A Bitcoin token sale that opened on Saturday and advertised a mint window of 9,666 blocks — roughly 67 days — moved every satoshi out of its treasury address on Sunday, 201 blocks in. The sale is called LEAF. Its protocol string is ico-20. On Sunday this desk reported that it was writing a 330-satoshi output to the address holding the 598.5 BTC retained from the Liquid sidechain exploit — in every one of its mints. That is still true, and the count has risen. What is new is that the money it raised is gone from where it was raised to.
At 10:42:24 UTC on Sunday 13 September, in block 966,807, four transactions consolidated 763 inputs out of the LEAF treasury address bc1pq43ahs…sypleaf. Eighty-one minutes later, at 12:03:36 UTC in block 966,817, three more finished the job. Between them the seven transactions sent 133,500,000 satoshis — 1.335 BTC, about $102,540 at Sunday’s close of $76,808.69 — to three addresses, with a further 4,251 satoshis to a fourth. All three principal recipients had a transaction count of zero before the sweep. Their first appearance on the Bitcoin blockchain is the transaction that paid them.
Within two hours and forty minutes of the second cluster, two of the three had moved on again.
What the transactions show
Every figure below is recomputed from the full confirmed transaction list of the addresses concerned, pulled between 06:10 and 06:28 UTC on Monday 14 September. Block heights, timestamps, input counts, output values and fees are as the network recorded them.
Cluster one — block 966,807, 10:42:24 UTC Sunday 13 September.
- 89c3d748… — 379 inputs, 60,000,000 sats to address A, 29,633 sats change back to the treasury, fee 65,631 sats, 21,879 vB.
- 3bb566be… — 46 inputs, 60,000,000 sats to address B, 387,261 sats change, fee 8,225 sats, 2,741 vB.
- 89ba64ef… — 337 inputs, 9,000,000 sats to address C, 7,798 sats change, fee 58,422 sats, 19,476 vB.
- 4cb0f28e… — 1 input of 6,400,000 sats, 4,251 sats to a fourth address, 6,395,287 sats change, fee 462 sats.
Cluster two — block 966,817, 12:03:36 UTC Sunday 13 September.
The seven transactions paid 147,373 satoshis in miner fees to consolidate 843 inputs. The three recipients, and what each received in total:
- A —
bc1qeyylxht62d3de74mkdfsq8fz5p4ge2m0ujajqt, a P2WPKH (native SegWit v0) address: 60,500,000 sats. - B —
bc1pa8vrkzs2wrrh6nsu862vj50vgmsajtju5yv52atlm6xdf0nmaesqrffjrs, a P2TR (Taproot) address: 60,500,000 sats. - C —
bc1ppszyukdrnc8ffvn5082ulc5cflt306rzqa30jx622m0akpg0gj6qtvezl8, also Taproot: 12,500,000 sats.
- A —
A and B received exactly the same amount — 60,000,000 satoshis each in cluster one, then 500,000 satoshis each in cluster two. Two identical payments, in two different output types, in the same two blocks. C received 9,000,000 and then 3,500,000. As shares of the 133,500,000 that left: 45.32% / 45.32% / 9.36%.
A 50/50 split with a smaller third share is what a two-way partnership with a service fee looks like. It is also what one person moving coins into three wallets they control looks like. This desk cannot distinguish between the two from the chain, and does not try to below.
Where it went next
B moved first. At 14:27:31 UTC, in block 966,829, transaction 43ea67d2… spent the 60,000,000-satoshi output. The transaction carried an OP_RETURN, and the payload is the sale’s own protocol speaking:
{"p":"ico-20","op":"transfer","tick":"LEAF","amt":"100000"}The transaction is worth reading closely, because it is not a simple onward move. It has four inputs: B’s 60,000,000 satoshis, two outputs of 670 satoshis from a fourth address bc1pvwft0saw…, and 1,000 satoshis from a fifth. Total in, 60,002,340. Its outputs were 201,340 satoshis to bc1pvwft0saw…, 6,000 to another address, 1,000 back to the fifth, and 1,000 plus 59,791,974 back to B. Fee 1,026 satoshis; the transaction balances to the satoshi.
Netted out, B paid roughly 207,000 satoshis and bc1pvwft0saw… received roughly 200,000, with 6,000 going to a third party, in a transaction carrying an ico-20 transfer instruction for 100,000 LEAF. That is the shape of a settled trade with a service fee, not a wallet consolidation — though this desk has not established who either counterparty is.
A moved twelve minutes later. At 14:39:46 UTC, in block 966,830, transaction 7eb90e13… spent its 60,000,000-satoshi output into two: 2,100,000 sats to a new address and 57,899,577 sats back to itself. Fee: 423 sats. No OP_RETURN.
C has not moved. Its 12,500,000 satoshis have sat unspent since 12:03:36 UTC Sunday.
As of 06:10 UTC Monday the three balances were: A 0.58399577 BTC across 3 lifetime transactions, B 0.60292974 BTC across 3, C 0.125 BTC across 2. The treasury address itself holds 0.04343439 BTC, of which 3,325,466 satoshis — about three-quarters — is change from its own sweep.
The recount: 1,114 mints, and all 1,114 still pay the whitehats
Sunday’s article counted 1,109 mints, each carrying a 330-satoshi output to the Liquid whitehat address. The re-pull at 06:12 UTC Monday gives 1,114 mints plus the deploy, and the property holds without exception: 1,114 of 1,114 mints pay 330 satoshis to that address. Total delivered by the 1,114 mints: 367,620 satoshis, about $282. Including the deploy’s own 330-satoshi output, 367,950.
The whitehat address now shows 1,440 confirmed transactions. The 1,115 ico-20 transactions are 77.43% of its lifetime count. Its balance is 598.50430779 BTC, up 5,350 satoshis on Sunday, and it has still not spent a single output since 16:09:25 UTC on 7 September.
What the mints put into the treasury, rather than into the whitehat address, is the number that matters here: 137,964,517 satoshis, 1.37964517 BTC, about $105,969 at Sunday’s close. The distribution across 1,114 mints:
- Median commitment: 30,000 sats (about $23).
- Mean: 123,846 sats. Ninetieth percentile: 280,000 sats.
- Largest single commitment: 6,400,000 sats (0.064 BTC, about $4,916).
- Smallest: 330 sats — and 18 mints committed exactly that, the dust output and nothing more.
- 252 mints committed 1,000 satoshis or less. 32 committed 0.01 BTC or more.
- 875 distinct funding addresses. The busiest funded 8 mints, 0.7% of the total. The top five funders together account for 33 mints — 3.0% — and 17.1% of the satoshis committed.
That last line is worth pausing on. This was not five wallets pretending to be a crowd. It was a wide, shallow crowd: 875 addresses, a median ticket of about twenty-three dollars, and a long tail of people who paid the 330-satoshi dust and nothing else. Whatever else the sweep was, it was a sweep of money that came from many hands.
The timing
The mint rate, hour by hour in UTC, from the first mint at 03:31:40 on Saturday 12 September:
- 12 Sep: 03h 1, 05h 2, 13h 1, 15h 1, 16h 6, 17h 10, 18h 11, 19h 16, 20h 20, 21h 80, 22h 43, 23h 131 — 322 mints.
- 13 Sep: 00h 381, 01h 233, 02h 131, 03h 39, 04h 2, 05h 1, 06h 1, 08h 1, 10h 2, 15h 1 — 792 mints.
The peak hour was midnight to 01:00 UTC on Sunday: 381 mints. Four hours later the rate was two per hour. It never recovered. The sweep began at 10:42:24 — roughly seven hours after the last hour that saw more than ten mints, and about ten and a half hours after the peak.
Exactly one mint has landed since the first sweep transaction confirmed: a 1,000-satoshi commitment at 15:39:02 UTC on Sunday, in block 966,839. Nothing since, through 06:28 UTC Monday.
The deploy transaction landed in block 966,606. The advertised window of 9,666 blocks ends at block 976,272. The sweep happened at block 966,807 — 201 blocks in, 2.08% of the way through the window, with 9,465 blocks still to run. At the Monday snapshot the chain tip was 966,927: 321 blocks elapsed, 9,345 remaining, roughly 65 days on current block times.
The mints themselves paid 1,344,703 satoshis in miner fees across 82 blocks and 765,745 virtual bytes — an average of about 0.93% of a one-million-vB block. Set the fees against what the mints actually delivered to the whitehat address and the ratio is 3.66 satoshis of fee for every satoshi delivered.
What the project’s own page shows now
The LEAF site at leaficobtc.vercel.app, fetched at 06:24 UTC Monday, still carries the sale copy in its metadata: “the first ICO built directly on Bitcoin L1”, the BRC-20 and ICO-20 references, the $ORDI and $BTC distribution. Its canonical URL and og:url both point at hashrate.market, and it is marked noindex, nofollow.
The rendered page is no longer a sale page. Its title is now “LEAF market” and its body is a marketplace: an order book, an “Available LEAF” panel, a “LIST TOKENS” control. Every figure on it is blank. Floor price shows an em-dash and “No 24h baseline yet”. Market cap shows “Awaiting price discovery”. Total volume shows “No 7d baseline yet”. Confirmed buys, unique buyers and amount traded are all em-dashes. Beneath them: “Market data is unavailable.” Sunday’s fetch recorded the mint terms — supply of 1,000,000,000, the 9,666-block window, the Golden Curve pricing formula, 7,000 points per BTC and 1 point per ORDI. The listed channels are t.me/leaf_ico and x.com/leaf_ico.
An important guard. There is a token called LEAF quoted on CoinGecko at $0.1755. It is a different asset. It is not the ico-20 LEAF described here, and nothing in this article should be read as a price for the token these 875 addresses were minting. The project’s own marketplace is the only venue this desk found claiming to price it, and as of the 06:24 UTC Monday fetch it reports no price at all.
What this desk is not saying
A treasury address moving its balance is not, by itself, evidence of theft, fraud or abandonment. Operators move funds to cold storage. They pay for infrastructure, audits, listings and market-making. A marketplace that has just launched needs inventory and liquidity from somewhere. All of that is consistent with what the chain shows.
So, precisely: this desk has not established who controls addresses A, B or C, or whether they are the same party. It has not established that any LEAF holder has lost anything. It has not established that the whitehats control, endorse, benefit from or have any knowledge of LEAF — and no statement has come from Blockstream, the Liquid federation, the whitehats or LEAF about the pairing. It has not established that the ico-20 specification requires the 330-satoshi output; this desk verified 1,114 transactions, not a published spec.
What it has established is a sequence, and the sequence is the story: a sale opened, raised 1.3796 BTC from 875 addresses in about thirty-one hours, saw its mint rate collapse from 381 an hour to one or two, and then — seven hours after the money stopped arriving, and 2% of the way through its own advertised window — sent everything it had raised to three addresses that had never transacted before, two of which moved it again the same afternoon.
Readers who want to check any of this themselves, or apply the same checks to a different sale, will find the method set out in our Field Guide #48, published alongside this article, and the address-level techniques in Field Guide #47.
What we are watching
- Whether addresses A, B and C consolidate into a single spend, which would answer the control question the chain has not yet answered.
- Whether C — the 12,500,000-satoshi share — ever moves, and where.
- Whether any further ico-20 mint confirms. One in nineteen hours is, on this evidence, the new rate.
- Whether the LEAF marketplace ever reports a price, a buyer or a trade.
- Whether the project’s Telegram or X channels address either the sweep or the whitehat pairing.
- Whether the whitehat address spends anything at all. It has not since 7 September.
New marker AI1: by 00:00 UTC on Wednesday 16 September, at least one of addresses A, B or C spends an output into a transaction that also spends from another of the three — the on-chain test for common control. Reading at publication: no such transaction. This desk expects this to fail, and says so in advance.
Sunday’s marker AE1 — cumulative ico-20 mints paying the whitehat address reaching 2,000 by 00:00 UTC Wednesday — stands at 1,114 with one mint in the last nineteen hours. It was published with a stated expectation of failure, and on this rate it will not clear the bar — but it settles at 00:00 UTC Wednesday, and this desk does not call a marker before its settlement date.
Method: prices, funding, open interest, basis, mining and on-chain figures in this article are pulled directly by Bitcoin Mastery at the timestamp stated — Bitstamp BTC/USD daily candles for closes, Binance BTCUSDT spot and USDT-margined perpetual for intraday, open interest, funding and account ratios, Binance COIN-M quarterly contracts for basis, mempool.space for difficulty, hashrate, address balances and individual Bitcoin transactions, blockstream.info’s Liquid API for sidechain block heights, hashes, timestamps and transaction counts, alternative.me for the Fear & Greed series and Farside Investors’ table for ETF flows. Transaction counts, fee totals, byte totals and OP_RETURN payloads are recomputed from the full confirmed transaction list of the address concerned, not read off a summary. Where a third-party figure is cited we name the source and its date; where two sources disagree we print both. Every streak or extreme figure is published with the first date of its series in the same sentence.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Cryptocurrencies are volatile and you can lose money. Nothing here is a recommendation to buy or sell any security, digital asset, token or exchange-traded fund, including MSTR, L-BTC, ORDI or the LEAF token where discussed above. Token sales of the kind described in this article are unaudited, frequently anonymous and have no obligation to deliver anything in return for a payment; treat any coin sent to one as capable of going to zero. Do your own research and consult a licensed financial advisor before making investment decisions.