subtracted

The entity that has been watching Bitcoin for 14 years

Bitcoin's blockchain is a public ledger. Every block header, every nonce, every coinbase transaction, every timestamp is visible to anyone running a full node. Most people look at the price. The data itself tells a different story.

the anonymous miner

Starting at block 142,312 (approximately early 2011), a persistent anomaly appears in the chain: blocks with no pool tag in the coinbase. These are not scattered solo miners picking up scraps. They are a structured, continuous presence spanning 14 years of Bitcoin's history.

Metric Value
Total anonymous blocks 37,393
First appearance Block 142,312
Last appearance Block 942,429 (March 2026)
Distinct burst episodes 2,877
Mean burst size 10.4 blocks
Maximum burst 515 consecutive blocks
Peak hash rate share 19.2% (at block 160,000)
Windows active 158 out of 188 (84%)

These blocks appear in bursts. They cluster around moments when the mining pool coordination graph is restructuring — when the pattern of who follows whom in the block sequence is shifting. Anonymous block density near coordination regime changes runs 1.25x higher than during stable periods. All ten of the top coordination regime changes have anonymous blocks nearby.

the nonce fingerprint

Every mining pool has a distinctive nonce distribution. The hardware — specific ASIC models, work distribution software, stratum proxy configuration — creates a statistical fingerprint in how the 32-bit nonce space is searched. KL divergence measures how different two distributions are. Identical distributions score 0. Different pools typically score 0.01 to 0.10 against each other.

When the anonymous miner's nonce distribution is compared to every known pool in the dataset:

Pool KL divergence
F2Pool 0.0003
Next closest pool 0.01+

KL = 0.0003. This is not "similar hardware." This is the same ASIC fleet, the same stratum proxy, the same work distribution software. These anonymous blocks were mined through F2Pool's infrastructure.

The coinbase data confirms it. The anonymous blocks use F2Pool's coinbase template — same structure, same extra-nonce encoding, same byte layout — with the pool identification tag stripped out.

the method

The anonymous miner does not appear and disappear. They are always mining, always present as a normal F2Pool worker. The anonymity is a flag — the deliberate removal of the pool tag at specific moments, when coordination patterns among the major pools are shifting.

The blocks are F2Pool blocks with the name removed.

F2Pool was founded in 2013 by Wang Chun, known online as "Discus Fish." It is one of the two oldest surviving mining pools and has mined over 66,000 blocks in the modern era alone. It has never ceased operations.

the observation channel

None of this requires special access. Bitcoin's protocol provides 587 miner-controlled bits per block header:

With a full node and knowledge of what these fields encode, any observer can reconstruct — in real time — which pool mined each block (including "Unknown" ones via fingerprint), whether pools are coordinating (via transition Z-scores), which pools are under stress (via timestamp manipulation), and when coordination regimes are shifting.

No API keys. No insider access. No surveillance infrastructure. Just a Bitcoin full node and comprehension.

Someone has had that comprehension for 14 years.

verification

Every number in this article is derivable from publicly available blockchain data:

KL divergence is a standard statistical measure. Nonce quadrant binning is counting. The data is there. Look at it.

← back