On-chain record · medium source confidence
Bitfinex Hacked-Coin Movement, January 2017
In late January 2017 a tranche of coins traced to the 2016 Bitfinex breach was moved on-chain in uniform amounts of roughly four bitcoin each. The movement was recorded at the time in a public CSV, and 99 of those receiving addresses were later carried into the GraphSense open TagPack under the label 'Bitfinex hack' with abuse type 'service_hack'.
- First seen
- January 2017
- Connected
- January 2017
- Route display ID
7°-A6A1-E67BDisplay identifier only — not proof of ownership.
2 additional population comparisons
Evidence boundary
What is — and is not — established
These are laundering-stage addresses, one hop or more removed from the original 2016 destinations - they are a different set entirely from the 2,072 hack destinations, with zero overlap when the two files were compared this session. The 'Bitfinex hack' tag reflects one analyst's 2017 clustering, republished by GraphSense at confidence level 'web_crawl'; it has not been confirmed by a court filing. All 99 tagged addresses pass base58check and all 99 appear in the January 2017 CSV. Only five are listed here as representatives; the full set is in the cited files.
The dossier
Evidence record
Address record
- Role
- receiving address in the January 2017 movement of Bitfinex-hacked coins
- Script
- P2PKH
- Category
- Incident record
- Source confidence
- medium
- Catalog reviewed
- 2026-08-06
View all 5 documented addresses
- 01
1D38A8TJHAQfEGdoirE1WpXPEh7NMNHT5L - 02
1LY2Y3mL64bxPJmzEa1e6hwK42ojfXnQ5E - 03
1JueqU9KmCHcCLzYa37QcRsSmJNNzNCTgZ - 04
1NGRjbawvDUoqCFFURqryPVvb2npvfh3jz - 05
1G8oebXXdZ7zjhLxdWchLgjxsK1fpwE7nJ