A three-week run of cryptic letter strings inscribed into the Bitcoin blockchain was the work of an automated publishing experiment rather than an attempt to conceal hidden messages, according to a new analysis by Galaxy Research. The firm examined 562 of the texts, which resembled encrypted sentences and appeared at a pace that peaked at roughly 40 transactions per day.

Galaxy traced the funding behind the activity to the same wallet responsible for a 44,194-byte upload of the US Constitution on May 29. The firm’s accounting showed that 3.33 million satoshis financed the operation, with 24% of that total consumed by mining fees. Researchers nicknamed the operator “Babel Scribe,” describing a tool under testing rather than a channel for secret communications.

OP_RETURN Messages Show Random Patterns

Galaxy Research published its findings on X on October 25, 2026, after examining messages that resembled encrypted sentences. Across the sample, each letter of the alphabet appeared between 3.6% and 4.2% of the time. English displays a far more uneven distribution, ranging from 12.7% for the letter “e” down to 0.07% for “z.”

The distinction matters because simple substitution ciphers preserve letter-frequency patterns even when individual letters are replaced. Galaxy measured an index of coincidence of 0.0385, a reading consistent with random text. The index of coincidence is a standard cryptanalysis measure for distinguishing natural language from random sequences.

The researchers also tested for repeating encryption keys across intervals of up to 40 letters. The messages lacked the statistical spikes that surfaced in a control comparison using an encrypted copy of the Constitution.

Word lengths provided another clue. Lengths from two through ten letters appeared equally often, while English typically favors words of three or four letters. Short messages filled 36 bytes, sometimes padded with single letters. Only ten words containing at least four letters repeated anywhere across the 562 texts.

Together, those patterns supported Galaxy’s assessment that software generated random letters and arranged them to resemble prose.

For three weeks someone has been writing sentences like this into Bitcoin, ~40 times a day: "Ieqkenszm aalzrnbgtr nxnstd gubighxvfg byvzwrzk df qukz." Looks like a cipher. It isn't. And the coins behind it belong to the wallet that inscribed the US Constitution in May. pic.twitter.com/IkEK9SxCkB

— Galaxy Research (@glxyresearch) October 25, 2026

Source: Galaxy Research on X

Funding Trail Reveals Automated Testing

The transaction structure reinforced that interpretation. Every transaction in the series contained exactly one input, one fresh change address, and one OP_RETURN output—the Bitcoin mechanism that allows a transaction to carry data, which explains how the messages appeared on the blockchain. Once confirmed, OP_RETURN data becomes part of the blockchain’s permanent public record—one reason inscriptions like these remain visible to anyone examining the chain. Each subsequent transaction spent the change from its predecessor, producing linked sequences the researchers could follow.

Galaxy identified 31 chains, with the longest stretching 86 transactions. Splitter outputs supplied the chains with either 20,000 or 5,000 satoshis. Long messages arrived every six hours per chain, while shorter messages followed 90-minute intervals. Daily activity climbed from 12 transactions to 24, and eventually to roughly 40 per day.

The funding trail led back to three small exchange withdrawals in May. Related uploads included 99,000 bytes of uppercase gibberish on June 5 and the Declaration of Independence on July 4. Earlier tests featured “Hello, world,” Lorem ipsum, multilingual words, and a JSON file explicitly describing an upload test. Galaxy also identified 34 opaque binary blobs.

Fees, Not Payments

For Bitcoin users, the practical effect is transaction activity and fee spending rather than an identified payment scheme. The three documents alone cost 512,000 satoshis in mining fees. Galaxy reported that 76% of the funds remained in the operator’s addresses, with nothing paid to anyone. The findings point to automated data publishing, without establishing the operator’s identity or a broader purpose. Beyond this case, the study demonstrates how letter-frequency counts, the index of coincidence, and key-repetition tests can separate random generation from a genuine cipher when cryptic strings surface on-chain. Whether Babel Scribe writes again is the open thread, and any resumption would be visible on the public ledger Galaxy followed.