Rare address hall of fame

[LoyceV]

Here's an interesting case, connected to the Mercado Bitcoin hack that happened today.
The hacker appears to use the following 2 addresses, which share an amazingly long 27 character prefix!

Or, and that's my guess, it's a major fuckup: the 2.5 Bitcoin address sent funds, but the 106 Bitcoin address hasn't sent anything. So my guess is the first address is just an old generic legacy address, and the second address is a burn address that looks like it and has a valid checksum.

[odolvlobo]

Here's an interesting case, connected to the Mercado Bitcoin hack that happened today.
The hacker appears to use the following 2 addresses, which share an amazingly long 27 character prefix:  
 
 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp   (received 106 BTC today)
 https://mempool.space/address/19qGpsHvzh1t6pVi526XNNkh6hW6prDZp

 19qGpsHvzh1t6pVi526XNNkh6hW53ZYvU3  (received 2.5 BTC today)
 https://mempool.space/address/19qGpsHvzh1t6pVi526XNNkh6hW53ZYvU3

One of those addresses is just a burn address. They did some clever math to get the first characters of the burn address to be the same as the real address. Both are valid addresses, but they have the private key for only one.

The method is a Base58 digit shift: divide the real hash160 by 58.

The hash160 for 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp is 0x01ab9fb3fc7394a4b41101949320ad4c29232fb2 and the hash160 for 19qGpsHvzh1t6pVi526XNNkh6hW53ZYvU3 is 0x60e22ec7322fad50cbda5ba95567434151f8ce77.

0x01ab9fb3fc7394a4b41101949320ad4c29232fb2 = 0x60e22ec7322fad50cbda5ba95567434151f8ce77 / 58

They sent 2.5 BTC to the real address 19qGpsH...53ZYvU3 and burned 106 BTC. Oops!