Following the Bitcoin Trail After the 2017 NiceHash Hack

A public ledger drew public attention

After the December 2017 NiceHash breach, people began examining Bitcoin transactions for clues about the stolen funds. My December 8 post collected diagrams and discussed an address that appeared central to those observations.

The address was written in the original article with a stray space. Without that space, it reads 12VkDG5PSo5Qh6Lzjje72eCvVwrTwdiuFK. Its appearance in a diagram should not be treated as proof of the identity or guilt of anyone associated with it.

The original diagrams

These images show the transaction relationships that were being discussed at the time. They are historical illustrations, not a live view of balances or a verified attribution report.

The original post also referred to 1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq and a reported amount of approximately 4,736 BTC. Any balance mentioned in the original belonged to that moment, not the present.

Correcting the Bitcoin explanation

Bitcoin records transactions that spend earlier outputs and create new outputs. It does not assign each whole bitcoin a simple permanent serial number that becomes “clean” when someone moves it. The Bitcoin developer guide explains the transaction-output model.

The public record can show relationships between transactions, but addresses don’t automatically identify real people. Establishing ownership often requires evidence outside the blockchain. Miners help secure transaction ordering through proof of work; an individual miner’s earnings aren’t simply proportional to how many payments it handles.

Observation is different from speculation

My original post speculated about how the funds might move and included a simplified diagram about separate wallets. That was not a confirmed reconstruction. A transfer pattern alone doesn’t prove who controls the addresses or establish the source of every payment.

At the time, NiceHash said it was working to restore service and encouraged analysis of the public transaction record. The responsible lesson is to separate visible transactions, hypotheses about control, and verified findings rather than present them as interchangeable.