283 BTC — still sitting, never moved
⚑ Output 8 (UNSPENT): 3GdMC6FYtqiwcJPqW4rjgmAhGLLWwq9TZg → 0.00749139 BTC — still sitting, never moved
The remaining 20 outputs were small amounts distributed to various wallets, all since spent.
95% LOOPS BACK TO EXCHANGE
2 OUTPUTS UNSPENT
Transaction Reference
| Who | When (AZ) | What |
|---|---|---|
| FBI | Feb. 10, est. | Funded sending wallet from 25-address distribution · ~$300 total |
| FBI | Feb. 10, 3:16 PM & 3:43 PM | Relay wallet forwarded funds to sending wallet in two transfers |
| FBI | Feb. 10, 5:12 PM | Message to informant sent — $152 to informant's wallet · $148 to FBI second address · hidden message embedded · Block 935,968 |
| Informant | Feb. 10 – present | Received $152. Never responded. Never touched the money. $132.94 still held as of Jun. 27, 2026. |
| FBI | Mar. 2, 10:49 AM | Transferred remaining $148 from second address to exchange deposit address |
| Exchange | Mar. 2, 11:06 AM | Pooled FBI's $148 with 171 other incoming deposits into internal wallet · $3,416 total |
| Exchange | Mar. 2, 2:47 PM | Distributed to 24 wallets — 95% looped back internally · 2 outputs still unspent |
Confirmed
- Informant's WalletNever touched. The FBI deposited $152 on Feb. 10, 2026. The informant never responded and never moved the money. $132.94 still held as of Jun. 27, 2026.
- Informant's WalletCreated fresh for this crime. No blockchain history before the FBI's deposit on Feb. 10, 2026.
- Exchange Deposit Address (3548M6Zb…)Where the FBI's $148 landed on Mar. 2, 2026. Belongs to a cluster of wallets with 60M+ total transactions — the scale of a major global cryptocurrency exchange. Not flagged on any government sanctions list.
- Exchange Deposit Address (3548M6Zb…)First used Jun. 29, 2022 — four years before the Guthrie case. The same address the FBI's money reached in 2026 had already been used by someone in 2022, and behaved identically: money arrived, then the exchange swept it out within 17–18 minutes.
- Exchange Deposit Address (3548M6Zb…)Blockchain monitoring tool MistTrack shows only one known counterparty for this address: the FBI's second address. Consistent with it being a dedicated account tied to this FBI operation.
- Exchange Internal WalletsIn both 2022 and 2026, most of the money the exchange distributed looped back into its own wallets (87% in 2022, 95% in 2026). Exchanges routinely move funds between their own accounts.
- 2022 Exchange Sweep Destination (bc1qse7x…)The address that received the 2022 exchange payout. Checked on WalletExplorer — no exchange or service name found. Still unidentified.
- Embedded MessageVerified via three independent sources (mempool.space, Blockchair, CyberChef). Full text: "We are ready to pay. Contact us. https://pastes.io/private-ne" — the link is dead (not found or expired).
OP_RETURN Deadline Search
The theory: The Feb. 10 message ("We are ready to pay") arrived after both ransom deadlines, paired with a wallet that was never touched. That pattern fits an informant channel, not direct contact with the actual kidnappers. The question was whether the FBI sent a separate OP_RETURN message near either deadline — Feb. 5 at 5:00 PM or Feb. 9 at 2:00 PM Tucson time — to reach the actual kidnappers. Every transaction in blocks around those two deadlines was scanned.
Feb. 5 · Full day · Midnight – Midnight Arizona · Blocks 935,086 – 935,216
131 blocks scanned · ~385,000 transactions · 9 notable messages
What was found: Two-word phrases, an order number embedded on-chain, two personal messages timed close to the 5:00 PM ransom deadline, a self-referential block-height tag, and a recurring "SENTINEL|SESSION" string posted three separate times overnight.
Morning:
"nickel chrome" — Block 935,128 · 7:23 AM AZ · two-word phrase, no obvious context
"Order# 675081770310470" — Block 935,147 · 10:20 AM AZ · order reference
Closest to deadline (2:00 PM – 5:00 PM window):
"Love you" — Block 935,170 · 2:58 PM AZ · personal message, ~2 hours before deadline
"Kik" — Block 935,179 · 4:32 PM AZ · messaging app reference, 28 minutes before deadline
Evening (after deadline):
"SENTINEL|SESSION|bf83ca15...|e0bd2094" — Block 935,198 · 8:30 PM AZ · first of three
"block 935k" — Block 935,208 · 10:04 PM AZ · self-referential tag
"SENTINEL|SESSION|aa9be850...|2ef888ba" — Block 935,213 · 10:26 PM AZ · second instance
"SENTINEL|SESSION|d2b656ca...|6f89827b" — Block 935,214 · 11:13 PM AZ · third instance, each with a unique hex tag — pattern unclear, possibly an automated session beacon, flagged for reference
Morning:
"nickel chrome" — Block 935,128 · 7:23 AM AZ · two-word phrase, no obvious context
"Order# 675081770310470" — Block 935,147 · 10:20 AM AZ · order reference
Closest to deadline (2:00 PM – 5:00 PM window):
"Love you" — Block 935,170 · 2:58 PM AZ · personal message, ~2 hours before deadline
"Kik" — Block 935,179 · 4:32 PM AZ · messaging app reference, 28 minutes before deadline
Evening (after deadline):
"SENTINEL|SESSION|bf83ca15...|e0bd2094" — Block 935,198 · 8:30 PM AZ · first of three
"block 935k" — Block 935,208 · 10:04 PM AZ · self-referential tag
"SENTINEL|SESSION|aa9be850...|2ef888ba" — Block 935,213 · 10:26 PM AZ · second instance
"SENTINEL|SESSION|d2b656ca...|6f89827b" — Block 935,214 · 11:13 PM AZ · third instance, each with a unique hex tag — pattern unclear, possibly an automated session beacon, flagged for reference
Feb. 6 · Full day · Midnight – Midnight Arizona · Blocks 935,220 – 935,368
149 blocks scanned · ~430,000 transactions · 15 readable messages
What was found: Automated wallet-management labels, BIP39 word groups (seed phrase backups stored on chain), DeFi withdrawal receipts, a sports-stats record, a mempool.space verification badge, political graffiti, a Bitcoin improvement proposal shoutout, and a web3 claim instruction.
Closest to deadline:
"ChangeNow to my USDT (Eth)" — Block 935,309 · 3:05 PM AZ · exchange transaction note
"fuck trump" — Block 935,310 · 3:11 PM AZ · political graffiti
"BERNSTEIN 2.1 REG 2cce508c…" — Block 935,313 · 3:31 PM AZ · regulatory filing identifier, unidentified
Evening (after deadline):
"maga=trash" — Block 935,350 · 9:52 PM AZ · political graffiti
"nBIP-110 4 EVER" — Block 935,350 · 9:52 PM AZ · Bitcoin improvement proposal advocacy
"gsmg.io claim: matrixsumlist enter theone" — Block 935,358 · 10:39 PM AZ · web3 claim instruction
Closest to deadline:
"ChangeNow to my USDT (Eth)" — Block 935,309 · 3:05 PM AZ · exchange transaction note
"fuck trump" — Block 935,310 · 3:11 PM AZ · political graffiti
"BERNSTEIN 2.1 REG 2cce508c…" — Block 935,313 · 3:31 PM AZ · regulatory filing identifier, unidentified
Evening (after deadline):
"maga=trash" — Block 935,350 · 9:52 PM AZ · political graffiti
"nBIP-110 4 EVER" — Block 935,350 · 9:52 PM AZ · Bitcoin improvement proposal advocacy
"gsmg.io claim: matrixsumlist enter theone" — Block 935,358 · 10:39 PM AZ · web3 claim instruction
Feb. 9 · Full day · Midnight – Midnight Arizona · Blocks 935,705 – 935,869
165 blocks scanned · ~480,000 transactions · 18 readable messages
What was found: An Italian-language memorial inscription repeated across three consecutive blocks, BIP39 word groups, DeFi deposits/withdrawals, YouTube links, a personal tribute, a Croatian-language comment about EU AI policy, a French-language Bitcoin declaration, and an order reference.
Notable coincidence:
"Use this $2400 as networking fees to finish the $4.4 m withdrawal" — Block 935,744 · 6:12 AM AZ · 8 hours before deadline. The $4.4 million figure is close to the reported ransom demand. On-chain trace documented below — the TX connects to a Feb. 2 predecessor with identical scripted language, and downstream the funds flow through a multi-step burner chain to a high-volume exchange wallet.
Closest to deadline:
"Tour exp" — Block 935,809 · 2:24 PM AZ · truncated label, likely unrelated
Evening (after deadline):
"Tour exp" — Block 935,817 · 3:57 PM AZ · same label, second occurrence
"LE BITCOIN EST UNE DEVISE" — Block 935,824 · 5:07 PM AZ · French: "Bitcoin is a currency"
"ORDER 1480" — Block 935,829 · 5:45 PM AZ · order reference, unidentified
Notable coincidence:
"Use this $2400 as networking fees to finish the $4.4 m withdrawal" — Block 935,744 · 6:12 AM AZ · 8 hours before deadline. The $4.4 million figure is close to the reported ransom demand. On-chain trace documented below — the TX connects to a Feb. 2 predecessor with identical scripted language, and downstream the funds flow through a multi-step burner chain to a high-volume exchange wallet.
Closest to deadline:
"Tour exp" — Block 935,809 · 2:24 PM AZ · truncated label, likely unrelated
Evening (after deadline):
"Tour exp" — Block 935,817 · 3:57 PM AZ · same label, second occurrence
"LE BITCOIN EST UNE DEVISE" — Block 935,824 · 5:07 PM AZ · French: "Bitcoin is a currency"
"ORDER 1480" — Block 935,829 · 5:45 PM AZ · order reference, unidentified
Feb. 10 · Full day · Midnight – Midnight Arizona · Blocks 935,870 – 936,018
149 blocks scanned · ~453,000 transactions · 3 notable messages
What was found: The day the FBI sent the "We are ready to pay" message. No readable response appeared on-chain — but two messages landed in or just after the FBI's transaction block.
Early morning:
"[LCA] | ENGINE:V1.052 | MODE:OPERATIONAL | STATUS:ACTIVE | ID:A018" — Block 935,887 · 2:30 AM AZ · structured beacon, same format as the SENTINEL|SESSION tags seen on Feb. 5
At and just after the FBI message (5:12 PM AZ · Block 935,968):
"I love you" — Block 935,968 · 5:12 PM AZ · different transaction, same block as the FBI's "We are ready to pay" — coincidence likely, but noted
"#PardonSamourai" — Block 935,973 · 5:41 PM AZ · Bitcoin community advocacy graffiti, 17 minutes after FBI message · not case-related
Early morning:
"[LCA] | ENGINE:V1.052 | MODE:OPERATIONAL | STATUS:ACTIVE | ID:A018" — Block 935,887 · 2:30 AM AZ · structured beacon, same format as the SENTINEL|SESSION tags seen on Feb. 5
At and just after the FBI message (5:12 PM AZ · Block 935,968):
"I love you" — Block 935,968 · 5:12 PM AZ · different transaction, same block as the FBI's "We are ready to pay" — coincidence likely, but noted
"#PardonSamourai" — Block 935,973 · 5:41 PM AZ · Bitcoin community advocacy graffiti, 17 minutes after FBI message · not case-related
TX Reference · ab177e00f0d0c3ff03d0685a13ffc29833421d85e710b97acf0dea9aa9fad0e2
"Use this $2400 as networking fees to finish the $4.4 m withdrawal"
Block 935,744 · Feb. 9, 2026 · 6:12 AM AZ · 1,440 sat fee · Miner: Foundry USA
Inputs (2):
bc1qh5639g…qgzzk8zn — 0.03477549 BTC ($2,402) · new funds
bc1q52pjzrfw…js97c7kh — 0.00057809 BTC ($44) · dust from Feb. 2 TX 4fbec348…, which carried "Manage this $700 as networking fees for the $4.4m withdrawal" — same sender entity, same scripted language, seven days earlier
Outputs (3):
bc1qa5u3cfuqm9t3glm3rd60d23uj3m6wz83wvq7nm — 0.03481370 BTC ($2,448) · payment recipient · 215 total TXs · active since May 2025
bc1qlg54wdfyxad8vuefdy48x6mgtge886eex3es73 — 0.00052548 BTC ($36.96) · change back to sender (identified by privacy analysis)
OP_RETURN — $0.00 · the message
Submission: Not broadcast to the public mempool — submitted directly to Foundry USA's private mining infrastructure. Fee paid 5× above market rate. RBF + SegWit enabled.
Downstream chain:
Feb. 27, block 938,549 — bc1qa5u3… (18 days later) split off exactly 0.003 BTC to a fresh 2-TX burner: 18oWrUrE6SyhdH4HpGn2A9javBfpEeqRFF
Feb. 28, block 938,697 — that burner combined with three other 2-TX burner addresses, all consolidating into a single output: 1PM46U2c5LhkcQXnHwfwQU6V1y4F4L7Ct4 — 18,547 transactions, ~18,272 BTC received (~$1.77 billion) — exchange hot wallet
Inputs (2):
bc1qh5639g…qgzzk8zn — 0.03477549 BTC ($2,402) · new funds
bc1q52pjzrfw…js97c7kh — 0.00057809 BTC ($44) · dust from Feb. 2 TX 4fbec348…, which carried "Manage this $700 as networking fees for the $4.4m withdrawal" — same sender entity, same scripted language, seven days earlier
Outputs (3):
bc1qa5u3cfuqm9t3glm3rd60d23uj3m6wz83wvq7nm — 0.03481370 BTC ($2,448) · payment recipient · 215 total TXs · active since May 2025
bc1qlg54wdfyxad8vuefdy48x6mgtge886eex3es73 — 0.00052548 BTC ($36.96) · change back to sender (identified by privacy analysis)
OP_RETURN — $0.00 · the message
Submission: Not broadcast to the public mempool — submitted directly to Foundry USA's private mining infrastructure. Fee paid 5× above market rate. RBF + SegWit enabled.
Downstream chain:
Feb. 27, block 938,549 — bc1qa5u3… (18 days later) split off exactly 0.003 BTC to a fresh 2-TX burner: 18oWrUrE6SyhdH4HpGn2A9javBfpEeqRFF
Feb. 28, block 938,697 — that burner combined with three other 2-TX burner addresses, all consolidating into a single output: 1PM46U2c5LhkcQXnHwfwQU6V1y4F4L7Ct4 — 18,547 transactions, ~18,272 BTC received (~$1.77 billion) — exchange hot wallet
→ The recipient wallet predates the kidnapping by 8 months. The downstream cash-out pattern — dust split to 2-TX burners, burners consolidate at an exchange — is inconsistent with a kidnapper holding ransom.
All 47 readable OP_RETURN messages across all days scanned
| Date | Block | Time AZ | Message | Type |
|---|---|---|---|---|
| Feb. 5 | 935,128 | 7:23 AM | nickel chrome fd798ee3… | two-word phrase |
| Feb. 5 | 935,147 | 10:20 AM | Order# 675081770310470 56609bfb… | order reference |
| Feb. 5 | 935,168 | 2:28 PM | consolidate 6250b7e7… | UTXO operation |
| Feb. 5 | 935,170 | 2:58 PM | Love you 5cf9d5fd… | personal message |
| Feb. 5 | 935,179 | 4:32 PM | Kik cdb7ce9a… | messaging app ref |
| Feb. 5 | 935,198 | 8:30 PM | SENTINEL|SESSION|bf83ca15…|e0bd2094 e1317e51… | recurring tag (1 of 3) |
| Feb. 5 | 935,208 | 10:04 PM | block 935k 38d01974… | self-referential tag |
| Feb. 5 | 935,213 | 10:26 PM | SENTINEL|SESSION|aa9be850…|2ef888ba b531a252… | recurring tag (2 of 3) |
| Feb. 5 | 935,214 | 11:13 PM | SENTINEL|SESSION|d2b656ca…|6f89827b 28935fd2… | recurring tag (3 of 3) |
| Feb. 6 | 935,227 | 1:51 AM | UTXO Consolidation - Primary Account (1186 UTXOs) bf387bf8… | wallet mgmt |
| Feb. 6 | 935,230 | 2:02 AM | UTXO Consolidation - Primary Account (1400 UTXOs) f65e6def… | wallet mgmt |
| Feb. 6 | 935,256 | 5:32 AM | transcend.tc · withdraw · 37146 db871f9f… | DeFi withdrawal |
| Feb. 6 | 935,259 | 6:39 AM | brick evil leaf bottom upgrade marriage 45e191b9… | BIP39 seed backup |
| Feb. 6 | 935,260 | 6:42 AM | TechNemesis hunt f2f92373… | unknown |
| Feb. 6 | 935,265 | 7:26 AM | badge apart milk motor unusual merit 12866ff4… | BIP39 seed backup |
| Feb. 6 | 935,265 | 7:26 AM | stackingsats.mempool.space verified 100% 3ba9e88a… | mempool badge |
| Feb. 6 | 935,276 | 10:16 AM | https://youtu.be/uE-1RPDqJAY ("taking the hobbits to isengard" via @sexypuerto on May 11, 2006) 6044c837… | YouTube link |
| Feb. 6 | 935,286 | 11:13 AM | SportzCube WIJA 33D 55.28 132444 by@Shasta_C (Go Coogs!) 04584586… | sports stats |
| Feb. 6 | 935,309 | 3:05 PM | ChangeNow to my USDT (Eth) 1a93dba8… | exchange note |
| Feb. 6 | 935,310 | 3:11 PM | fuck trump 32b82eab… | political graffiti |
| Feb. 6 | 935,313 | 3:31 PM | BERNSTEIN 2.1 REG 2cce508c… 2d6e0d33… | regulatory ID, unidentified |
| Feb. 6 | 935,350 | 9:52 PM | maga=trash d5d2ae03… | political graffiti |
| Feb. 6 | 935,350 | 9:52 PM | nBIP-110 4 EVER 1262ab99… | BIP advocacy |
| Feb. 6 | 935,358 | 10:39 PM | gsmg.io claim: matrixsumlist enter theone 3b1abf55… | web3 claim |
| Feb. 9 | 935,715 | 2:22 AM | b.forjasz@gmail.com 6001dde4… | email address |
| Feb. 9 | 935,723 | 3:53 AM | Sempre con te, blocco dopo blocco ("Always with you, block by block.") 10caa703… | Italian memorial |
| Feb. 9 | 935,724 | 4:07 AM | Sempre con te, blocco dopo blocco ("Always with you, block by block.") 9bd15082… | Italian memorial (repeat) |
| Feb. 9 | 935,724 | 4:07 AM | Sempre con te, blocco dopo blocco ("Always with you, block by block.") db62f053… | Italian memorial (repeat) |
| Feb. 9 | 935,725 | 4:11 AM | transcend.tc · withdraw · 37203 c0af3a5e… | DeFi withdrawal |
| Feb. 9 | 935,737 | 5:20 AM | symbol fan child will never fruit e8fc0928… | BIP39 seed backup |
| Feb. 9 | 935,743 | 6:08 AM | surface music panda age upper trophy bb6f40ab… | BIP39 seed backup |
| Feb. 9 | 935,744 | 6:12 AM | Use this $2400 as networking fees to finish the $4.4 m withdrawal ab177e00… | ⚑ traced above |
| Feb. 9 | 935,749 | 6:47 AM | https://youtu.be/uE-1RPDqJAY ("taking the hobbits to isengard" via @sexypuerto on May 11, 2006) 33aa42d0… | YouTube link |
| Feb. 9 | 935,750 | 6:54 AM | https://youtu.be/KaqC5FnvAEc ("Trolling Saruman" via @PistolShrimps on Jul. 10, 2011) 540756ce… | YouTube link |
| Feb. 9 | 935,751 | 7:07 AM | ordx:f:pearl_amm.tc · deposit · VgAGNDkwMDAw 3c9c6fde… | DeFi deposit |
| Feb. 9 | 935,756 | 8:14 AM | Born of strength, loved beyond measure & destined to change the world Kar 7a387ca6… | personal tribute |
| Feb. 9 | 935,758 | 8:24 AM | As above so below b42f0eea… | occult phrase |
| Feb. 9 | 935,758 | 8:24 AM | znate ljudi, iman dojam de ce EU uvest poreze na AI kad budemo poceli koristit AI vise unutar firmi ("You know, people, I have the impression that the EU will introduce taxes on AI when we start using AI more within companies.") f1e2879d… | Croatian, EU AI policy |
| Feb. 9 | 935,773 | 10:31 AM | Credit my uba 30eac852… | partial/unclear |
| Feb. 9 | 935,817 | 3:57 PM | Tour exp b8d8c6dc… | truncated label (repeat) |
| Feb. 9 | 935,824 | 5:07 PM | LE BITCOIN EST UNE DEVISE ("Bitcoin is a currency") efc26079… | French: "Bitcoin is a currency" |
| Feb. 9 | 935,829 | 5:45 PM | ORDER 1480 83865a4a… | order ref, unidentified |
| Feb. 10 | 935,887 | 2:30 AM | [LCA] | ENGINE:V1.052 | MODE:OPERATIONAL | STATUS:ACTIVE | ID:A018 2d94bef3… | structured beacon |
| Feb. 10 | 935,935 | 10:53 AM | Credit me fast 87d5d998… | wallet label |
| Feb. 10 | 935,968 | 5:12 PM | I love you 3c7a2300… | same block as FBI message |
| Feb. 10 | 935,968 | 5:12 PM | We are ready to pay. Contact us. https://pastes.io/private-ne 5004328866a… | FBI message to informant |
| Feb. 10 | 935,973 | 5:41 PM | #PardonSamourai 9d0ae12b… | advocacy graffiti |
WELP: All four full days came up empty of anything case-relevant. Every transaction across Feb. 5, Feb. 6, Feb. 9, and Feb. 10 was checked — 594 blocks, ~1,748,000 transactions total. The 47 readable messages found are standard blockchain activity: wallet labels, seed backups, DeFi receipts, political graffiti, personal inscriptions, and recurring automated beacons. The FBI's "We are ready to pay" message on Feb. 10 produced no readable on-chain response.
ELI5 & To-Do List
01
Which exchange received the FBI's $148?
Where: Blockchain explorer Blockchair shows transaction history for the Exchange Deposit Address (
3548M6Zb9Pixppji32BW7beCQBF8Fwikrm) but no exchange name. Try: Arkham Intelligence (intel.arkm.com), Breadcrumbs.app, or Crystal Blockchain — each maintains its own database of named exchanges.→ Whichever exchange operates this deposit address holds account records — name, email, and ID — for whoever opened it.
02
Who owns the two wallets from the March 2nd exchange payout that still haven't moved their money?
Address 1: bc1qkm8jf9khsg55n6c4v0mj8lwrxklr75852xfcx0 — received ~$4,330
Address 2: 3GdMC6FYtqiwcJPqW4rjgmAhGLLWwq9TZg — received a smaller amount
Where to check: WalletExplorer → paste each address to see whether it's connected to a known exchange or service
Address 2: 3GdMC6FYtqiwcJPqW4rjgmAhGLLWwq9TZg — received a smaller amount
Where to check: WalletExplorer → paste each address to see whether it's connected to a known exchange or service
→ When the exchange distributed funds on Mar. 2, 2026, every other recipient wallet quickly moved the money out. These two still haven't — which is unusual and could indicate cold storage, a locked account, or a wallet under active scrutiny.
03
What is the FBI Funding Wallet?
Where: WalletExplorer → paste
bc1q34zcc3lr9e9sg8cuna7g8xeazm7j9ds622ktpv→ This is the first wallet in the chain — where the FBI's funds originated before the operation began. Identifying it likely reveals which exchange the FBI used to purchase the Bitcoin.
04 · CHECKED — NO NAME FOUND
Who owns the 2022 Exchange Sweep Destination?
Checked: WalletExplorer shows no name for this address. Try Arkham Intelligence or Breadcrumbs.app:
bc1qse7x4e7eukgyp4y58vpuujwycfj0m42fn45d5a→ In 2022, the exchange swept deposits — including $140,764 — into this address before distributing them. It played the same role in 2022 that the Exchange Internal Wallet played in 2026. Identifying it would almost certainly name the exchange that received the FBI's $148.
04b
Who received 87% of the 2022 exchange payout?
Where: WalletExplorer → click
[0000016660] from the TX 75bb6114 output list→ When the exchange distributed the 2022 deposit, one address received ~$121,800 — 87% of the total. Identifying it could confirm which exchange is behind the deposit address and show where the bulk of those funds ended up.
05b
Who deposited $1,580 into the Exchange Deposit Address in June 2022?
Where: WalletExplorer or Blockchair → TX
05910f6494a568955cdcab674f3073b48226f1cc517280115488b1d58c8fb7a5 → look at the sending address→ The Exchange Deposit Address (3548M6Zb…) was used once in 2022 — four years before the Guthrie case — by someone who sent $1,580 to it. That person is either an ordinary exchange customer who happened to use the same deposit account, or the FBI using the same exchange account for an earlier unrelated operation.
05
What is the FBI Sending Wallet?
Where: WalletExplorer → paste
babe626d29 directly. Also try Arkham Intelligence, Breadcrumbs.app, or Crystal Blockchain.→ This is the wallet the FBI used to send the $152 USD on Feb. 10, 2026. Identifying which exchange or service it belongs to would confirm where the FBI purchased the Bitcoin for this operation.