Bitcoin Magazine I Scanned the Entire Bitcoin Blockchain for Images. Here’s What I Found

I scanned the Bitcoin blockchain for images, and the result was unexpected. Much has been said online about the arbitrary data and content that can be found on the Bitcoin blockchain. That possibility has helped give rise to a niche art scene, and it has also fueled a movement against “non-monetary transactions” on the Bitcoin network. From the way proponents and detractors discuss it, you might imagine the blockchain as a wall covered in graffiti.

I decided to test the claim directly: are there actually images on the blockchain, and what does that mean for Bitcoiners who want to run their own full node and maximize their financial sovereignty? My approach was straightforward. I bought a fresh hard drive to store the blockchain and then ran classic image recovery software over the data — the kind of tool used to rescue images from broken hard drives and detect raw image data.

I chose PhotoRec, an open-source image recovery program that has been around for more than 20 years. The software is designed to find image files in raw data. It can recover images and other file formats from hard drives that have failed or become corrupted. It is also often used to recover lost wallet.dat files from the early days of Bitcoin wallets, before seed words became widely used.

Syncing the Full Bitcoin Node

To store the full Bitcoin blockchain, I bought a 4-terabyte disk drive for a couple of hundred dollars. I installed the latest version of Bitcoin Core on it and began syncing the chain. The process, which involves downloading and verifying the accounting integrity of all transactions in Bitcoin history, took about 72 hours, or three days, with Bitcoin Core handling it automatically in the background. I carried this out on an otherwise powerful gaming machine; the main bottleneck was the disk drive, which is slow to read and write data during Bitcoin blockchain synchronization.

The slowest part of the process involves the unspent transaction output set, or UTXO. When someone syncs the blockchain, every unspent transaction value, or positive balance, is organized into the UTXO set. As those values are spent, they are removed from the set, and the new address receiving the satoshi is added.

On a disk drive, this UTXO indexing process could have taken three weeks according to some estimates, so to speed things up, my clanker, an AI agent, suggested indexing the data in RAM first and then moving the data back to the 4-terabyte disk drive. Although the full process took three days while running in the background, an SSD could have completed the job in about a day. SSD drives are much faster than disk drives, but they are also more expensive — often four times the price, or more.

Once the blockchain had been fully downloaded and validated, I moved the UTXO index from RAM back to the disk and booted the Bitcoin software. The chain was fully synced, and the wallet was ready to use. At that point, the question was less about finding hidden artwork and more about whether ordinary node operators would ever need to worry about arbitrary data showing up in the stored chain itself. The next step was recovering any images stored on the blockchain.

Image Recovery on the Blockchain with PhotoRec

With the full Bitcoin blockchain on my disk drive, I turned off Bitcoin Core and asked my clanker, the Cursor AI agent, to run PhotoRec 7.2 on the drive. By default, PhotoRec searches for jpg, png, gif, tif, bmp, ico, psd, and raw formats. The process ran for more than 11 hours on the blockchain data and ultimately found nothing.

After scanning more than a terabyte of blockchain data for half a day, no images turned up. The PhotoRec wiki page provides a simple example of how the software works: “PhotoRec identifies a JPEG file when a block begins with: 0xff, 0xd8, 0xff, 0xe0, 0xff, 0xd8, 0xff, 0xe1, or 0xff, 0xd8, 0xff, 0xfe.” In other words, the program scans the data on the disk for byte patterns that indicate an image file.

The program can produce false positives. It saved 8 ICO files and 4 identical PNG files that do not show any images when opened, as seen in the picture below. In practical terms, no meaningful images of any kind were found.

Where Did the Jpegs Go? XOR Magic Tricks

How is this possible? For years, crypto users have discussed NFTs and the possibility of engraving image data onto the Bitcoin blockchain. Millions of dollars have moved through this niche, and a culture war around the issue is still ongoing. Can there really be no images on the chain?

The risks of arbitrary data have been discussed and planned for in Bitcoin Core development circles for a long time, as early as 2011. XOR, a simple data obfuscation technique, is used to scramble blockchain data while it is stored on a hard drive.

In simple terms, computers work with 0s and 1s, and XOR compares two bits and returns 1 if they are different or 0 if they are the same. In Bitcoin’s case, XOR compares every bit of blockchain data to a random key generated during initial installation, producing data at rest that other programs cannot interpret. When Bitcoin software runs, it has the key needed to unscramble that data and use it. XOR is also very fast, so it does not meaningfully affect performance. Here is an example of the Bitcoin genesis block before and after an XOR.

XOR is currently applied to both the blockchain data and the UTXO set. It was first discussed in 2014, when antivirus software began misidentifying blockchain data as virus code. The antivirus software would quarantine a block, corrupting the blockchain data and crashing Bitcoin, which made syncing impossible. By the end of 2015, XOR had been implemented on the UTXO set data at rest, and in 2024 it was implemented on all blockchain data at rest.

The XOR process means that arbitrary data cannot be identified or extracted from the blockchain without intentionally bypassing the XOR. That step is not necessary for monetary use of Bitcoin. Because Bitcoin Core keeps a simple database of the location of each scrambled block, it can retrieve the data, unscramble it, and use it in a targeted way. Syncing Bitcoin in an unscrambled form is a custom process that can take as long as syncing from scratch, since it effectively requires rewriting the full terabyte of data in a new order. For someone who simply wants the normal privacy and security benefits of running a Bitcoin node, there is little point in doing that.

So, for the vast majority of copies of the Bitcoin blockchain data stored on the computers of ordinary Bitcoin users around the world, there is effectively no arbitrary data or images that can be identified. Shocking, I know. Feel free to run the PhotoRec test yourself on your own node.

This post, I Scanned the Entire Bitcoin Blockchain for Images. What I Found Will Shock You, first appeared on Bitcoin Magazine and is written by Juan Galt.