© 2026 AnChain.AI. All Rights Reserved | Privacy Policy
Bitcoin is mined, but today it is mined mostly through large Bitcoin mining pools: sophisticated, often opaque infrastructure businesses that direct more than $10 billion in annualized block-subsidy value before transaction fees. Major pools such as Foundry USA, AntPool, F2Pool, ViaBTC, and SpiderPool account for the majority of observed Bitcoin block production.
Over the past few years, AnChain.AI has supported Bitcoin mining-pool forensic use cases across forensic accounting, crypto tracing, litigation support, AML compliance reviews, and investigative workflows. These cases often begin with a deceptively simple question: did this Bitcoin really come from mining?
The answer is technical. Newly mined BTC enters circulation through a coinbase transaction — the Bitcoin protocol term, not the Coinbase exchange — where there is no normal sender. In blockchain analytics systems, that origin may appear as a NULL sender, NULL input, or all-zero previous transaction reference. This article demystifies the forensic anatomy of Bitcoin mining pools: NULL-origin rewards, pool tags, reward addresses, payout flows, and how AnChain.AI CISO turns raw blockchain data into case-ready intelligence.
Bitcoin mining pool analytics is economically material because Bitcoin block production is concentrated. Hashrate Index currently lists Foundry USA at 26.8% pool share, AntPool at 19.6%, Together, the top five pools represent about 80% of observed pool share in that snapshot.
At a BTC price of about $64K, the post-halving 3.125 BTC subsidy creates about 450 BTC per day across roughly 144 blocks. That equals about $28.96 million per day, or about $10.57 billion per year, in new subsidy value before transaction fees.
Approximate daily subsidy flow by pool share, excluding fees:
There is also a strategic infrastructure trend: Bitcoin mining and AI data centers are converging around the same scarce resources: power, land, grid interconnects, cooling, substations, and high-voltage operations. The IEA projects global data-center electricity consumption to double to about 945 TWh by 2030, representing just under 3% of global electricity consumption, driven heavily by AI workloads. (IEA) Cambridge’s Bitcoin Electricity Consumption Index tracks Bitcoin network power demand and annualized electricity consumption, and the U.S. EIA cited CBECI’s 2023 Bitcoin-mining electricity range of 67–240 TWh, with a 120 TWh point estimate. (CCAF) (U.S. Energy Information Administration)
Forensics now has to follow both money and infrastructure. Mining cases increasingly intersect with AI/HPC conversion plans, hosting contracts, power-purchase agreements, equipment financing, tax records, curtailment payments, and energy-credit claims. A miner is no longer just a wallet owner. It may also be a data-center operator.
Bitcoin mining is solving cryptographic puzzles to create new Bitcoin blocks, secure the network, validate transactions, and earn BTC rewards.
Think of Bitcoin mining like buying lottery tickets, there are two main kinds:
Bitcoin mining creates economic value at the protocol layer, but most miners do not receive block rewards directly. They connect ASIC fleets to mining pools. The pool receives the coinbase reward, accounts for each miner’s contributed shares, then pays miners according to a payout method such as FPPS, PPS, PPS+, PPLNS, or solo-style settlement.
Mining pool analytics is critical for forensic accountants, law firms, investigators, exchanges, custodians, OTC desks, miners, hosting providers, lenders, and regulators. Given its highly sophisticated and technical nature, it requires blockchain forensics professionals.
Now, let’s deep dive into a recent real bitcoin mining pool transaction, to showcase blockchain forensics. This bitcoin transaction happened in June 29, 2026, at block height 955954:
2d285bb6b287cb0e2a53ae21c9689dbe2519abb67d9f74a9dd0e19d310171616 [blockchain explorer]
Let’s try to decode this bitcoin coinbase script to extract the mining pool tag. The key indicators are visible in the input:
This is the forensic reason the transaction appears as a NULL-origin reward in blockchain analytics. It is not missing data; it is the protocol fingerprint of newly mined BTC.
The important field for pool attribution is the sigscript:
Bitcoin coinbase scripts are made of pushed byte sequences. When decoded, this script breaks into several parts:
This is the mining pool attribution artifact. The readable coinbase tag contains /ViaBTC/, which indicates the block was mined through ViaBTC’s pool infrastructure. The rest of the string, Mined by 3440826406, is likely an internal miner, account, worker, or campaign identifier chosen by the pool or miner.
Now we have successfully decoded the mining pool tag from the bitcoin blockchain. This bitcoin is mined by ViaBTC, website showing:
In the AnChain.AI graph example, from May 26 to June 29, 2026, more than 1,400 BTC in mined rewards are associated with this ViaBTC mining-pool address. The subsequent payout graph shows distributions to 400+ downstream addresses, which may represent pool participants, payout beneficiaries, or related settlement wallets. Those relationships should be validated through payout behavior, labels, and off-chain records where available.
View the live graph: https://ciso.anchainai.com/s/5FXgkKRC6j2
Curious to investigate it yourself?
The AnChain.AI CISO platform is available for a free trial. Once sign up, you can trace Bitcoin mining-pool payouts by time range, beneficiary address, transaction flow, and downstream exposure.
This is not luck. The same forensic pattern appears across mining pools. Let’s decode another Bitcoin coinbase transaction. TXID [explorer]: d5840d42a9f857e22596e67189d3b6a52e7c6ecbc69d57bff9228334e2a2a05c
As with the ViaBTC example, the key forensic artifact is the coinbase sigscript:
03c7a00e04cbda8c562f466f756e6472792055534120506f6f6c202364726f70676f6c642f74bc4709c132000000000000
Decoded, the first segment, 03c7a00e, encodes the block height 958663. The next segment, 04cbda8c56, is miner or pool nonce data. The readable ASCII segment decodes to:
Foundry USA Pool #dropgold/
We just identified Foundry USA Pool as the mining-pool tag embedded in the coinbase transaction.
The forensic pattern is the same: start with the NULL-origin coinbase reward, decode the coinbase metadata, extract the pool tag, then trace the reward output and downstream payout path.
Foundry USA example — AnChain.AI CISO night mode:
View the live graph: https://ciso.anchainai.com/s/5HM3X24yFQE
One powerful feature that AnChain.AI customers love is the reporting capability.
Reporting is critical because blockchain evidence is only useful when it can be explained, reviewed, and defended. For forensic accountants, law enforcement, tax agencies, compliance teams, and litigation support, the report becomes the bridge between raw blockchain data and a decision: source-of-funds validation, suspicious activity escalation, subpoena support, tax analysis, expert review, or court-facing documentation.
Manually creating this type of report can easily take several hours for a simple coinbase-reward trace, and one to three days for a more complex case involving payout batches, exchange deposits, screenshots, USD conversions, labels, and narrative explanation. Analysts often have to collect block explorer data, decode scripts, capture transaction graphs, calculate values, verify timestamps, and assemble the findings into a readable format.
With AnChain.AI CISO, that workflow is compressed into minutes. The platform automates the evidence trail from mined-origin BTC to destination wallet, generates the visual transaction path, preserves key forensic artifacts, and produces a structured report that investigators can use for review, escalation, or case documentation.
For bitcoin mining pool analytics, the coinbase tag is an attribution signal, not final proof by itself. Tags can theoretically be copied. Stronger attribution combines the coinbase tag, reward address, payout behavior, entity labels, and where available, off-chain records such as pool account data, Stratum logs, KYC records, hosting invoices, ASIC serial numbers, and exchange account records.
AnChain.AI CISO platform [link] simplifies the end-to-end workflow for Bitcoin mining-pool blockchain forensics, from identifying mined-origin BTC to preparing a professional investigation report.
Can you further trace the mining pool payouts? https://ciso.anchainai.com/s/5FXgkKRC6j2
Bitcoin mining-pool forensics is no longer a niche technical exercise. It has become a practical requirement for source-of-funds reviews, forensic accounting, litigation, tax analysis, compliance, and crypto investigations.
In recent years, AnChain.AI has supported blockchain forensics cases across five major customer segments:
Bitcoin mining-pool forensics starts with a NULL-origin coinbase reward, but it does not end there. A defensible investigation must decode the pool tag, trace reward outputs, validate payout behavior, screen downstream exposure, and integrate off-chain business evidence.
© 2026 AnChain.AI. All Rights Reserved | Privacy Policy