How to find multisignature transactions ?

[kristiano92]

Hi,

How can I find multisignature transactions e.g. 2of3, 2of2 ?
I dowloaded many raw transactions but I haven't seen any parameter with more than 1 required signature.

For instance, here it is possible to see few multisig addresses https://bitinfocharts.com/pl/top-100-richest-bitcoin-addresses.html

How this statistics are made ? I would like to divide multisig into e.g multisig 2of2, 2of3
https://btc.bitaps.com/statistic/outputs

[1714111903]

1714111903

[1714111903]

1714111903

[ABCbits]

You need to extract the script of each transaction, then check whether it uses operator such as OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY

See https://bitcoin.stackexchange.com/a/71869 if you're confused how to interpret the script.


Example with transaction78c93aaa2f7fbcf08c528a0dcb691393e50446d71eef30ac5baa0183df33a5b9 with input address 3FuqMT3VeyRhB917aiJUeWSn2jRt4M3hw8

1. Get raw transaction

Command :

Code:

getrawtransaction 78c93aaa2f7fbcf08c528a0dcb691393e50446d71eef30ac5baa0183df33a5b9

2. Decode raw transaction

Command :

Code:

decoderawtransaction 0200000001ac1408fc8b58a2f1962611b3c52688d3c4e77321bdd2890275c3b9b2e025501000000000fd8901004730440220576976125dfb46f9d617f41b1d8f3c666ae1107610ad910a627cb3eaf18705fc0220219e462d580eb66bf3d4d4d2fbd7f0164d340d23ddf90b82f858b2d3f0ce66bb01473044022001c668407ebcfcea5c5eb406090c2946f6a91bd9881501e834924c2c4e8f588002207f12bdefe185390f28673b95da88b48222fb681c3b1f45083cde814a416e866a01483045022100db620adb2687098ab9961780a76782ccb0241e75882218ff3be8bb99de09fe3502206c929b3cb1c4f289619f9a6cde83caa41a33d2de230d74c11903b48a5fa3bc03014cad532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055aefdffffff0190aef5050000000017a9145aff956682d511d872eed2fa91971efa9d9fd95b87022f0900

The output :

Code:

{
  "txid": "78c93aaa2f7fbcf08c528a0dcb691393e50446d71eef30ac5baa0183df33a5b9",
  "hash": "78c93aaa2f7fbcf08c528a0dcb691393e50446d71eef30ac5baa0183df33a5b9",
  "version": 2,
  "size": 478,
  "vsize": 478,
  "weight": 1912,
  "locktime": 601858,
  "vin": [
    {
      "txid": "105025e0b2b9c3750289d2bd2173e7c4d38826c5b3112696f1a2588bfc0814ac",
      "vout": 0,
      "scriptSig": {
        "asm": "0 30440220576976125dfb46f9d617f41b1d8f3c666ae1107610ad910a627cb3eaf18705fc0220219e462d580eb66bf3d4d4d2fbd7f0164d340d23ddf90b82f858b2d3f0ce66bb[ALL] 3044022001c668407ebcfcea5c5eb406090c2946f6a91bd9881501e834924c2c4e8f588002207f12bdefe185390f28673b95da88b48222fb681c3b1f45083cde814a416e866a[ALL] 3045022100db620adb2687098ab9961780a76782ccb0241e75882218ff3be8bb99de09fe3502206c929b3cb1c4f289619f9a6cde83caa41a33d2de230d74c11903b48a5fa3bc03[ALL] 532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055ae",
        "hex": "004730440220576976125dfb46f9d617f41b1d8f3c666ae1107610ad910a627cb3eaf18705fc0220219e462d580eb66bf3d4d4d2fbd7f0164d340d23ddf90b82f858b2d3f0ce66bb01473044022001c668407ebcfcea5c5eb406090c2946f6a91bd9881501e834924c2c4e8f588002207f12bdefe185390f28673b95da88b48222fb681c3b1f45083cde814a416e866a01483045022100db620adb2687098ab9961780a76782ccb0241e75882218ff3be8bb99de09fe3502206c929b3cb1c4f289619f9a6cde83caa41a33d2de230d74c11903b48a5fa3bc03014cad532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055ae"
      },
      "sequence": 4294967293
    }
  ],
  "vout": [
    {
      "value": 0.99987088,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_HASH160 5aff956682d511d872eed2fa91971efa9d9fd95b OP_EQUAL",
        "hex": "a9145aff956682d511d872eed2fa91971efa9d9fd95b87",
        "reqSigs": 1,
        "type": "scripthash",
        "addresses": [
          "39zAv4u6QBSmUAttAUP6bLvENRMZuNAJaP"
        ]
      }
    }
  ]
}

3. Decode the script from vin -> scriptsig -> asm. Only take hex script after last "[ALL]"

Command :

Code:

decodescript 532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055ae

The output :

Code:

{
  "asm": "3 02002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd1 026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c21 029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd 02c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd316 03ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf0 5 OP_CHECKMULTISIG",
  "reqSigs": 3,
  "type": "multisig",
  "addresses": [
    "1LqxDSWQLcg3nKvmWNAGoADMPzswHpLcKj",
    "1NTkRiGiZP1FoSb6JkraMH4TyoKG3WMXzT",
    "1D7Wmurjy264dpZK8LdJ1xc3f6ALAcNJAx",
    "1HapYFsTiZBdXe1L1hegv11yM3apJWxZui",
    "1Fdhk674u3WejXsJmpxsyQss5VMvYd8j87"
  ],
  "p2sh": "3FuqMT3VeyRhB917aiJUeWSn2jRt4M3hw8",
  "segwit": {
    "asm": "0 259ea6036131f75feb83db7882dfd5a91fb9bcebb270e3c2f68991c54a64b2dc",
    "hex": "0020259ea6036131f75feb83db7882dfd5a91fb9bcebb270e3c2f68991c54a64b2dc",
    "reqSigs": 1,
    "type": "witness_v0_scripthash",
    "addresses": [
      "bc1qyk02vqmpx8m4l6urmdug9h744y0mn08tkfcw8shk3xgu2jnyktwqnxdsjq"
    ],
    "p2sh-segwit": "389rC5x48fCbcmsWirjyGorUsS4mf7Ldwx"
  }
}

From the output, we can see it uses 3-of-5 multisignature and it matched with information from https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html. CMIIW.

[kristiano92]

Thanks for this explanation Is it possible to decode also outputs in this way to check that it is multisig address ?

[nc50lc]

Is it possible to decode also outputs in this way to check that it is multisig address ?

No, you can only tell by the input.
A P2SH-multisig output will look like any other P2SH outputs: HASH160 of the redeem script.

Example, use the "vout" of the decoded transaction in ETFbitcoin's post:

Code:

  "vout": [
    {
      "value": 0.99987088,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_HASH160 5aff956682d511d872eed2fa91971efa9d9fd95b OP_EQUAL",
        "hex": "a9145aff956682d511d872eed2fa91971efa9d9fd95b87",
        "reqSigs": 1,
        "type": "scripthash",
        "addresses": [
          "39zAv4u6QBSmUAttAUP6bLvENRMZuNAJaP"

P2SH outputs will look like: OP_HASH160 RIPEMD-160(SHA256(RedeemScript)) OP_EQUAL
SHA256 and RIPEMD-160 hash are irreversible.

[Chikito]

you also can check in decode script

Code:

decodescript 532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055ae

see the second line to know how many signers 532102002a57268073cbc.... (you can see 3 signers)

Example

[pooya87]

see the second line to know how many signers 532102002a57268073cbc.... (you can see 3 signers)

it is actually 53 not 3 which is the byte representing OP_3 in bitcoin which pushes number 3 onto the stack. for example number 10 will be OP_10 and is represented by byte 0x5a.
you can use up to 15 compressed public keys or 7 uncompressed ones in a P2SH redeem script in multisig scheme (15of15 or 7of7).

by the way the thing that makes this a multisig script is the 0xae or OP_CheckMultiSig at the end not the 53 at the beginning.

[kristiano92]

Thanks for this explanation Is it possible to decode also outputs in this way to check that it is multisig address ?

No, you can't even know the script itself before the address is used as input.

On a side note, when Taproot is activated on Bitcoin network, you only can see part of the script used to redeem input.

Okay So I am not able to check that transactions outputs are P2SH-Multisig ?

3. Decode the script from vin -> scriptsig -> asm. Only take hex script after last "[ALL]"

Command :

Code:

decodescript 532102002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd121026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c2121029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd2102c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd3162103ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf055ae

The output :

Code:

{
  "asm": "3 02002a57268073cbc5472d35d8f8fae2c52825241592f53e53ae516913d8c82bd1 026c1061b95ccfc52594c9b376382e2f0240a523b3b1dc5db6a9cdd9730a4a0c21 029e8c3ae6c0516df4075089ab9475c9335985569ac0f3b9f1a4b0d946785937cd 02c6a7c72de9221cba7029f1b920a86bb84997d9c91a2e4428b1397cba669dd316 03ba7c7d7b8d2379de450441445c30a638c555305cbe044abb88f10643d9621bf0 5 OP_CHECKMULTISIG",
  "reqSigs": 3,
  "type": "multisig",
  "addresses": [
    "1LqxDSWQLcg3nKvmWNAGoADMPzswHpLcKj",
    "1NTkRiGiZP1FoSb6JkraMH4TyoKG3WMXzT",
    "1D7Wmurjy264dpZK8LdJ1xc3f6ALAcNJAx",
    "1HapYFsTiZBdXe1L1hegv11yM3apJWxZui",
    "1Fdhk674u3WejXsJmpxsyQss5VMvYd8j87"
  ],
  "p2sh": "3FuqMT3VeyRhB917aiJUeWSn2jRt4M3hw8",
  "segwit": {
    "asm": "0 259ea6036131f75feb83db7882dfd5a91fb9bcebb270e3c2f68991c54a64b2dc",
    "hex": "0020259ea6036131f75feb83db7882dfd5a91fb9bcebb270e3c2f68991c54a64b2dc",
    "reqSigs": 1,
    "type": "witness_v0_scripthash",
    "addresses": [
      "bc1qyk02vqmpx8m4l6urmdug9h744y0mn08tkfcw8shk3xgu2jnyktwqnxdsjq"
    ],
    "p2sh-segwit": "389rC5x48fCbcmsWirjyGorUsS4mf7Ldwx"
  }
}

Could you explain what params "ps2h" and "p2sh-segwit mean ? What are these two addresses: "bc1qyk02vqmpx8m4l6urmdug9h744y0mn08tkfcw8shk3xgu2jnyktwqnxdsjq" and "389rC5x48fCbcmsWirjyGorUsS4mf7Ldwx" ?

[pooya87]

Okay So I am not able to check that transactions outputs are P2SH-Multisig ?

not by only having the output alone because it is the hash of a redeem script which can be any script including a multisig one.

Could you explain what params "ps2h" and "p2sh-segwit mean ? What are these two addresses: "bc1qyk02vqmpx8m4l6urmdug9h744y0mn08tkfcw8shk3xgu2jnyktwqnxdsjq" and "389rC5x48fCbcmsWirjyGorUsS4mf7Ldwx" ?

the "decodescript" command is taking the redeem script and converts them to 3 different pubkey scripts.
* one is called P2SH which is RIPEMD160 of SHA256 of serialized redeem script (aka HASH160 of it). and its format is OP_HASH160 <hash> OP_EQUAL. the corresponding address is 3FuqMT3VeyRhB917aiJUeWSn2jRt4M3hw8

* another is P2WSH which is similar to P2SH but using SegWit so it is SHA256 of serialized redeem script and its format is OP_0 <hash>. the corresponding address is bc1qyk02vqmpx8m4l6urmdug9h744y0mn08tkfcw8shk3xgu2jnyktwqnxdsjq

* and finally the nested SegWit or P2SH-P2WSH which is like a combination of the above two. it is using SegWit while being "nested" inside a backward compatible P2SH script. its pubkeyscript format is the same as P2SH but the script that it hashes is a redeem script that is created using SHA256 hash of the original redeem script with this format: OP_0 <hash> and its corresponding address is 389rC5x48fCbcmsWirjyGorUsS4mf7Ldwx

read about scripts: https://en.bitcoin.it/wiki/Script

[Timelord2067]

You may find that the reason you haven't encountered any multisig transactions is because they are primarily used for the storage of wealth (think the Forum's Funds) whereby three or four people are required to sign to release the funds when needed.  The transaction amounts will most likely be much higher values (one off shifting of large sums) than day-to-day $ 10, $20 transactions.

Some people will utalise two-of-three multisig for betting (the two having the wager and the third - an intermediary/escrow who decides who won and pay out the funds) - It might pay to ask the Escrows here if they can point you towards such TX's

Another avenue is to look at Lightning Network channel creations whereby funds are locked away.  Given the nodes are listed publicly as are the channels (the two party connections) which are multi signature to create the channel and release the funds when the channel is closed.

Hope this approach helps you.

[kristiano92]

Thanks for your replies

I use bitcoin-etl to download data from the blockchain. So which parameters can be useful to recognize and analyze addresses/transactions? How to recognize segwit addresses (pubkeyhash could be multisig or segwit) ?
I think about "inputs": "script_asm", "required_signatures", "type"; "outputs": "required_signatures", "type". What do you think ?

Code:

{
  "hash": "412910031c9677c24d08a27034c994564ca0801a7817b4fa0e6d38ab425508cc",
  "size": 223,
  "virtual_size": 223,
  "version": 1,
  "lock_time": 0,
  "block_number": 641225,
  "block_hash": "00000000000000000001c40a6317eec0cdd1b669a237bf1e049d7f70d56a8345",
  "block_timestamp": 1595969476,
  "is_coinbase": false,
  "index": 379,
  "inputs": [
    {
      "index": 0,
      "spent_transaction_hash": "1ad97eaf9013507e0f2ae8f42a4381adf2141b45ca874c5e0b1956c60854f4ec",
      "spent_output_index": 2,
      "script_asm": "30440220357d50e85dd29c52e54bc14dde809956abe1ac691a5fb6ffc46f79ace749b2bd02201447841e72078f0b2f9b512bea3d91e2b787ef6f3318c4c0192a4266f0d6d7ac[ALL] 0292423edb90a4b950ecf25bc0b76173ebea211bb56c5f7d05518bd02603b97ded",
      "script_hex": "4730440220357d50e85dd29c52e54bc14dde809956abe1ac691a5fb6ffc46f79ace749b2bd02201447841e72078f0b2f9b512bea3d91e2b787ef6f3318c4c0192a4266f0d6d7ac01210292423edb90a4b950ecf25bc0b76173ebea211bb56c5f7d05518bd02603b97ded",
      "sequence": 4294967295,
      "required_signatures": 1,
      "type": "pubkeyhash",
      "addresses": [
        "13yQitAQzggzTr6dw7Qe5PZnGhsoMxjrEM"
      ],
      "value": 59822256
    }
  ],
  "outputs": [
    {
      "index": 0,
      "script_asm": "OP_HASH160 8f7c778eb3d10e78f19e42c4e810c0c4748cd15c OP_EQUAL",
      "script_hex": "a9148f7c778eb3d10e78f19e42c4e810c0c4748cd15c87",
      "required_signatures": 1,
      "type": "scripthash",
      "addresses": [
        "3Emhf6WMZSgqZorB2SeymSE55XeL3JLcqa"
      ],
      "value": 3636800
    },
    {
      "index": 1,
      "script_asm": "OP_DUP OP_HASH160 3948bdcd3ae6de4ced68de778bbd88c27b18e75f OP_EQUALVERIFY OP_CHECKSIG",
      "script_hex": "76a9143948bdcd3ae6de4ced68de778bbd88c27b18e75f88ac",
      "required_signatures": 1,
      "type": "pubkeyhash",
      "addresses": [
        "16Dtf6axb6BYXXmMmdhTNuqHFSePDg1654"
      ],
      "value": 56153138
    }
  ],
  "input_count": 1,
  "output_count": 2,
  "input_value": 59822256,
  "output_value": 59789938,
  "fee": 32318
}

[nc50lc]

I think about "inputs": "script_asm", "required_signatures", "type"; "outputs": "required_signatures", "type". What do you think ?

Looks good as long as it supports SegWit, otherwise it won't recognize them.
Based on the description: github.com/blockchain-etl/bitcoin-etl-airflow - transactions.json#L125-L127

Code:

            {
                "name": "type",
                "type": "STRING",
                "description": "The address type of the spent output"
            },

Alternatively, for bitcoin-cli / console: look for OP_CHECKMULTISIG or OP_CHECKMULTISIGVERIFY at the end of the script.
That's 0xAE or 0xAF at the end of either asm or hex.
If it is SegWit, it should have "txinwitness" and it's at the end of it.

-Edit-

OP_CHECKMULTISIGVERIFY may not appear at the end of the script.