Hall
006 Solved Size extremes

One transaction has 20,000 inputs. Was this an attack, a mixer, or housework?

Most payments have one or two inputs. Transaction 52539a56… has twenty thousand. It still fits in a block.

Block
orphaned
Date
1 Jul 2015
Inputs / outputs
20000 / —
Miner
Unknown
Transferred
—
Fee
—
Then
—
Now
—
Txid 52539a56b1eb…170a2f8980c1 Explorer

The appearance

A transaction this wide looks like an attack: thousands of tiny UTXOs swept at once, the pattern dust-bombers use to bloat blocks and deanonymise wallets. It also looks like a mixer. The honest third reading is the least cinematic: someone did the dishes.

Case file sealed

Investigation notes, the reconstruction, and sources sit behind this seal. Open it when you have sat with the raw transaction.

Open the case file

The investigation

  1. 01 UTXOs are liabilities

    Every output you receive is a separate coin. Spend a large amount later and your wallet must gather enough coins to cover it. Each input adds bytes, and fees are per byte, not per bitcoin. If you expect fees to rise, you consolidate while they are cheap: sweep thousands of small UTXOs into one, pay once, and hold a single coin.

  2. 02 Size is the constraint, not the count

    A pre-SegWit block is 1 MB. A legacy input is ~148 bytes. Twenty thousand inputs is about 3 MB of raw input data — too big unless the transaction uses tricks, is post-SegWit, or the count sits near a different era’s limits. LearnMeABitcoin cites 52539a56… as the largest input count they had observed. The shape is consolidation, not a payment to 20,000 people.

Reconstruction

Housework. An entity — an exchange, a payment processor, or a very patient hodler — collapsed a gigantic UTXO set into something spendable. The 'attack' reading fails because a dust attack sends many outputs to victims; this transaction consumes many inputs of its own. Mixers also look busy, but they balance inflows and outflows. This is a vacuum cleaner.

Sources