In January 2026, automated sweeper bots collectively spent roughly $4,800 in Bitcoin transaction fees to capture a total of $12.67 from a compromised SegWit address.
How the incident unfolded
The targeted address was created using a private key derived from the coinbase transaction ID of Bitcoin block 924,982. Because a coinbase transaction ID is publicly visible, the key could be generated by anyone running the appropriate script, making the address effectively insecure.
Two small deposits were sent to the address: 0.00018209 BTC and 0.00002096 BTC, totaling 0.00020305 BTC. Both deposits were swept within minutes, leaving the address with a zero balance and no unspent transaction outputs (UTXOs).
Fee war and replace‑by‑fee competition
Multiple bots detected the deposits simultaneously and each attempted to claim the funds using replace‑by‑fee (RBF), a Bitcoin feature that allows an unconfirmed transaction to be replaced by a new one with a higher fee. Miners typically prioritize the higher‑fee transaction, giving it a better chance of inclusion in a block.
Fee rates reached 12.8 sat/vB for the first sweep and 4.80 sat/vB for the second. The combined fees paid by the bots amounted to about $4,800, while the total value captured was only $12.67.
Implications
The episode highlights the economic challenges for bot operators, as the cost of competing far exceeds the reward. It also underscores how weak‑key addresses can attract automated attacks.
Miners benefited from the situation by collecting the high fees, as they simply included the highest‑paying transactions, which is standard practice.
Replace‑by‑fee is intended to help users accelerate stuck transactions, but when exploited by competing bots it can become a mechanism that escalates fees and transfers value to miners.
