Hall
001 Probable Fee disasters

Someone sent $2.1 million and paid $3.1 million in fees. Why?

On 23 November 2023 a brand-new wallet spent 139 bitcoin and left 83.65 of them on the table for Antpool. The fee was one and a half times the payment.

Block
818,087
Date
23 Nov 2023
Inputs / outputs
1 / 1
Miner
Antpool
Transferred
55.77 BTC
Fee
83.655 BTC
Then
$2.09M / fee $3.13M
Now
$4.35M / fee $6.53M
Txid Identified by block 818,087 Explorer
Inputs139.425 BTC
Paid out55.77 BTC
Fee83.655 BTC

The appearance

A wallet that had existed for minutes broadcast a transfer of 55.77 BTC. The implied fee was 83.65 BTC — about $3.1 million at the day’s price, and 120,000 times the going rate in that block. There was no change output. 99% of fee disasters look like a forgotten change address. This one did not.

Case file sealed

Investigation notes, the reconstruction, and sources sit behind this seal. Open it when you have sat with the raw transaction.

Open the case file

The investigation

  1. 01 The arithmetic is too clean

    Mempool developer @mononautical noticed that 83.65497568 BTC is exactly 60% of the 139.42495946 BTC input. The same address also swept a 100,000-satoshi UTXO in a separate transaction, paying exactly 60,000 sats as a fee. A human fat-fingering a wallet does not hit 60% twice.

  2. 02 Replace-by-fee made it worse

    The transaction was marked replaceable. The last RBF bump added another 20% — 12.54 BTC — on top of an already absurd fee. Someone, or some script, was bidding against time.

  3. 03 A competing sweeper

    The sending address showed signs of a low-entropy key: the kind of wallet an automated scanner can crack. When two bots find the same weak key, they race. A common tactic is to donate most of the UTXO as a fee so miners prefer your sweep over the other bot’s. Sixty percent is a round, programmable number.

  4. 04 Someone claimed the key

    A user posting as @83_5BTC later produced a signature over the sending address. Jameson Lopp confirmed the signature. That does not prove the original intent, but it proves the key was in a human’s hands after the fact — consistent with a compromised or weak wallet, not with a retail user who typed the wrong fee field.

Reconstruction

The leading reconstruction is not a missed change output. It is a fee-as-weapon sweep: an automated script draining a weak-entropy wallet, programmed to burn a fixed fraction of each UTXO as a miner bribe so the transaction would win a race against other scanners. Antpool kept the 83.65 BTC. Unlike the 2016 BitClub fee and the 2021 Paxos fee, there is no public record of a return.

Still open: We do not know who generated the weak key, which software produced the 60% rule, or whether the later claimant was the original owner, a white-hat, or the sweeper.

Sources