# The Permanent Record — Full Technical Reference & Protocol Dossier # Site: https://opreturn.xyz # Canonical Manifest: https://opreturn.xyz/llms.txt ## 1. System Architecture The Permanent Record is an edge-native Bitcoin OP_RETURN monitor built on: - **Cloudflare Workers**: High-performance V8 isolate runtime handling HTTP routing, content negotiation, and SSR. - **Cloudflare D1 (SQLite)**: Globally replicated database storing collections, monitored addresses, and classified messages. - **Hono**: Ultrafast, zero-dependency web framework. - **mempool.space API**: Multi-endpoint live blockchain polling (confirmed and unconfirmed mempool transactions). - **Edge Resvg (WASM)**: On-demand serverless generation of OpenGraph PNG social cards. - **Proof-of-Work Mining (16-bit SHA-256)**: Client-side spam mitigation for likes and address suggestions. --- ## 2. Field Manual: How to Etch a Message onto Bitcoin An OP_RETURN output lets you attach arbitrary binary or UTF-8 data to a Bitcoin transaction. ### Step 1: Understand the Constraints - Standard UTF-8 text payload. - Bitcoin Core 30.0 (October 2025) raised the default -datacarriersize from 83 to 100,000 bytes, which effectively uncaps OP_RETURN data because the transaction size limit is reached first, and began relaying and mining transactions with multiple OP_RETURN outputs. This is relay and mining policy, not a consensus rule; node operators can restore the old limit with -datacarriersize=83. - Cost: Standard miner fees (sat/vB) for the transaction virtual size. - 0 sats output value (provably unspendable). ### Step 2: Constructing with Bitcoin Core CLI ```bash # 1. Encode your text message to hex DATA=$(printf 'gm, permanent record' | xxd -p -c 999) # 2. Create raw transaction with OP_RETURN output and change bitcoin-cli -named createrawtransaction \ inputs='[{"txid":"","vout":0}]' \ outputs='[{"data":"'$DATA'"},{"":0.00095}]' # 3. Sign transaction bitcoin-cli signrawtransactionwithwallet "" # 4. Broadcast to the mempool bitcoin-cli sendrawtransaction "" ``` ### Step 3: Constructing with a wallet 1. Navigate to **Send**. 2. Click **Add OP_RETURN** in the transaction outputs section. 3. Paste plain text or hex data. 4. Set recipient change address and appropriate sat/vB fee rate. 5. Sign and broadcast. --- ## 3. Curated Collections Catalog ### Coldcard Exploit Bulletin Board - **Slug**: `coldcard-exploit-bulletin-board` - **Description**: Main attacker consolidation addresses from the July-August 2026 Coldcard firmware RNG exploit. These became the most active public OP_RETURN message boards, filled with begging, laundry ads, threats, haikus, philosophical notes and prompt injections. - **Metrics**: 8 monitored addresses, 59 archived messages - **Feed**: https://opreturn.xyz/c/coldcard-exploit-bulletin-board - **Chat Room**: https://opreturn.xyz/c/coldcard-exploit-bulletin-board/chat - **Monitored Addresses**: - `bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r` — *Primary holding address (highest message volume)* - `bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3` — *Major holding address* - `bc1q8jy96fe5lf8vfugydnte3cguk92gpev7kwtp3q` — *Holding address* - `bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0` — *Early collector / residue* - `bc1qtfrwa4j6rmj9rsgspv6a0yjumkg39js2numu75` — *Holding address* - `bc1qmd5m5ktv7m5ffujxv4248fxv36myvdx79n8jp6` — *Collector residue* - `bc1qsjrf5ze5tmulz7y2x4pc7qaex2a35sanp3rqlx` — *Additional monitored holding address* - `bc1q0rvn88w08j75k4h48lf9fvhan7unjp7vjf5q6m` — *Wave 4 consolidation address* ### High-Value Dormant Wallet Notices - **Slug**: `high-value-dormant-wallet-notices` - **Description**: High-balance early (mostly 2010-2011) addresses that have received systematic OP_RETURN legal notices, ownership claims, phishing links and 'abandoned property' messages (including the 2025 Salomon Brothers-style campaigns). - **Metrics**: 6 monitored addresses, 27 archived messages - **Feed**: https://opreturn.xyz/c/high-value-dormant-wallet-notices - **Chat Room**: https://opreturn.xyz/c/high-value-dormant-wallet-notices/chat - **Monitored Addresses**: - `1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF` — *Mt. Gox related (also appears in dormant notices)* - `1LdRcdxfbSnmCYYNdeYpUnztiYzVfBEQeC` — *Large long-dormant address* - `12ib7dApVFvg82TXKycWBNpN8kFyiAN1dr` — *Early high-value dormant address* - `12tkqA9xSoowkzoERHMWNKsTey55YEBqkv` — *Early high-value dormant address* - `1PeizMg76Cf96nUQrYg8xuoZWLQozU5zGW` — *Long-dormant high-balance address* - `1F34duy2eeMz5mSrvFepVzy7Y1rBsnAyWC` — *Long-dormant high-balance address* ### Genesis & Satoshi Tribute - **Slug**: `genesis-satoshi-tribute` - **Description**: The Genesis block address. A long-running cultural phenomenon where people send symbolic tributes, memorials, and messages to Satoshi. - **Metrics**: 1 monitored addresses, 694 archived messages - **Feed**: https://opreturn.xyz/c/genesis-satoshi-tribute - **Chat Room**: https://opreturn.xyz/c/genesis-satoshi-tribute/chat - **Monitored Addresses**: - `1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa` — *Genesis block address (Satoshi)* ### Russian Intelligence Marking Campaign - **Slug**: `russian-intelligence-marking-campaign` - **Description**: Addresses publicly labeled via OP_RETURN in early 2022 as belonging to Russian intelligence agencies (GRU / SVR / FSB). Classic geopolitical on-chain marking campaign. - **Metrics**: 3 monitored addresses, 102 archived messages - **Feed**: https://opreturn.xyz/c/russian-intelligence-marking-campaign - **Chat Room**: https://opreturn.xyz/c/russian-intelligence-marking-campaign/chat - **Monitored Addresses**: - `1DLA46sXYps3PdS3HpGfdt9MbQpo6FytPm` — *Linked to SVR / SolarWinds infrastructure* - `1L5QKvh2Fc86j947rZt12rX1EFrCGb2uPf` — *Linked to SVR / SolarWinds infrastructure* - `18N9jzCDsV9ekiLW8jJSA1rXDXw1Yx4hDh` — *Linked to GRU / DCLeaks activity* ### Cultural Memorials & Digital Graffiti - **Slug**: `cultural-memorials-digital-graffiti` - **Description**: Addresses and vanity addresses associated with permanent cultural tributes, memorials, religious messages, and early digital graffiti on Bitcoin. - **Metrics**: 2 monitored addresses, 3 archived messages - **Feed**: https://opreturn.xyz/c/cultural-memorials-digital-graffiti - **Chat Room**: https://opreturn.xyz/c/cultural-memorials-digital-graffiti/chat - **Monitored Addresses**: - `1BibLEafdYxCvioFhuemkbiY9r6TT5iNBn` — *Bible-themed vanity address* - `1GoDxxMEvikCb7JLAuqGWNeht75E48AgN6` — *God loves me vanity address* ### Historical Hacker Negotiation Boards - **Slug**: `historical-hacker-negotiation-boards` - **Description**: Addresses from past major incidents that have been used for public on-chain negotiation, bounty offers, threats, or responses between victims, projects, and attackers. - **Metrics**: 0 monitored addresses, 0 archived messages - **Feed**: https://opreturn.xyz/c/historical-hacker-negotiation-boards - **Chat Room**: https://opreturn.xyz/c/historical-hacker-negotiation-boards/chat ### Liquid Network Peg-Out Bulletin Board - **Slug**: `liquid-network-peg-out-bulletin-board` - **Description**: Addresses from the September 2026 Liquid Network incident, in which self-described whitehats used an L-BTC inflation bug and a valid SideSwap peg-out authorization to withdraw ~3,996 BTC (about 95% of federation reserves) in block 965,783. The hackers, Blockstream security and the usual crowd of lawyers, launderers and wallet ads are all talking through OP_RETURN. - **Metrics**: 4 monitored addresses, 627 archived messages - **Feed**: https://opreturn.xyz/c/liquid-network-peg-out-bulletin-board - **Chat Room**: https://opreturn.xyz/c/liquid-network-peg-out-bulletin-board/chat - **Monitored Addresses**: - `bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte` — *Hacker holding address (~3,998 BTC; 'we are whitehats. contact us on chain')* - `bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr` — *Liquid federation peg-out address (drained; hackers reply to it on chain)* - `bc1qgslsydz56d0ed6827hdemfmk5w2f6ldyc6wt7p` — *Peg-out intermediary (received the 3,996 BTC in tx 8db751...a7b140, forwarded same block)* - `bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym` — *Blockstream security responder (PGP-signed / ECIES-encrypted messages to the hackers)* ### Bitget Hack Bulletin Board - **Slug**: `bitget-hack-bulletin-board` - **Description**: Largest unspent Bitcoin parcels attributed to the attacker in the 24 September 2026 Bitget hot-wallet breach. Bitget says about $387.5 million left its hot and warm wallets across Ethereum, XRP, TRON, Zcash and other chains, and much of what moved was swapped into BTC. These eight addresses are the biggest balances on Bitget's public stolen-funds tracker (trace.bgblockchain.xyz) as of 28 September 2026: about 190 BTC, mostly a single receipt each. - **Metrics**: 8 monitored addresses, 0 archived messages - **Feed**: https://opreturn.xyz/c/bitget-hack-bulletin-board - **Chat Room**: https://opreturn.xyz/c/bitget-hack-bulletin-board/chat - **Monitored Addresses**: - `bc1q578370zc2zrr39l9prsjfc7xhwdmhek3pavwvz` — *42.06 BTC holding address* - `bc1q3q57s0etyfla66rwtckfxt5zzz0emclmjjy7mw` — *25.99 BTC holding address* - `bc1qzacwkkldkee3cnsg3ntq9a4ppxcy8kyl8tecsw` — *25.38 BTC holding address* - `bc1qcjndd78tmvsmdttazc50gfsfa3qqdx4f6ru5dj` — *21.57 BTC holding address* - `bc1q6ctdtjk2zej0kem9f0jmq7kntq3xkhhgt234dc` — *21.27 BTC holding address* - `bc1qq2g6up5ete6s35qm7k0tqd8z2lhlk4rwhxz9lu` — *18.55 BTC holding address* - `bc1ql0nc646qq8c8anrfumk42ugwt528ymlz2za7yp` — *18.21 BTC holding address* - `bc1qyrntxyc9pkef88v97lshnmhs2dk966ersgjghe` — *17.23 BTC holding address* --- ## 4. REST API Endpoint Specifications ### GET /api/collections Returns all tracked collections with live statistical tallies. ### GET /api/messages Query parameters: - `sort`: 'hot' (by likes) or 'new' (chronological) - `limit`: 1 to 100 (default 50) - `collection_id`: Filter by numeric collection ID - `address`: Filter by recipient Bitcoin address - `category`: Filter by classification category slug - `before`: Keyset cursor for pagination (`likes:ts:id` or `ts:id`) ### GET /api/chat Query parameters: - `collection_id` or `address` (at least one required) - `limit`: 1 to 200 (default 200) - `before`: Keyset pagination cursor ### GET /api/message/:key Fetch single message by numeric ID or 64-character txid. --- ## 5. Security & Privacy Philosophy - **Non-Custodial**: The Permanent Record never requests private keys, runs no wallet software, and performs purely read-only on-chain indexing. - **Anti-KYC / Cypherpunk**: No tracking cookies, no third-party telemetry, no surveillance scripts. - **Proof-of-Work Anti-Spam**: Public likes and address suggestions require mining a 16-bit SHA-256 partial pre-image nonce, preventing bot floods without CAPTCHAs or KYC.