Transactions that moved the ledger.

What happened

On 3 Jan 2009 the Bitcoin ledger began with block 0. Its only transaction created 50 BTC from nothing: a block reward, of the kind every later block has also paid to whoever produced it.

Whoever made the block also wrote a line of text into it, where a miner may put any data. The line is a newspaper headline: "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks".

What the chain shows

The transaction spends no earlier coins. It is a coinbase, the way new bitcoin enters the ledger, and it pays 50 BTC to a public key rather than to an address.

The Bitcoin Wiki reads the headline as probably meant to prove that the block was made on or after that day ².

Why it matters

Every block since links back, one by one, to this block, so every later bitcoin transaction is recorded on a chain that starts here. It fixes the ledger's starting point.

What happened next

The reward never moved and never can: the reference software skips the block's transactions when it records which coins are spendable ¹, and the Bitcoin Wiki notes that the genesis block's subsidy is unspendable ². Its value at today's price is therefore not shown.

What happened

In March 2013 Hal Finney, a cryptographer who had run Bitcoin from its first release, wrote a forum post about his part in its early days ¹. He wrote that he grabbed the software as soon as it was announced, and that he was the recipient of the first bitcoin transaction, ten coins sent to him as a test ¹.

Finney wrote the post after years of illness: by then he operated his computer with an eye tracker, and he described still writing code that way ¹.

What the chain shows

The payment is in block 170, mined at 03:30 UTC on 12 Jan 2009. It paid 10 BTC to one public key and returned the rest to the sender's key, for a fee of 0 BTC.

A complete read of every block before it finds only block rewards: this is the first transaction in which coins passed from one party to another ^proof.

Why it matters

Until this block every coin on the chain had come straight from mining. This payment is where the ledger started recording transfers, and its receiver tied himself to it in his own words ¹.

The chain itself records only two public keys. Finney names himself as the receiver; his post is the only account of who sent the coins, so the sender stays unnamed here ¹.

What happened next

Finney wrote that as the price climbed he moved his coins to an offline wallet, where he hoped they would be worth something to his heirs ¹.

What happened

On 18 May 2010 a Bitcoin Forum user named laszlo offered 10,000 bitcoins for a couple of large pizzas, to be delivered by anyone who would take the coins ¹.

On 22 May 2010 he reported in the same thread that he had traded 10,000 bitcoins for pizza, and thanked another forum user ¹.

What the chain shows

One transaction in block 57,043, on 22 May 2010, paid exactly 10,000 BTC to a single address. It gathered 131 earlier payments, all held at one address, into that output and paid a fee of 0.99 BTC.

It was not the only payment of that size. A complete read of every transaction from 17 May 2010 to 23 May 2010, 1,383 of them, found two that paid exactly 10,000 BTC on the same day ^proof. The forum posts give no transaction id, so they cannot say which one bought the pizzas. Reporting identifies this one ², and that is the only basis for showing it here; the paying address is therefore not named.

Why it matters

It is a price set by a trade rather than by a market. No exchange series this page can read reaches back to that week, so the trade itself is the only price this page can show for it.

Read against today's price, shown beside this story, it measures how far the asset has travelled since a forum user could trade it for dinner.

What happened next

laszlo kept the offer open for a while, then withdrew it in August 2010, writing that he could no longer generate thousands of coins a day ¹.

What happened

On 16 Nov 2011 one transaction gathered 11 earlier payments and paid them out to two addresses. Reporting since has called it the biggest bitcoin transaction ¹, and given its size as 500,000 BTC ².

No primary document this page could find says whose coins they were, so the addresses stay unnamed here.

What the chain shows

The transaction in block 153,509, at 05:59 UTC on 16 Nov 2011, paid 500,000 BTC to one address and 50,000 BTC to another, for a fee of 0 BTC. Together that was 7.17% of all the bitcoin the issuance schedule had allowed by that block.

Decrypt gives its size as 500,000 BTC ², which matches the larger payment; the transaction moved 550,000 BTC in all.

Why it matters

Dollar figures flatter recent transfers, because the price has risen so far. Measured against supply instead, this one transaction moved 7.17% of all the bitcoin the schedule had allowed by then; the share chart further down compares it with the other entries.

What happened next

This page does not follow the coins further. With no primary document saying whose they were, later moves cannot be read as anyone's.

What happened

When Ethereum launched, its blocks could not hold a single transaction. The genesis block set a gas limit of 5,000, and the smallest transfer needs 21,000 ^proof.

The limit crept up block by block and first reached that mark at block 46,145; the first transaction followed in block 46,147 ^proof. GoldRush, a blockchain data provider, also identifies it as the first transaction on Ethereum ¹.

What the chain shows

Block 46,147, mined at 03:30 UTC on 7 Aug 2015, holds exactly one transaction. It sent 31,337 wei from an account that had held 2,000 ETH since the genesis block, and paid a fee of 1.05 ETH.

Every earlier block is empty. No block could hold a transfer at all before block 46,145, and none did until this one ^proof.

Why it matters

Ethereum did not open with a switch. It opened with a ceiling that rose block by block until a transaction could fit, and the first one went through almost as soon as one could ^proof.

The payment itself was a token amount: the fee was worth vastly more than the ether it moved.

What happened next

The sending account kept nearly all of its genesis allocation: it held 1,998.95 ETH at block 46,147, after the payment and its fee.

What happened

On 17 June 2016 the Ethereum Foundation warned that an attacker was draining The DAO, a contract holding ether for its token holders, into a child DAO ¹. It described a recursive calling flaw: the attacker's request to split from The DAO called itself inside the split, collecting ether many times over in a single transaction ¹.

The Foundation noted that the child DAO's own rules kept the attacker from withdrawing for at least another 27 days, which left time to act ¹.

What the chain shows

One drain transaction, which Aegis, a security research tool, uses as its example of the DAO hack ², moved 2,323 ETH from The DAO to the child DAO in block 1,718,497 at 03:34 UTC on 17 Jun 2016, in a series of internal calls read from its trace.

The child DAO's balance tells the rest. It held 0 ETH at block 1,718,496 and 3,641,694.24 ETH by block 1,720,245, at 11:00 UTC the same day.

Why it matters

The response is what made it a landmark. Rather than reverse any transaction, the network adopted new rules at a fork block that moved the ether out of the child DAO into a recovery contract for token holders ³.

On chain that shows as something no transaction can do: the child DAO held 3,642,408.53 ETH at block 1,919,999 and 0 ETH one block later, moved by what the Foundation called an irregular state change ³. Not everyone accepted it; the same post tells users who wanted to keep following the chain without the fork how to do so ³.

What happened next

The Foundation reported a smooth fork, with roughly 85% of miners on the new chain, and the recovery contract already returning ether to token holders ³.

What happened

On 10 April 2020 a single bitcoin transaction was spotted on Twitter for its size and its tiny fee ². Bitfinex's chief technology officer replied there that the exchange had refilled its hot wallet with 15,000 BTC, and that the rest went back to the original address ¹².

What the chain shows

The transaction in block 625,332, at 19:23 UTC on 10 Apr 2020, spent 161,501 BTC held at one address. It paid 15,000 BTC to a second address and returned 146,501 BTC to the sending address, for a fee of 0.00010019 BTC, about $0.69 at the time.

Why it matters

A transaction's inputs are not its payments. Bitcoin spends whole earlier outputs, so a wallet paying out part of a large balance sends the remainder back to itself as change, and the total can look like a transfer of everything.

Read by its outputs, this was an exchange moving part of a balance into its own hot wallet; read by its inputs, it became a billion-dollar headline ¹².

What happened next

Two days later Decrypt quoted the statement, yet still described a transaction for 161,500 bitcoin worth more than $1.1 billion, the largest to date in dollars ². This page counts only the payment output as moved.

What happened

On 5 November 2020 federal prosecutors in San Francisco filed a civil complaint to forfeit about 69,370 bitcoin ¹³. The complaint says a hacker it calls Individual X broke into Silk Road, the darknet market, took the coins, and that they sat at one address from 2013 ¹.

It says Individual X signed an agreement on 3 November 2020 consenting to the forfeiture, and that the United States took custody of the coins from that address the same day ¹. The Justice Department called it the largest seizure of cryptocurrency in its history ³.

What the chain shows

On 3 Nov 2020 the address made two payments to the same address: 1 BTC at 21:31 UTC, then 69,369 BTC at 21:36 UTC, about $955.55M at the time. A complete read of the address's history finds these two spends that day and no others ^proof.

Before them, the complaint says, the address had last sent coins in April 2015, when it paid 101 bitcoin to the BTC-e exchange ¹.

Why it matters

The chain shows the coins leaving; only the complaint says who moved them and why ¹. Both payments that day went to one address, which fits the custody the complaint describes, but no document this page could read prints that address, so it stays unnamed here.

The complaint prints the address without its final character in its caption and in two paragraphs, and in full only once, in paragraph 17 ¹.

What happened next

Elliptic, an analytics firm, spotted the move within a day, before the complaint was public ². Silk Road's founder, prosecuted in 2015, was pardoned on 21 January 2025, according to the Justice Department's list of clemency grants ³⁴.

What happened

On 10 August 2021 Poly Network, which runs a bridge for moving tokens between blockchains, announced that it had been attacked on Ethereum, BNB Chain and Polygon, and listed the addresses that received the funds ¹.

Over the following days the attacker returned the funds. On 23 August Poly Network said all user assets had been recovered, apart from USDT that had been frozen ².

What the chain shows

Three of the transfers on Ethereum, all to the address Poly Network named, moved 2,857 ETH, 96,389,444 USDC and 33,431,198 USDT out of the bridge's contract between 09:51 UTC and 10:11 UTC on 10 Aug 2021.

The ether moved inside a contract call, so its amount is read from the trace; the two stablecoins moved as ordinary token transfers. This page shows these three because it can price them from exchange records; Merkle Science lists the other tokens taken alongside them ³.

Why it matters

Poly Network said it was attacked on three chains at once ¹. The attacker's handover ended with an on-chain message publishing a key to the wallet where the remaining funds sat ².

It is also a case where a freeze shaped the outcome: on 23 August the USDT was still frozen, Poly Network counted it apart from the assets it had recovered, and it said Tether was confirming how to unfreeze it ².

What happened next

Poly Network, which called the attacker Mr. White Hat, wrote on 23 August that it had regained control of the affected assets and was returning them to users ².

What happened

On 27 September 2021 a user's deposit of 100,000 USDT to DeversiFi, a trading platform built on Ethereum, carried a fee of 7,676 ETH ¹. DeversiFi blamed a flaw in a widely used Ethereum software library that met the network's new fee rules, and said the user's hardware wallet may have shown the fee in a form that was hard to read ¹.

What the chain shows

The transaction in block 13,307,440, at 11:10 UTC on 27 Sep 2021, moved 100,000 USDT, about $100.03K, and paid 7,676.62 ETH in fees, about $23.74M.

The sending address carries an Etherscan tag naming Bitfinex; DeversiFi's account calls the depositor a user ¹.

Why it matters

Since Ethereum's London upgrade the base part of a fee is burned, but the tip goes to whoever produces the block, and nothing in the protocol caps it ¹. A wrong number is paid in full, and only the recipient's goodwill can return it.

Here the miner of the block received the fee ¹. A deposit worth a small fraction of the fee became, by value, a transfer to a stranger.

What happened next

DeversiFi found the miner through Binance, where the miner deposited mined ether, and the miner returned 7,626 ETH that evening, keeping 50 ETH that DeversiFi had offered as a fee for the return ¹. DeversiFi said it added a ceiling on transaction fees to its own software ¹.

What happened

On 29 March 2022 Ronin, a network run by Sky Mavis, announced that its bridge to Ethereum had been drained six days earlier ¹.

Ronin wrote that a withdrawal needed five of its nine validator signatures, and that the attacker had gained control of four validators run by Sky Mavis and one run by the Axie DAO ¹. With five keys, Ronin wrote, the attacker could forge withdrawals ¹.

What the chain shows

Two transactions, in blocks 14,442,835 and 14,442,840, sent 173,600 ETH and 25,500,000 USDC from the bridge contract to the same address. At the time that was about $514.00M and $25.54M.

The ETH moved inside a contract call: the bridge unwrapped its wrapped ether and passed the proceeds on in the same transaction. The amount is read from the transaction's trace and checked against the unwrap event in its receipt, which every endpoint returned identically.

The USDC moved as an ordinary token transfer, worth 0.0542% of all USDC on Ethereum at that block.

Why it matters

The bridge's security rested on a signature threshold. Ronin's own post says the five-of-nine threshold was set low because some validator nodes kept falling behind the chain ¹.

The theft was only noticed when a user could not withdraw from the bridge, days after the funds had gone ¹.

What happened next

Ronin raised the threshold to eight of nine and paused the bridge ¹. On 14 April 2022 the US Treasury listed the receiving address under Lazarus Group in its sanctions update ².

What happened

On 21 February 2025 Bybit said that a scheduled move of ether from its multisig cold wallet to its hot wallet had been manipulated, and that more than 400,000 ETH and stETH went to an unidentified address ¹. Bybit wrote that the attack altered the wallet's smart contract logic and masked the signing interface ¹.

The Safe Ecosystem Foundation, which promotes the multisig software the wallet ran on, published the Safe{Wallet} team's finding that the attack came through a compromised developer machine, which proposed a disguised malicious transaction ⁴.

What the chain shows

One transaction in block 21,895,251, at 14:16 UTC on 21 Feb 2025, moved 401,347 ETH, about $1.13B at the time. The ether moved inside a contract call, so the amount is read from the transaction's trace and checked against the wallet's balance before and after the block.

Bybit's notice gives about 12:30 UTC as the time it detected the activity, while the chain dates this transfer to 14:16 UTC; the notice does not explain the gap ¹.

Why it matters

The signers never approved this transfer as such. According to CertiK, the attacker first obtained three valid signatures for an earlier transaction that swapped the wallet's code for a malicious contract, then used that contract to drain the wallet ³.

The Safe{Wallet} team's statement says outside reviewers found no flaw in the multisig's contracts ⁴. The weakness was in what the signers were shown, which Bybit describes as a masked signing interface ¹.

What happened next

The FBI asked exchanges and other services to block transactions with the addresses the thieves were using to launder the funds, and listed dozens of them ².

What happened

On 7 Jul 2026, 10 Aug 2026 and 21 Aug 2026, the multisig that owns the USDT contract called the contract's redeem function, four times in all ^proof. The contract's own code says what that does: only the owner can call it, the tokens come out of the owner's balance, and the total supply falls by the same amount ¹.

Tether published no statement about these removals that this page could find, so this page does not say why they happened, or whether anything was issued elsewhere in their place.

What the chain shows

The removals took 2,500,000,000 USDT and 2,500,000,000 USDT on 7 Jul 2026, 1,750,000,000 USDT on 10 Aug 2026 and 2,000,000,000 USDT on 21 Aug 2026. The removal at 09:20 UTC on 7 Jul 2026 was by itself 2.64% of all USDT on Ethereum at its block. Each was sent by an account acting through the multisig, which owns the contract and made the call; the measured table lists those senders.

A complete read of the contract's events over the whole window finds exactly these four Redeem events ^proof, and not one Issue, the event that adds supply ^proof. Tether also destroyed frozen balances in the window, which the contract's code shows lowers the supply too ¹; the measured table further down lists them.

Why it matters

The tokens these Redeems removed were Tether's own: the code takes them from the owner's balance, so no other holder's tokens were cancelled ¹. The event is named Redeem, but nothing in it records a payment to anyone.

The contract records only that the supply on Ethereum shrank, not why, and without a statement from Tether this page does not guess.

What happened next

No new USDT was added on Ethereum for the rest of the window: the complete read finds no Issue event up to 1 Oct 2026 ^proof.

What happened

On 16 July 2026 CoinDesk reported that a bitcoin address that had not spent a coin in eight years had moved its holding, worth about $383 million ¹. It linked the address, and wrote that the coins went to a new address rather than to an exchange, so nothing showed a sale ¹.

What the chain shows

One transaction in block 958,217, at 00:15 UTC on 16 Jul 2026, moved 5,908 BTC, about $382.63M at the time, for a fee of 0.00000643 BTC.

The single earlier payment it spent arrived in block 499,310, on 14 Dec 2017, and had not moved in the 8.6 years since. A complete read of the address's history finds no other spend from it, before or after ^proof.

Why it matters

The chain can prove how long coins sat still, to the block, without knowing who holds them. Here it shows a holding that CoinDesk describes as bought near the late-2017 peak, and that stayed put through the crashes and rallies that followed ¹.

What the chain cannot show is who moved the coins or why. Moving to a new address can mean a change of custody as easily as a step toward a sale, as CoinDesk notes ¹.

What happened next

CoinDesk wrote that coins arriving at an exchange's deposit address would be the first real sign of a sale ¹. The status line below records whether the coins have moved since.

What happened

On 6 September 2026 an attacker used a bug in Elements, the software Liquid runs on, to create about 4,000 Liquid bitcoin with nothing behind them ¹. Liquid is a Bitcoin sidechain run by a federation of members, and each of its bitcoin tokens is meant to be backed by a bitcoin the federation holds ¹.

The attacker then deposited the tokens with SideSwap, a federation member whose service exchanges them for bitcoin from the reserve ¹. Within hours the attacker posted an on-chain message calling themselves whitehats, and after negotiations returned most of the bitcoin the next day ¹.

What the chain shows

The release in block 965,783, at 14:28 UTC on 6 Sep 2026, paid 3,996 BTC out of the reserve, about $318.49M at the time. It combined 83 separate amounts held at the reserve's address into one payment.

In the same block, SideSwap's address passed 3,996 BTC on to another address: the one the coins came back from. The next day, in block 965,950, that address sent exactly 3,400 BTC back to the reserve's address and kept the rest.

Why it matters

Two safeguards failed in turn, by Blockstream's account ¹. The bug came from a fix: an earlier flaw was reported and patched in August, and the patch combined the fields of a validation cache key in a way a forged proof could match byte for byte ¹.

The second safeguard was delay. The federation's rules expect a member's receiving wallet to be kept offline, so that released bitcoin waits for a manual step; the report cites SideSwap's own statement that its key was online and payouts were forwarded automatically ¹. The chain shows that directly: the release and the forward share a block.

Amounts on Liquid itself are hidden by design, so the forged tokens cannot be read from that chain; this page reads the bitcoin side ¹.

What happened next

Blockstream halted Liquid's bridge nodes that evening, deployed an emergency patch overnight and published a fixed release within days ¹. Block production resumed on 9 September on a corrected chain that leaves out the forged tokens and everything built on them ¹.

What happened

Bitget wrote on 24 September 2026 that its security systems had detected unauthorised transfers from some of its hot wallets at 18:31 UTC ¹. It first put the loss at about $351.6 million, said its cold wallets were secure and paused withdrawals ¹.

The next day it raised the figure to about $387.5 million, after counting assets on Zcash and Tron, and published the main receiving addresses it had identified ². Hypernative, a security firm, reports Bitget's account of the cause: the attacker compromised a backend system and used it to feed spoofed withdrawal requests into the exchange's own signing process ³.

What the chain shows

On Ethereum, a wallet that Etherscan tags as Bitget's sent 34,751,168 USDT at 18:58 UTC, then three ETH transfers between 19:01 UTC and 21:23 UTC, all to the address Bitget published. Each is an ordinary transfer signed by the wallet itself. Hypernative also reports small test transfers from 18:31, before these ³.

Hypernative reports that the attacker's requests carried round gas limits, unlike the computed ones on Bitget's own withdrawals, and that this was the one detail that set them apart ³.

Why it matters

No key was stolen, by Bitget's account as reported: the wallets signed what they were asked to sign ³. Hypernative's conclusion is that a signer must check each transfer against an independent record of what should be paid, rather than trust the internal service that asks ³.

About a quarter of the haul was in stablecoins and other tokens whose issuers can freeze them, yet Hypernative found none frozen on the original transfers; the USDT was being sold for ETH less than two minutes after it arrived ³.

What happened next

Bitget said the loss falls within the coverage of its User Protection Fund ¹, and launched a bounty paying a share of any funds frozen or recovered with help from outside ². Hypernative reports that withdrawals were to reopen in stages from 28 September ³.