Key Takeaways
- • Galaxy Research, the research arm of Galaxy Digital, assessed that an unidentified string recorded on the Bitcoin blockchain for three weeks is more likely test data for automated tools than a real encrypted message.
- • The string was recorded roughly 40 times a day, with daily counts rising from about 12 to 24 and then to about 40 over the three-week period, using the OP_RETURN function.
- • Galaxy Research found the letter distribution nearly uniform across 562 analysed texts (about 3.6 to 4.2 percent per letter), which differs from typical language patterns and makes a simple substitution cipher unlikely.
- • Funds used so far total about 3.33 million satoshis, traced to three small exchange withdrawals in May 2026 totaling 0.033 BTC, with the same funding source as a May recording of the full U.S. Constitution; the operator remains unidentified.
- • The activity follows relaxed OP_RETURN limits in Bitcoin Core v30, released in October 2025, reigniting debate over non-financial data on the Bitcoin blockchain.
Summary
Galaxy Research, the investigative arm of Galaxy Digital, has analysed a repeatedly recorded string on the Bitcoin blockchain and concluded that it is more likely data used to test automated tools than an encrypted message, according to a report published on October 26 by CoinPost. The string was recorded about 40 times a day over three weeks, with the daily count starting near 12, rising to 24, and then reaching about 40. The data was stored using OP_RETURN, a function that allows arbitrary information to be embedded in Bitcoin transactions.
The activity was made possible by eased rules in Bitcoin Core v30, released in October 2025, which relaxed the byte cap for OP_RETURN data and the limit on the number of such records per transaction. In May 2026, the full text of the U.S. Constitution was similarly recorded on the blockchain using the same function. Galaxy Research determined that the funds used for the recent recordings originated from the same source as those used for the Constitution recording, tracing back to three small exchange withdrawals in May totaling 0.033 BTC. The identity of the operator has not been confirmed.
Total funds spent so far amount to about 3.33 million satoshis, with roughly 24 percent estimated to have been paid as miner fees and the remainder held at related addresses. Galaxy Research judged the possibility of genuine ciphertext to be low. Across 562 analysed texts, each of the 26 letters appeared at a nearly even rate of about 3.6 to 4.2 percent, a distribution that differs from typical languages and is inconsistent with a simple substitution cipher. The firm also found no statistical signature of a Vigenere cipher with a repeating key.
The timing pattern further pointed to an automated program. Long strings were posted every six hours and short strings every 90 minutes, with the cycle continuing overnight and on weekends. On this basis, Galaxy Research characterised the activity as closer to tool testing and recommended that observers "stop reading" into it.
The episode has renewed debate over storing non-financial data on the Bitcoin blockchain. Opponents argue that such recording burdens Bitcoin's original purpose and consumes network resources, while supporters contend it broadens the range of on-chain applications. With data-recording cases rising since OP_RETURN limits were loosened, the discussion over which data types should be permitted on the network is expected to continue.
The activity was made possible by eased rules in Bitcoin Core v30, released in October 2025, which relaxed the byte cap for OP_RETURN data and the limit on the number of such records per transaction. In May 2026, the full text of the U.S. Constitution was similarly recorded on the blockchain using the same function. Galaxy Research determined that the funds used for the recent recordings originated from the same source as those used for the Constitution recording, tracing back to three small exchange withdrawals in May totaling 0.033 BTC. The identity of the operator has not been confirmed.
Total funds spent so far amount to about 3.33 million satoshis, with roughly 24 percent estimated to have been paid as miner fees and the remainder held at related addresses. Galaxy Research judged the possibility of genuine ciphertext to be low. Across 562 analysed texts, each of the 26 letters appeared at a nearly even rate of about 3.6 to 4.2 percent, a distribution that differs from typical languages and is inconsistent with a simple substitution cipher. The firm also found no statistical signature of a Vigenere cipher with a repeating key.
The timing pattern further pointed to an automated program. Long strings were posted every six hours and short strings every 90 minutes, with the cycle continuing overnight and on weekends. On this basis, Galaxy Research characterised the activity as closer to tool testing and recommended that observers "stop reading" into it.
The episode has renewed debate over storing non-financial data on the Bitcoin blockchain. Opponents argue that such recording burdens Bitcoin's original purpose and consumes network resources, while supporters contend it broadens the range of on-chain applications. With data-recording cases rising since OP_RETURN limits were loosened, the discussion over which data types should be permitted on the network is expected to continue.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.