SPOILER. Don't read this post if you don't want to know the answer.
These 4 transactions look like classic payments:
- several inputs controlled by a payer are merged
- an amount is sent to an address controlled by a payee
- change is sent to an address controlled by the payer
Actually, it's possible (likely ?) that these transactions were classic payments, but they might be something else: "steganographic transactions"
Let's see the
3rd transaction:
- The 1st output (19z5fD6LhhiRupqezw7vi3fuumt5jCS9LU - 0.01 BTC) seems deterministically linked* to the 2nd input (1P3RfYxRTkTLdwXAVYzh41sfyMgzppELZA - 0.01 BTC)
- The 2nd output seems deterministically linked* to the others inputs
It means that this transaction might be:
- a classic payment transaction built by a single user
- a manually crafted transaction merging a txo controlled by a user A (the 2nd input) with txos controlled by a user B (the others inputs). No payment is done. The transaction just sends the coins to others addresses controlled by the users.
- ... (more weird scenarii)
This second interpretation has some "fun" properties:
- detection of this pattern is quite hard for human eyes
- it breaks the "merged inputs" heuristic used by some tools in order to clusterize addresses in wallets
A few remarks:
- The 4th transaction is similar to the 3rd transaction (no fee)
- The 1st and 2nd transactions have the same property but they pay a fee and the pattern is even more difficult to detect.
Example: In the 1st transaction, the 3rd input (14okJQwaHJ3xHBtdU3LxqUEuXcsHhz9gtE - 0.01301568 BTC) seems deterministically linked to the 1st output (1Njw6FuxuVk293LwYREHxvUVUhx5MfzJLf - 0.01251568 BTC)
It remains a "mystery" for the 3rd and 4th transactions:
If they're classic payments, I don't know why the wallet has added an additional input/output. Hypotheses:
- a feature of the wallet, ensuring that there's always a minimum of 2 outputs ?
- a bug in the algorithm selecting the inputs ?
- manually crafted transactions ?
I wouldn't be surprised if someone already discussed this pattern. On my side, I've spotted the transactions this morning, while doing some tests, and found it was a funny coincidence (because, you know...easter eggs).
*: "deterministically linked" means the input and the output are linked whatever the correct interpretation of the transaction. I wrote "seems" because, with some more advanced scenarii, this statement might be proven wrong.
