The dump is reported to contain roughly 62,400 unique bitcoin addresses. Chain analysis of them found evidence of transaction activity on 49.
The ratio is not a payment rate and this file is not claiming it is one. Addresses are generated cheaply and for many reasons — per build, per target, per attempt, including attempts that never reached a victim. What the figure measures is how little an address count constrains anything.
This Corpus Has Been Handed The Opposite Kind Of Number Before
At 25-0227 a chain analysis produced an "at least": $107m traced to Black Basta, a floor derived from a public ledger. That figure was useful precisely because it could only be an undercount.
An address count is the other shape. It is a ceiling with nothing underneath it, and a headline built on 62,400 of anything would describe a quantity of database rows.
The Distinction The Corpus Keeps Returning To
Reachable, taken and published are three populations, recorded at 25-0717 where a notification count and a researcher count of the same incident differed by around 400,000 and both were correct.
Generated, sent and paid is the same structure applied to money. Every operational system in this field produces artefacts at the first stage in volumes that say nothing about the third, and every one of those volumes is available to anybody who wants a large number.
What It Says About The Operation Is More Limited
It would be tempting to read 49 active addresses as evidence that almost nothing worked. That reading is not supported: the dump covers a lower-tier programme over roughly four months, per 25-0508, and payments routed through addresses outside it would not appear.
Graded medium for that reason. The address figure is solid; every inference from it is bounded by what the dump does not cover.
Address counts and chain-activity findings are as reported in published analyses of the panel dump, listed below. This desk has not examined the dump or reproduced the chain analysis. No payment rate is asserted here: the ratio of active to generated addresses is not one, and the underlying population is bounded by what the dump covers. Graded medium. Corrections: corrections@forensicpost.com.