SatsumapBitcoin transaction explorer
CASE ARCHIVE

Inspector

Real Bitcoin cases, told in sheets. Each case file follows the trail of a few transactions with Satsumap and public blockchain data. Max Labib reviews them.

12 case files3 open2 coming soon7 classified

THE CASE FILES

CASE 004
CLASSIFIED
  • First steps

The Patoshi pattern

How an inference is built from the traces left by mining in the early years, and why it is not proof.

When
2009 and 2010
Sheets
—
Status
Classified
CASE 005
CLASSIFIED
  • History

WikiLeaks accepts bitcoin

Donations arrive at an address WikiLeaks publishes. The chain shows how much comes in and when.

When
2011
Sheets
—
Status
Classified
CASE 006
CLASSIFIED
  • History

The first halving

The block reward is cut in half for the first time. It shows in the coinbase.

When
November 2012
Sheets
—
Status
Classified
CASE 007
CLASSIFIED
  • History

Silk Road and the FBI wallet

What the FBI seizes from Silk Road ends up at a known address. From there, every movement is in plain view.

When
2013
Sheets
—
Status
Classified
CASE 008
CLASSIFIED
  • History

The Bitfinex hack

Bitcoin is stolen from an exchange and, years later, the courts recover it. Following the money at scale.

When
2016 to 2022
Sheets
—
Status
Classified
CASE 009
CLASSIFIED
  • History

Bitcoin splits in two

The coins that existed up to that block also start to exist on Bitcoin Cash. What each chain shows.

When
August 2017
Sheets
—
Status
Classified
CASE 010
CLASSIFIED
  • History

The first Taproot transaction

Bitcoin's latest major upgrade activates. How it looks on the map.

When
November 2021
Sheets
—
Status
Classified
CASE 011
COMING SOON
  • Present day

Follow the money until it comes back

3,996 BTC leave a bridge, and a negotiation starts that is written on the chain, message by message.

When
September 2026
Sheets
—
Status
Coming soon
CASE 013
COMING SOON
  • Present day

Can the trail be broken?

Several people pool their coins in one transaction so nobody can tell whose is whose. Three ways to mix, and one that looks like mixing and isn't.

When
2023 to 2026
Sheets
—
Status
Coming soon

THE INSPECTOR'S TECHNIQUES

The case files are built with these tools. You can practice each one in Satsumap, on real transactions.

TECHNIQUE 1

Follow the money

Where a coin came from and where it went next.

How it works
Every transaction spends coins that an earlier transaction created, and creates new coins that someone spends later. The inspector jumps from one transaction to the next through those coins, backward or forward, and builds the chain.
On the map
On the left are the coins the transaction spent, and on the right the ones it created. Tapping one on the left, Satsumap loads the transaction it came from. Tapping one on the right that was already spent, it loads the one that spent it.
How far it goes
Going back, the trail ends at a coinbase, the transaction that creates new coins, and going forward at a coin nobody has spent yet. At each hop the path can branch, and the inspector decides which branch to follow.
Practice it on the map
TECHNIQUE 2

Find a live coin

Coins nobody has spent yet.

How it works
An output nobody has spent is called a UTXO. All the bitcoin that exists is split into coins like these.
On the map
Unspent coins have a green border and the UTXO mark in the corner.
How far it goes
A coin that hasn't moved doesn't say who holds it, or whether anyone still has its key.
Practice it on the map
TECHNIQUE 3

Catch a reused address

The same address showing up in more than one movement.

How it works
Spending what arrives at an address takes its key. If the same address receives several times, all those movements are tied to whoever holds that key.
On the map
Tags with a red dot in the corner use an address that already appeared somewhere else on the map.
How far it goes
It ties movements together. Knowing whose they are takes outside information, and a service that holds bitcoin for many customers can move different people's money through the same address.
Practice it on the map
TECHNIQUE 4

Tell the payment from the change

Which output is the payment and which one goes back to the payer.

How it works
A coin is spent whole, like a banknote. If it is worth more than what has to be paid, the rest goes back to the payer in a new output, the change.
On the map
Satsumap flags as likely change the output that repeats the address type of the inputs, because the same wallet usually builds it.
How far it goes
It is a hint. It fails when the wallet uses a different address type for the change, and some wallets do that on purpose.
Practice it on the map
TECHNIQUE 5

Spot a consolidation

A transaction that gathers many coins into one or two.

How it works
Spending each coin takes its key. When a transaction gathers ten or more coins into one or two outputs, they most likely all belong to the same owner, and the inspector ties them together.
On the map
Satsumap gives it the CONS mark. To find one, follow the inputs backward with the ◀ Inputs button.
How far it goes
The rule fails with a CoinJoin, where several people sign the same transaction together so nobody can tell which coin belongs to whom. And the shape does not say what it was for. An exact payment with no change also gathers many coins into a single output, and the money goes to someone else. Satsumap got this wrong with the 2010 pizza payment.
Practice it on the map

THE SPECIMENS

Real transactions, one of each kind, to learn to recognize them on the map.

February 18, 2025

Just any transaction

It looks like an ordinary payment, and it carries a BRC-20 inscription in the witness, RBF enabled, and the change sent back to the same address.

TX f0a1f254…535eaa5e
Open it on the map
September 6, 2026

A batch payment

One input and twenty outputs. This is how a service pays many people at once, with a single fee.

TX 0498de35…688e3efa
Open it on the map
September 6, 2026

A consolidation

Thirty-four small coins gathered into two. It is done when fees are cheap.

TX 78f17bf5…c289b6b2
Open it on the map
September 6, 2026

A 2-of-3 multisig

Spending it took two signatures out of three keys. The script is only revealed when it is spent.

TX 0efd8424…b69a688a
Open it on the map
September 6, 2026

Today's coinbase

A 3.125 BTC reward plus fees, and several OP_RETURN outputs with the commitments the pool writes into the block.

TX 0c678647…d2b4b600
Open it on the map
September 6, 2026

A message in OP_RETURN

An output that can't be spent and exists only to leave a piece of data. Here, readable text.

TX 282a1ce1…a5f66502
Open it on the map
September 6, 2026

Runes: tokens on Bitcoin

A runestone in OP_RETURN moves Runes protocol tokens; the money goes back to the same addresses.

TX 53e3cf5f…fc6867c1
Open it on the map
September 6, 2026

An Ordinals inscription

Text written to the chain inside the witness of a Taproot input. Look at the content type and how many bytes it takes.

TX f4dcef38…b587ac30
Open it on the map

HOW TO READ A CASE FILE

What the chain showsEvery fact comes with the number of its transaction. Anyone can check it in Satsumap.
What is known from outsideNames, stories and motives are not on the chain. When they show up, the sheet says who tells them.
What is not knownIf something is an assumption, the sheet says so. The chain shows which coins move together; it doesn't say whose they are.