Cases
Famous spends, on-chain vs rumor
Each case separates what the chain shows from what people said about it. The chain part is dated observation at a cited explorer link; the published part is quoted material with its date; the conclusion is labelled interpretation. A handle here is never an identity, and a matched scalar never names a person.
How to read a case
Each case below keeps four things separate: the on-chain observation (block, UTC time, address, explorer figures as dated observations of that address), the cryptographically checkable material (a published scalar against the catalog compressed public key and the P2PKH address), the self-attribution or community report attached to it, and the rumor layer. The rumor layer is not hidden — it is useful, because the stories people tell about a spend are part of the puzzle record — but it is never promoted to fact. Published scalars quoted here are already-public historical solve records for addresses that are spent; they are reproduced as published evidence, not as anything to hunt with. No live balance is claimed: the explorer link is the current state, and this atlas does not poll it.
Case #66 — same-day spends, public broadcast
Address 13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so. Multiple transactions on 12–13 September 2024 (blocks 861068, 861069, 861166), with further activity on the address afterwards. Explorer observation at the time of the spot-check: 6.60321602 BTC funded and fully spent across 50 transactions (chain re-checked 2026-09-12: funded equals spent to the satoshi). The published scalar 0x2832ed74f2b5e35ee matches the catalog compressed public key and this address. Same-day confirmed spends at blocks 861068 and 861069 move different UTXOs; block 861166 is a 12-sat receive. This page does not treat unconfirmed replacements as chain facts.
What the story adds, and does not establish
Stories that a bot recovered the key in tens of seconds after a mempool broadcast, or that the original finder lost the coins to that bot, are community interpretation. They are plausible given P2PKH scriptSig leakage — a spend in the mempool publishes the public key before confirmation — but plausibility is not evidence, and no published account ties a specific bot, operator or intent to these transactions. Finder identity and theft intent are not proven on this page. #66 is also the case where the atlas deliberately refuses a single narrative: confirmed same-day spends move different UTXOs, and who controlled what is unresolved.
Observed: several spends in mid-September 2024
Several spends in mid-September 2024, including confirmed activity at blocks 861068 and 861069 (different UTXOs) and a 12-sat receive at block 861166.
Verified: published key matches the address
The published scalar produces the catalog compressed public key and the P2PKH address 13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so.
Not established: finder identity, bots, intent
Finder identity and the popular “stolen by bots” account are not proven by the transactions or by any cited publication.
Case #69 — key near the start of the range
Address 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG. Key 0x101d83275fb2bc7e0c. Range [268, 269 − 1]; the offset from 268 is 0.72% of the interval. Two spends in blocks 894620 (14:45:54 UTC) and 894621 (14:58:29 UTC). Explorer observation at the time of the spot-check: 6.90046533 BTC funded and spent (chain re-checked 2026-09-12: funded equals spent to the satoshi).
What the story adds, and does not establish
That “keys sit near the start of every range” is false as a law, and this case is the source of the misconception. One instance sits at 0.72% of its interval; #66's key does not, and one sample plus a coincidence is not a search strategy — the offset of a uniform random scalar is uniform, so a solver that starts at the low edge gains nothing systematic. Ownership of either spend is not confirmed here.
Observed: two close spends on 2025-04-30
Two spends in blocks 894620 (14:45:54 UTC) and 894621 (14:58:29 UTC). Position within the range is a function of the published scalar, not of any transaction property.
Verified: published key matches the address
The published scalar produces the catalog compressed public key and the address 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG.
Case #120 — spent before the 0.1 BTC unit
Address 17s2b9ksz5y7abUm92cHwG8jEPCzK3dLnT. Block 778498, 09:40:55 UTC. Explorer observation at the time of the spot-check: 1.20001 BTC funded and spent, which matches the pre-16-April-2023 unit of N × 0.01 BTC. The catalog column today prints 12.0 BTC for #120; that figure was never the UTXO, and it is a reward-unit convention rather than a balance.
What the story adds, and does not establish
RetiredCoder is credited in community records; no primary self-attribution was found. Read the name as a labelled attribution, the date and the amount as on-chain observation. A kangaroo-class solve is plausible here because #120 sits in the 2019 leak series and therefore has a published public key, but no public measurement of hardware or duration accompanies the credit.
Observed: spend on 2023-02-27, about 1.2 BTC on the address
Block 778498, 09:40:55 UTC; the address received and spent about 1.2 BTC, consistent with the pre-increase reward unit.
Reported: RetiredCoder
Credit rests on community records, not on a signed statement binding the key to the handle.
Case #125 — after the increase
Address 1PXAyUB8ZoH3WD8n5zoAthYjN15yN5CVq5. Block 797930, 10:24:07 UTC. Explorer observation at the time of the spot-check: 12.50004706 BTC funded and spent, consistent with the post-increase unit. #125 is in the 2019 leak series, so its public key was already published in 2019 — do not confuse 2019-06-01, when the key became public, with this 2023 spend: some public dumps print the leak date as if it were the solve date, and that single confusion is the most common factual error about this puzzle.
What the story adds, and does not establish
RetiredCoder, per community records. The same handle is later associated with #130 and with a public claim on #135. Nothing in this case measures how the key was found; the leak series only tells you that a bounded-interval method was possible.
Observed: spend on 2023-07-09, about 12.5 BTC
Block 797930, 10:24:07 UTC; the address received and spent about 12.5 BTC, consistent with the post-increase reward unit.
Reported: RetiredCoder
Community records; no public proof binds the handle to the key.
Case #130 — eleven days after #66
Address 1Fo65aKq8s8iquMt6weF1rku1moWVEd5Ua. Block 862493, 08:13:37 UTC. Known public key since the 2019 leak series, which makes this a kangaroo-class target rather than an exhaustive-scan target. Explorer observation at the time of the spot-check: the address was funded and spent around the catalog reward unit for #130.
What the story adds, and does not establish
RetiredCoder credited in community records. The eleven-day gap from #66 is a coincidence unless someone publishes evidence tying the two events together, and this atlas does not invent that link: two spends by (reportedly) one handle, in one month, is the kind of pattern a reader supplies, not something the chain states.
Observed: spend on 2024-09-23 08:13:37 UTC, block 862493
The address was spent in block 862493 at 08:13:37 UTC.
Reported: RetiredCoder
Community records; not a proof of identity.
Case #135 — the leak series loses another target
Address 16RGFo6hjq9ym6Pj7N5H7L1NR1rVPJyw2v. Spend transaction 817535430c600810080662dd425a2e335f771effd950d28fc443bce4a92fa812, block 959946, 08:20:16 UTC. Published key 0x6d9392a16883f90903d5f78da57af07eb2 matches the catalog compressed public key 02145d26… and the P2PKH address. A later transaction in block 960138 (2026-07-29 19:35:34 UTC) is also on the address. Remaining leak-series kangaroo targets at the time of writing: #140, #145, #150, #155, #160.
- #135 spend (mempool.space)
- Key disclosure post (BitcoinTalk #5589799)
- Address 16RGFo6h… (mempool.space)
- Catalog folio #135
What the story adds, and does not establish
A public statement attributed to RetiredCoder — quoted on public dumps and Reddit — claims the solve, about five months of work on 200 GPUs, and a retirement from #140. That is a statement: the chain records no hardware, duration or method, and the claim was not body-verified in the spot-check behind this page. The key match is independent of the name, and the name is the weaker half of the pair. The remaining leak-series targets are a fixed list, not a count of what is left overall.
Verified: key, compressed public key and address match
The published scalar produces the catalog compressed public key (02145d26…) and the P2PKH address 16RGFo6hjq9ym6Pj7N5H7L1NR1rVPJyw2v.
Observed: block 959946, 2026-07-28 08:20:16 UTC
Spend confirmed in block 959946 at 08:20:16 UTC, with a later transaction on the same address in block 960138 on 2026-07-29 (txid 840d3ed5183fd1309c364d5f5a71a9686e78b24ec2e8a502062fc5a9258a9ba7, a 3,408-sat dust sweep).
Reported: RetiredCoder public statement
The attribution and the work estimate come from a public statement, not from the transaction.
Where attribution lives
Cases borrow their context from three rooms: handles are indexed on the people page, the dated sequence on history, and the cost of acting on a key on the claim page. Read a case with those open.