Hanshan on Nostr: This is a short write-up about bad stealth addresses that appear on the #monero ...

This is a short write-up about bad stealth addresses that appear on the #monero blockchain.
They are provably unspendable and appear some 9k times.

quoting
naddr1qv…vlf5

Interesting find from my implementation of the Monero Inflation Checker (MIC). Some actor was sending coins to invalid stealth addresses. It seems unlikely this was searching for an exploit... But then it continues for three years, so seems unlikely it's just an undiscovered bug too. Heres a writeup about it. There are some badly formed Borromean range-proofs early in the chain but I want to understand those a little better before I post something. Cheers fam.

A single non-subgroup curve point embedded in ~7,355 blocks

What: One specific ed25519 point (9b2e4c02…) that is not on the prime-order subgroup appears in 7,355 unique blocks spanning heights 200,382 → 1,839,780, always in the stealth address position. It accounts for the overwhelming bulk of the 8,931 "points outside subgroup" entries. It recurs in a dense cluster around heights 323,000–323,500 (~300 blocks), plus a second, smaller cluster later. A second point (2a74a3c4…) shows the same pattern at smaller scale (36 blocks), and a tail of ~16 minor points appear 1–5 times each.

What it means: A stealth address is supposed to be derived as a valid subgroup point; a non-subgroup point in that position means someone was generating output keys with broken or deliberately tweaked math — and did so thousands of times over 1.6M blocks (~3 years of chain history). The two candidate explanations are (a) one actor (wallet software, bot, or researcher) repeatedly emitting a malformed/tweaked output key, or (b) a systemic generator artifact in some wallet implementation from that era.

It is not an inflation vector — the point is on the curve, funds are still spendable-bound normally by consensus rules, and the checker's fallback verification handles it — but it's a real, previously undocumented census of pathological output keys on-chain. Until the txs embedding it are extracted and examined, this is the scan's most interesting open thread.

Summary in one line: a non-subgroup stealth address is a curve point outside the reach of the protocol's scalar algebra; consensus never forbade it, it's an address so it can't inflate anything, and it's eternally unspendable — so the scan's deepest anomaly is not a crack in Monero's supply, but a three-year archaeological record of someone torching their own coins.