SandpitWarrior Master Plan & UTXO Query Tool
Sanitized UTXO Guiding Principles
Before Bitcoin Private can restart on a modern chain, the project must publish a cleaned starting balance set (the relaunch UTXO). That set should preserve legitimate holders as far as possible while excluding value that was illicitly created or still controlled by bad actors.
This page summarizes the major policy choices guiding that work. It is written for holders, exchanges, and other stakeholders. It is intentionally high-level: operational internals, forensic tooling, and implementation detail are not published here.
1. Mandate
The governing mandate for the cleaned UTXO is straightforward:
- Identify and exclude as much illicit value as can be responsibly attributed to bad-actor control, so the relaunch supply is not inflated by stolen minting.
- Do so in a way that minimizes harm to innocent holders — especially exchange depositors who never held private keys.
- Prefer precision over maximal blast radius: tracing may surface candidates; expunging is reserved for concentrations that survive policy filters, not for every address that ever sat downstream of a risky path.
In short: remove exploiter-held illicit supply where attribution is strong; do not “clean” the chain by casually destroying ordinary users.
2. What is this trying to achieve
- Fair restart. Honest self-custody holders should recognize their balances on the new chain.
- Targeted remediation. Where value can be attributed to illicit minting or continued bad-actor control, it should not be carried forward as spendable supply.
- Protect depositors, not punish them for custodian failure. Users who only ever held BTCP on an exchange should not be wiped out merely because the venue mishandled funds or later disappeared.
- Transparency without enabling abuse. Policies and high-level outcomes will be explained publicly; recipes that would help a hostile party reconstruct or fork a competing unclean launch are not.
3. Surgical cleanup, not a blank slate
The project rejected “wipe everything and airdrop from scratch” as the default. Instead, the relaunch UTXO is built from the historical transparent state after applying published remediation rules. Legitimate economic activity that already entered normal markets is treated with care; remediation focuses on exploiter-held value, not on every coin that ever touched a risky path.
That approach continues a principle already used in earlier community remediation: coins that reached ordinary exchange users in good faith are treated as legitimate; coins still attributable to exploiters are not. The exchange policies below are that same principle applied consistently.
4. Operational exchanges — leave balances in place
Where an exchange (or similar custodian) is still operational and can act as a live counterparty for depositors, balances attributed to that venue’s wallets remain in the transparent set at relaunch.
- As per Terms and Conditions of most exchanges, the respective exchange retains a contractual custodial relationship with its customers.
- Whether users can withdraw is a matter between the exchange and its depositors.
- Past disputes about a venue’s behavior do not by themselves justify destroying customer balances on the new chain.
- There is no policy bucket whose purpose is “erase an exchange.” Remediation targets illicit attribution, not branding.
Before the UTXO is frozen, the project is confirming remaining questions with operational venues so that customer funds are not misclassified.
5. Defunct exchanges — redemption fund
Where a venue is defunct and no counterparty remains to honor depositor claims, identifiable exchange-held balances are not simply deleted into the void. They are moved into a redemption fund held for entitled users:
- Redemption fund / set-aside for people who can show they were entitled to those balances.
- Claim standard: entitlement, not key possession. Acceptable evidence is yet to be determined, while evidence examples may be exchange account records, deposit or withdrawal history, correspondence with the custodian, or a documented chain of custody. A cryptographic signature from the address proves possession of keys — it does not by itself prove a depositor’s entitlement, and would favor whoever still holds those keys.
- Time-bounded window long enough for dispersed holders to learn about the process (policy target: on the order of 24 months from the claim mechanism going live — not a short “gotcha” window).
- Unclaimed residue directed to a community grants / development fund, not retained as discretionary treasury windfall for whoever decided the remediation.
- Discoverability. Addresses assigned to the redemption fund are intended to be published and checkable (including via this balance tool) so holders can find out whether they are affected, rather than having to guess.
Exact claim procedures and support channels will be announced when the mechanism is ready. Holders who used defunct venues should keep any exchange statements or account exports they still have.
6. Custodian conduct is not the test
Disposition depends on a simple, checkable question: is there still a live counterparty? Operational → leave in place. Defunct → redemption path. Historical negligence, hostility, or poor communication by a custodian does not convert legitimate customer balances into expunge candidates.
7. Distinguishing actors from exchanges (“first-receiver” exclusion)
Illicit value typically leaves the shielded pool into transparent addresses controlled by the actor. Those first transparent receivers of illicit unshielding are treated as actor-side, not as exchanges.
Known exchange wallets, by contrast, appear further downstream — as cash-out or custody destinations, not as the first stop after an illicit unshield. Under project policy, a wallet that is a first receiver of an illicit unshield is not classified as an exchange for protection purposes. That rule prevents “labeling the actor’s own wallets as exchanges” and then shielding them from remediation.
This is a policy filter, not a public how-to. The operational lists and tracing steps remain internal.
8. Limitations — why careful labeling matters
Automated “looks like an exchange” structure is not enough on its own. Many real custodial wallets have little on-chain structure (few transactions, little clustering signal). Relying only on structure would miss genuine exchange addresses — and missing an exchange is the expensive error, because it risks prejudicing innocent depositors.
Therefore the project treats curated, evidence-backed exchange labels as significantly important safety controls, not as optional polish. Where confidence is low, policy biases toward protecting depositors (leave-in-place, redemption, or contingency — see below) rather than aggressive removal.
Expunge / exclusion from the relaunch set applies to coins attributable to bad actors — never as a way to “delete an exchange” as an institution.
9. Contingency fund — residual fairness
Not every depositor-related coin can be perfectly labeled in advance. Some venues never swept per-user deposit addresses into a hot wallet; those addresses can look like ordinary personal wallets. Expunging them without a backstop would punish people who did nothing wrong — including later buyers who never knew the address was exchange-related.
The project therefore adopts a contingency fund alongside the redemption fund. At a high level it is meant to cover residual harm that careful process still cannot perfectly pre-classify, including:
- Expunged-but-entitled — coins removed because an address could not be safely identified as exchange-controlled, where a depositor (or successor buyer) later proves entitlement.
- Make-whole for mistaken exchange hits — if an exchange-controlled wallet is removed in error despite policy filters, the project’s posture is to restore that value rather than leave depositors permanently short.
Prevention first. Contingency is a safety net, not the primary control. The preferred order is: strong protected exchange lists, conservative attribution, bounded tracing, then contingency for what still slips through. The size of the contingency is deliberately not finalized until remediation totals are clearer — an adopted policy with an amount to be set, not a blank check advertised in advance.
10. Unmoved legacy airdrop / fork allocation
Bitcoin Private’s history includes large early allocations from the fork/airdrop era. Where those outputs remained unmoved under prior network rules, the relaunch must decide what remains spendable. The public posture is continuity with the project’s long-standing remediation narrative: unmoved legacy allocations that were already treated as non-spendable under historical consensus intent are not revived as free spendable supply on the new chain. Details of eligibility lists will be published with the final UTXO package — not as a do-it-yourself reconstruction guide.
11. What we will and will not publish
- Will publish: high-level policies (this page); roadmap status; eventually address balance checks; claim guidance and discoverability for redemption when live.
- Will not publish: step-by-step forensic recipes, internal tooling, hop-by-hop working papers, or materials that would help a hostile party assemble an alternate unclean launch.
12. Current status
Sanitized UTXO finalization is in progress. Some classifications remain open pending confirmation from operational counterparties. Redemption and contingency mechanisms are adopted as policy; claim UX and exact sizing follow once the cleaned set is closer to freeze. Until then, any balances shown on the query tool should be treated as preliminary if a demo or intermediate dataset is loaded.
Related pages: Balance · Overall BTCP Timeline · Roadmap