Strange Null Data (OP_RETURN) Transactions

[Security Engineer]

Hello,

I have noticed thousands of Null Data (OP_RETURN) Transaction and these transactions sometimes have milliseconds between them always sending the exact same amount of bitcoins which makes the transactions identical.

I have searched before for repeated R values and I think this null data transactions are very strange.

I have extracted data from these transactions but I was failed to identify what kind of string they are. I see in thousands of transactions.

As I said everything in the transaction is identical except the data which looks like this:

Transaction 1:
Data 1: kkjtdb3vja6bzo42uqe5spjqbahvowoqjkb8fzbu56ffff4ta6vr2ag74c36ezgrindxecwpx8shggyq6vk8potpkhbeya4r

Transaction 2:
Data 2: kkjtdb3vja6bzo42uqe5spjqbahvowoqjkb8fzbu56ffff6vwtuh2bzvojmmdbxk347hfo95nhzsqiopkfb6pr7zdgmqcw

As you see the half of the data is the same. It is 92 character long and the first 46 of that is always the same in every transaction.

In other words everything exactly looks the same in different transactions except the last 46 character of the unidentified string in data.

I have that feeling that this is similar to the repeated R values but maybe I'm wrong that is why I asking here.

I currently targeting the address which sent these transactions because there is 7 BTC left on that unused address.

Thank you

[pooya87]

that is usually how OP_Return outputs look like, they insert a certain type of "data" into bitcoin blockchain that sometimes has a certain purpose so it starts with the same bytes. sometimes it is just concatenated bytes and sometimes it is a full script that could be run. for example someone posted this 2 days ago: https://bitcointalk.org/index.php?topic=5179450.0
other than that i don't think anybody can give you any more information unless you also post the transaction IDs.
also i don't see how you think this has anything to do with reusing k values for ECDSA (which is i assume what you meant by "repeated R"). can you explain why you think that? have you checked their signature and saw the same R being repeated?

[Security Engineer]

that is usually how OP_Return outputs look like, they insert a certain type of "data" into bitcoin blockchain that sometimes has a certain purpose so it starts with the same bytes. sometimes it is just concatenated bytes and sometimes it is a full script that could be run. for example someone posted this 2 days ago: https://bitcointalk.org/index.php?topic=5179450.0
other than that i don't think anybody can give you any more information unless you also post the transaction IDs.
also i don't see how you think this has anything to do with reusing k values for ECDSA (which is i assume what you meant by "repeated R"). can you explain why you think that? have you checked their signature and saw the same R being repeated?

I just modified the python script to scan for repeated R correctly because the old script had some limitations. This address has 30,000+ transactions to scan. At least this transactions don't have witness. (Transactions with witness always result in repeated R according to this script...to scan them properly also need to run a full segwit node[miner] to see the signatures) I will update you with my finding in an hour or so.

Reused R with Witness (just an example one of my old scan)

Code:

Address:  1757jTnwZTQtH6kdvTDA8gZzcEe9bWF5RQ
number of txs: 44
#################################################################################
........................................
#################################################################################
Resued R-Value: 
d642c916dca24dd8075ef62ce889796938f56fb1aa63f334197091267232
In Input NR: 9[global increment] 2200206abe9d5b0b43f27471f4a29653600d6db5e5d698d716b8068bf49cd57e9e9c58

Resued R-Value: 
9d5b0b43f27471f4a29653600d6db5e5d698d716b8068bf49cd57e9e9c58
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 33[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 94[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 94[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 94[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 98[global increment] 220020b67073a7774403ea1dc5b1f66c37869545e1257f399d5256f2b9ff9058bfcf56

Resued R-Value: 
73a7774403ea1dc5b1f66c37869545e1257f399d5256f2b9ff9058bfcf56
In Input NR: 111[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 111[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 128[global increment] 220020336bd0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332

Resued R-Value: 
d0d58152786a9b8e38e954c9f4e37307132b226046c2df5690a986dd3332
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 158[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 184[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 185[global increment] 22002065a1dbfdff46ac9ac584bd5a546ad9d1dc490b2eda71fd34ff172e7d634f40ce

Resued R-Value: 
dbfdff46ac9ac584bd5a546ad9d1dc490b2eda71fd34ff172e7d634f40ce
In Input NR: 194[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 194[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 194[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 194[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 194[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 196[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 196[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 196[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 196[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 198[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 198[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 198[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 202[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 202[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 204[global increment] 22002002fdac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151

Resued R-Value: 
ac89f28b8efff49638aa91fca25e7616b21eda3cb9cd7199107cc47f6151
In Input NR: 255[global increment] 220020619e236c9dacae4ef40a703e5f2cbcbacc2deeb8a2cf132c07fd42d5b6e65146

Resued R-Value: 
236c9dacae4ef40a703e5f2cbcbacc2deeb8a2cf132c07fd42d5b6e65146

all the secrets lie in the bytes if you look under the hood!
as the other poster said these are Omni layer transactions. the way to recognize them is first their OP_Return output which you would see as a red text on blockchain.com saying "Unable to decode output address" but looking under the hood you could see the output is this:

Code:

6a146f6d6e69000000000000001f0000000e45c3c500

the initial 4 bytes being 6f6d6e69 is an indicator of Omni

in case you are more interested:
6f6d6e69 Omni marker
0000 version
00000000001f tether marker
0000000e45c3c500 amount = 61,300,000,000

The transactions in question in this topic including this output: 9bf7e6a..... Not looking like Omni

[pooya87]

Code:

Address:  1757jTnwZTQtH6kdvTDA8gZzcEe9bWF5RQ
number of txs: 44

this address has 154 transactions and first of all it has 0 OP_Return data in it so i don't know how this relates to your topic.
secondly i did a quick check on a bunch of transactions sent out of this address and i didn't see any repeated R values either:

Code:

0b496347f58379cd53a11187e5cf9305aa62823b8773eb75cf41de1bba8bbbb4
296b177dc9d9c951a540d419a82010492fff9ffe0707ee80244a15d5293600b4
2b7fcab6ff6d4c86e30ca27b46ad1e85f928bfbbe5263236d97e1ec1cc0dd73b
2f040250430cb26645733c75214d6ec3dbbadcec76963843ffc0fb9b6765956f
3252e43b4e11df0ca7c344fe9e73f13de3bd56ae18b9dfe09e1097973d2ac3b6
3ec86eaea201763e54d5b0eeefd453df6c6d3b8a07a5c1b09aebe86056d085ba
4b918b39452955f112c5d5d8cd247f1d92a181a86c53128e2e39833d7cd706d3
6bebe10de4a91cb3cbd07a703f4ca36add13adbbeef6aec61d39e8fc7b677ac5
0089e0674ddf6a77424801517dcaf427814eb523f482fab30c0f8dfdd63d0efb20
008a8eb528b9f6b68cc0e8f91d55706ab5b9d6302ef085a5ef6ed84e5a9917b624
0090d516ae0ad7ec4fd52807eb7801e18bab74e56c9b5f51937941ae65cc3e6abe
00ae4c9263b2b7158f9e36cfd13b0fd8e05de54f8a1e3fbb3bf5cd64e2643abcc0
00ba7bda7bc78d24504e34d69e4c9cf42a9571733dd8efa6e9dfa3b723e4bd2a42
00be30a03cf61e7f106b34d70902aa40df7747ba392a5dd770ce90f7e1769a21d8
00bfaba439c3678be3f6cb5ac4566e7a3bb030f43b8127cd68992047c793c67834
00c17f32446261ad2385a9a628b4adba21a1a12b2e1e9499494d2f146bb316a69e
00e2ed3d8d3d5743abd150a14675b60bca38b64b39de73348e69460439ed70bfb6
00f8c11b298b32558fd17d80a48581349754f13fc332dc706c8a6d463d86834eb0
00f974a00288a4366f2ad2e8921793e3ab74e21be28defc2802663f7e95142abb4

i obviously didn't go through them all so please post the 2 actual transaction IDs that have a signature with repeated R value next time.

The transactions in question in this topic including this output: 9bf7e6a..... Not looking like Omni

it was obviously just an example!