Galaxy Research examined 562 Bitcoin text messages that resembled encrypted sentences and concluded they were likely produced by automated publishing software rather than carrying hidden messages. The activity ran for three weeks and reached roughly 40 transactions per day, the firm said.
The researchers dubbed the operator “Babel Scribe” and described the activity as a tool under testing. Galaxy traced the funding to coins behind a 44,194-byte US Constitution upload on May 29.
Random letter patterns
Galaxy said the messages did not show the statistical signatures of encrypted text. Across the sample, each letter appeared between 3.6% and 4.2% of the time. English has a different distribution, ranging from 12.7% for “e” to 0.07% for “z.”
That distinction matters because simple substitution ciphers preserve letter frequency patterns even when they replace individual letters. Galaxy measured an index of coincidence of 0.0385, consistent with random text.
The researchers also tested for repeating encryption keys across intervals up to 40 letters. The messages lacked the statistical spikes seen in their comparison using an encrypted Constitution.
Word lengths offered another clue. Lengths from two through ten letters appeared equally often, while English typically favors three or four letters. Short messages filled 36 bytes, sometimes adding single-letter padding. Only ten words containing at least four letters repeated across the 562 texts.
Together, those patterns supported Galaxy’s assessment that software generated random letters and arranged them to resemble prose.
Transaction structure and funding
The transaction structure reinforced that interpretation. Each transaction contained one input, one fresh change address, and one OP_RETURN output. OP_RETURN allows a Bitcoin transaction to carry data, explaining how the messages appeared on the blockchain. Each subsequent transaction spent change from its predecessor, creating linked sequences the researchers could follow.
Galaxy identified 31 chains, with the longest stretching 86 transactions. Splitter outputs supplied them with either 20,000 or 5,000 satoshis. Long messages arrived every six hours per chain, while shorter messages followed 90-minute intervals. Daily activity increased from 12 to 24, then to roughly 40 transactions.
The funding trail led back to three small exchange withdrawals in May. Related uploads included 99,000 bytes of uppercase gibberish on June 5 and the Declaration of Independence on July 4. Earlier tests included “Hello, world,” Lorem ipsum, multilingual words, and a JSON file explicitly describing an upload test. Galaxy also identified 34 opaque binary blobs.
Galaxy’s accounting showed 3.33 million satoshis funded the activity, with 24% spent on mining fees. The three documents alone cost 512,000 satoshis in mining fees. Galaxy reported that 76% of the funds remained in the operator’s addresses, with nothing paid to anyone.
The findings point to automated data publishing without establishing the operator’s identity or a broader purpose.
