Tracing the Pizza Day bitcoins
Every year the same articles. Counterfactual valuations, the road-trip rumor, the man-bites-pizza headline. Nobody traces the actual coins. So I did. Here is what the chain shows and what 'those specific bitcoins' even means.
Every May 22 the same articles. Some variant of "those pizzas would be worth a billion dollars today." The Bitcoin Pizza Index does the math live. The road-trip story gets retold: that jercos, the nineteen-year-old who took Laszlo Hanyecz's offer, sold the 10,000 BTC for cash on a road trip with his girlfriend. The most-cited blockchain analysis of the transaction is a Google Cloud notebook from 2018 that starts its trace from Hanyecz's sending address, not from jercos's recipient, and stops at depth 2.
I wanted to know what actually happened to the coins. Not the valuation. The chain. Where did they go in the first hop, the second, the fifth? Did any of them sit unspent? Is there a sense in which they are still anywhere?
The short answer is no. There are no Pizza Day bitcoins. The longer answer is the rest of this piece, and it teaches more about the question than about the coins.
More precisely: under one explicit tracing convention (strict positional FIFO) at a depth-5 horizon, no uniquely identifiable dormant Pizza Day UTXO exists in the traced frontier. The first sentence is what the convention concludes. The longer sentence is what the chain actually supports. The gap between them is why this piece is long.
Everything below is reproducible from a public repo: github.com/mnardit/pizza-day-trace. The raw CSV datasets sit in data/processed/ of that repo.
The transaction the legend points at
The anchor is transaction a1075db55d416d3ca199f55b6084e2115b9345e16c5cf302fc80e9d5fbf5d48d, mined in block 57043 on 2010-05-22 at 18:16:31 UTC. It has 131 inputs and 1 output. The output is 10,000 BTC to address 17SkEw2md5avVNyYgj6RiXuQKNwkXaxFyQ, jercos. So far this matches the legend.
The structure of the inputs is what surprised me first. All 131 came from a single sending address, 1XPTgDRhN8RFnzniWCddobD9iKZatrvH4, which Hanyecz publicly self-attributed in his bitcointalk pizza thread at the time. Of those 131, 111 were exactly 0.01 BTC, crumbs left over from earlier consolidations and tiny payments. The remaining 20 are chunkier: one piece of 3753.88 BTC, several in the 100-900 BTC range, all collected by Hanyecz at this same address over the prior 37 days. The largest input, that 3753.88 BTC piece, had been sitting at his address for only 5.2 days when he spent it on the pizza order. The mean age across all 131 was 30.7 days; the median 34 days.
There is also a detail that almost nobody mentions: this transaction paid a 0.99 BTC fee. Inputs totalled 10,000.99 BTC; the output was exactly 10,000 BTC; the difference went to whichever miner produced block 57043. In May 2010, when most transactions paid no fee at all, that 0.99 BTC was unusually large by usage norms — but in 2010 dollars its market value was a fraction of a US cent (Bitcoin Market and the earliest exchanges in late May 2010 quoted roughly $0.003–$0.008 per BTC). Restating the fee at May 2026 spot prices gives about $76k. Both numbers are accurate; they answer different questions, and quoting only the 2026 one performs the exact retrospective-valuation move this piece is trying to disarm.
One outlier carried 37.5% of the value Hanyecz needed.
The remaining 62.5% came from 19 mid-size inputs — plus 111 crumbs of 0.01 BTC each, padding out the long tail. So 85% of inputs by count contributed 0.01% of the value.
The shape (many crumbs, a few chunks, one outlier) is what you would see in a wallet that had been mining and receiving small payments steadily and got swept on short notice to assemble a round number. Hanyecz had to compose exactly 10,000 BTC and overshot by 0.99. He let the change go to the miner rather than add a change output and rebuild the transaction.
"The same coins" is not a thing in Bitcoin
Bitcoin uses an unspent-transaction-output (UTXO) model. A transaction consumes one or more existing UTXOs and produces new ones. Outputs are not labelled by their origin. A transaction with two inputs of 5 BTC each and two outputs of 4 BTC and 6 BTC has no canonical mapping from input satoshis to output satoshis. The 6 BTC output is from both inputs in equal measure; or from the first input plus the first 1 BTC of the second; or, under a different convention, from the second input. The chain itself does not pick.
This is not a bug. Bitcoin is unit-fungible — any satoshi is interchangeable with any other — but at the ledger layer it is lot-distinguishable: each UTXO is a uniquely addressable lot, the satoshis inside it are unlabelled, and the ledger never encodes which input satoshi flows to which output. The question "where are the bitcoins that paid for the pizza" therefore has no unique answer after the first hop. Anyone who claims otherwise has, knowingly or not, picked a tracing convention.
I picked one out loud. The convention used in this trace is strict positional FIFO. Each input is modelled as a value range whose first taint satoshis are tainted and the remaining value − taint are clean. Outputs are filled left-to-right by consuming inputs in order: for each input we donate its tainted portion first, then its clean portion. This is one of three reasonable choices. The methodology document explains why poison-taint and haircut conventions would re-attribute the numbers, though not change which transactions the trace visits in the no-pruning limit.
The choice is not new. Anderson, Shumailov, Ahmed, and Rietmann (Cambridge, WEIS 2018) argued that FIFO maps onto the rule from Devaynes v. Noble (1816), commonly cited as Clayton's Case — a Court of Chancery decision on tracing fungible money through mixed bank accounts — and that FIFO is lossless in a way poison and haircut are not. The legal-doctrine analogy is structural rather than literal: positional FIFO over UTXO indices is the chain-level analogue of temporal FIFO over deposit sequences, since the chain has no time-of-deposit signal within a single transaction. Later UK case law (notably Hallett's Estate 1880, Barlow Clowes 1992, and D'Aloia v. Persons Unknown [2024]) has substantially limited Clayton's rule and accepted non-FIFO tracing where properly evidenced, so I use FIFO here as algorithmic discipline, not as a binding legal mapping. The foundational empirical work on tracing Bitcoin transactions and clustering addresses is Meiklejohn et al.'s 2013 A Fistful of Bitcoins (IMC 2013), which won the IMC Test-of-Time Award in 2024. Neither paper makes "the same coins" claim do work it cannot do; both are honest about the convention being a choice.
I also stopped tracing past three thresholds, all chosen as trace budgets and explicitly not as forensic terminals:
- Any tainted UTXO smaller than 1 BTC is recorded as
dust-prunedand not followed. - Any transaction consuming a tainted UTXO alongside 100 or more inputs is treated as a cluster boundary; the input is recorded as
cluster-absorbed. - At depth 5, the trace stops. Remaining tainted UTXOs are recorded as
depth-pruned.
These are stop-conditions, not findings. When the trace ends at one, it ends because I chose to stop looking, not because the coins did anything in particular.
What the chain shows
Under that convention, the descendant graph is small. Ten distinct UTXOs across seven distinct transactions, no fan-out larger than two-way, no early cluster terminations, no dust pruning. Total tainted value at the depth-5 horizon: 10,000 BTC. Conserved.
Tracing the Pizza Day taint, anchor to horizon
10 UTXOs across 7 transactions, top to bottom. All values are BTC tainted, not UTXO value. Total taint at the depth-5 horizon conserves the original 10,000.
What that graph hides is timing. Read it left to right and you might imagine the coins flowing forward smoothly. They did not.
The first hop happened immediately. Ten minutes after Hanyecz's transaction was confirmed, in block 57044, jercos's 17SkEw… address spent the full 10,000 BTC, splitting it into 5,777 BTC at 1MLh2… and 4,223 BTC at an unencoded P2PK output. Fifty-seven minutes after the original pizza transaction, in block 57053, the 5,777 BTC half moved one more hop to 18ZChqRsb7eKgH8wLg9Pfkkezux34pf6eo. Then both halves sat.
For 45 days, neither half moved.
On 2010-07-07 at 02:56 UTC, in block 64683, the dormancy ended in one transaction. That transaction had twenty inputs. Two of them carried the pizza taint: 4,223 BTC from the still-unmoved P2PK output and 5,777 BTC from 18ZChq…. The other eighteen inputs, totalling 1,022 BTC, came from elsewhere and were non-pizza-tainted under our convention. All twenty inputs collapsed into a single 11,022 BTC output at address 1PrwYMffhu1XJyVXs6Ba67NidGZVjbGHCq. The fee was zero.
Within the same block, at the very next position in the block's ordered transaction list, the 11,022 BTC was spent again. This time split two ways, 5,500 BTC and 5,522 BTC, into new addresses. Under strict FIFO the first output absorbed the entire tainted prefix and received 5,500 BTC of pizza taint. The second output received the remaining 4,500 BTC of pizza taint plus 1,022 BTC of non-pizza-tainted change.
Seven minutes later the 5,500-BTC chain made one more hop into a 5,677-BTC UTXO. Six days later the 5,522-BTC chain split again into 3,500 BTC and 2,000 BTC UTXOs. At depth 5 the trace stops, by convention, on three frontier UTXOs. The tainted value at each, summed, is 4,500 BTC, 3,500 BTC, and 2,000 BTC. Total: 10,000.
Five events span 51 days — but three of them happen inside a single hour.
The first three transactions sit within 57 minutes of each other. The fourth lands 45 days later. The middle gap is the dormancy — the window where the 4,223 BTC P2PK output simply sat there, untouched.
Anchor
10,000 BTC sent from Hanyecz to jercos for two pizzas. The first widely-cited real-world Bitcoin purchase.
block 57,043- 10 min · Δ
First split
10,000 BTC → 5,777 + 4,223 BTC. The 4,223 goes to a P2PK output and won't move for 45 days.
block 57,044- 47 min · Δ
Linked hop
The 5,777 BTC moves on to
18ZChq…— a routine one-hop relay. Then nothing.block 57,053- Dormancy45 days, 8 hours
The 4,223 BTC P2PK output sits unspent. When it finally moves, it does so in the same transaction that pulls in the 5,777 BTC stream, the consolidation event.
Consolidation spend
Both descendant streams converge: 20 inputs → 1 consolidating tx → 2 outputs in the same block.
block 64,683- 6 days, 14 hours · Δ
Horizon split
Last recorded hop before the depth-5 stop. After this, the trail crosses our tracing horizon.
block 65,621
The 45-day gap is the part of this trace that the road-trip story has to fit around. Either Sturdivant sold the coins gradually after waiting six weeks, or the wallet was held by someone else for those six weeks before consolidating, or the legend is partly true and partly retconned. The chain does not say which.
One historical anchor sits inside the 45-day window: Mt. Gox went live on 17 July 2010, ten days after the 7 July consolidation. It is worth flagging the coincidence, but it is only that — a coincidence on the calendar. The 250 BTC round-trip on Pizza Day itself can be described post hoc as wallet-test-like, but routine alternatives (wallet-software change handling, an unrelated counterparty interaction) are equally consistent, and the consolidation moved 11,022 BTC into a single output — around two hundred times Mt. Gox's contemporary daily volume, which would have been a remarkable "inventory" to place onto a brand-new sub-100-BTC/day exchange. The cleaner statement is that the consolidation took place before the first major exchange existed; what happened next is below the trace's resolution.
A name appears twice
The address 18ZChqRsb7eKgH8wLg9Pfkkezux34pf6eo is the depth-2 successor of the 5,777-BTC pizza half. The coins landed there at 19:13 on Pizza Day and stayed for 45 days. The same address is also a counterparty in three of the four lifetime transactions of the consolidation address 1PrwYMff…. Specifically:
- 2010-05-22 19:13, the consolidation address received 250 BTC from
18ZChq…. - 2010-05-22 19:28, fifteen minutes later, the consolidation address sent 250 BTC back to
18ZChq…. - 2010-07-07 02:56, the consolidation address received 11,022 BTC, partly from
18ZChq…(the 5,777 BTC pizza half) and partly from another address.
So on Pizza Day itself, the consolidation address ran a 250-BTC round-trip with 18ZChq…: money out, money back, fifteen minutes apart. The pattern is consistent with an address-pair verification — informally a "wallet-test" — performed in advance of the July consolidation. It is one of several behaviorally plausible readings; routine alternatives include a wallet-software change-handling artifact or an unrelated counterparty interaction. It is not identity proof, and I make no allegation that any party here acted improperly. Forty-five days later, the same 18ZChq… address, alongside one additional sender, fed the consolidation. The consolidation address has four lifetime transactions in total, all in May–July 2010, and a zero balance today — which is necessary, but nowhere near sufficient, to argue the coins were "cashed out"; dispersion across many addresses, re-spending, custody by third parties, and key loss are all consistent with the same observation.
I am not invoking external clustering heuristics here. This is all on-chain, in the open. The chain-only evidence is consistent with common or coordinated control of both addresses, walking through them in a pattern that looks like a wallet rather than an exchange. It does not prove that, and I will not claim it does. But it does pull the story away from "exchange ate the coins" and toward "the coins were walked through a small, repeated-interaction address set rather than disappearing immediately into a large, exchange-like cluster."
What is at the depth-5 horizon
The three depth-5 frontier UTXOs at 1KcAt5…, 12ofyF…, and 17G2pj… are the most-misframed claim in the genre. Articles that bother to look usually stop here and call them "still moving" or "still alive." Earlier drafts of this piece did the same.
Both framings are wrong. The trace stops at depth 5 because I told it to, not because the coins did anything notable at that depth. To know what happened next I had to ask separately, without recursing, what the next-hop spending status of each frontier UTXO was. The answer for all three: spent. The coins kept going past the horizon. There is no UTXO in the descendant graph that has been holding pizza taint at rest for nearly the sixteen years since.
What can be said honestly is more modest. At the budget chosen here, all 10,000 BTC of strict-FIFO pizza taint is accounted for at the horizon. None of it had been dormant for an extended period: none in still-unspent, none in cluster-absorbed, none in dust-pruned. The trace ends, and the coins kept moving past it.
| Frontier UTXO | Tainted BTC | Next-hop status | Why the trace stopped |
|---|---|---|---|
1KcAt5… (vout 1B7cet's spend) | 4,500 | spent (next hop) | depth-5 cutoff |
12ofyF… (vout 1NX8uq's spend) | 3,500 | spent (next hop) | depth-5 cutoff |
17G2pj… (vout 1NX8uq's spend) | 2,000 | spent (next hop) | depth-5 cutoff |
"Spent (next hop)" means the frontier UTXO was itself further spent in one subsequent transaction, which I checked manually one step past the horizon. I made no claim about what happens after that hop — depth-6 territory is outside this trace.
Convention sensitivity
I claimed up top that strict positional FIFO is one of three reasonable conventions. To make that claim defensible rather than rhetorical, I re-ran the trace under all three:
| Convention | Tainted BTC at horizon | Fee / residual BTC | Largest tainted branch |
|---|---|---|---|
| FIFO (strict positional) | 10,000.00 | 0 | 4,500 BTC at 1KcAt5… |
| Haircut (proportional) | 9,999.99999998 | 0.00000002 | 5,009.98 BTC at 1KcAt5… |
| Poison (maximalist) | 11,177.00 | 0 | 5,677 BTC at 1KcAt5… |
The 0.00000002 BTC in the haircut row is an integer-satoshi rounding residual, not a miner fee — the floor() in proportional attribution leaves two satoshis unassigned, which the algorithm parks in the fee bucket so the conservation check still closes. The poison row's "horizon" total of 11,177 exceeds the original 10,000 by design: poison inflates as un-tainted inputs join descendant transactions.
Three conventions, three different numbers, the same ten UTXOs visited. The topology survives because the 1 BTC dust threshold is below every per-output tainted amount under every convention; at a higher threshold, poison's inflation would push more outputs past the cutoff and the descendant graph would grow. All three conventions also agree that the depth-5 horizon contains no dormant UTXO. Where they disagree is the ~12% spread on "how much pizza-taint sits where" — exactly the kind of disagreement that a present-tense claim about "the pizza bitcoins" usually hides.
The 13 unspent deposits at jercos's address
The recipient address 17SkEw2md5avVNyYgj6RiXuQKNwkXaxFyQ has been funded fourteen times in its life. Once with 10,000 BTC, on Pizza Day. Thirteen times since then, with tiny amounts that have never moved.
Recipient address · 13 unspent post-2010 deposits
Address 17SkEw…axFyQ has been funded 14 times in total and spent exactly once: the famous 10,000 BTC. Six of the thirteen unspent deposits are 546 satoshis, the P2PKH dust limit.
| Date (UTC) | Value (sats) | Note |
|---|---|---|
| 2015-04-19 | 10,000 | first known post-2010 deposit |
| 2017-07-04 | 100,000 | |
| 2018-10-23 | 1,111 | |
| 2020-02-04 | 141,482 | |
| 2023-01-24 | 1,000 | |
| 2023-05-22 | 546 | May-22 anniversary · P2PKH dust limit |
| 2024-05-22 | 546 | May-22 anniversary · P2PKH dust limit |
| 2024-05-25 | 546 | P2PKH dust limit |
| 2024-05-25 | 546 | P2PKH dust limit |
| 2024-07-07 | 546 | P2PKH dust limit |
| 2024-10-07 | 1,010 | |
| 2024-12-13 | 546 | P2PKH dust limit |
| 2026-03-31 | 571 |
I will resist over-reading two data points. The 2023-05-22 and 2024-05-22 anniversary deposits at the dust limit are consistent with deliberate memorial sends: people choosing the smallest amount their wallet would accept and timing it to the anniversary. But n=2 is thin, and several of the other 546-sat deposits sit nowhere near May 22. What the data does support is that the recipient address has stopped being a recipient address in any practical sense. It accumulates dust, but nobody has spent from it since 2010.
Three small corrections
A 2021 academic chapter, Extracting Insights From Bitcoin Transactions (Moussa & Cuzzocrea), captions a figure as "131 input addresses participated in the pizza transaction." There were 131 inputs but one sending address. The 131 input UTXOs all came from 1XPTgDRhN…, which Hanyecz publicly self-attributed at the time.
Coverage that does describe the transaction tends to time-zone-shift the block timestamp. The block was mined at 18:16:31 UTC. May 22 is in Eastern Daylight Time (UTC−4), so the correct local time is 14:16 ET, not 1:16 PM as it appears in one frequently-cited CoinDesk piece. That would be EST (UTC−5), which Florida was not on in May. Minor.
The 0.99-BTC fee on the original transaction barely shows up in the coverage I surveyed. The closest acknowledgement I found was a side comment on a learnmeabitcoin explainer. In 2010 dollars it was sub-cent — large by usage norms, trivial by market value. Restated at May 2026 spot prices it is about $76k. The 2026 number is the one that gets quoted; both are accurate, and the 2010 one is the one the man actually paid.
What this case actually teaches
The interesting question turned out not to be where the pizza coins went. It was what happens when you take the casual phrase "those bitcoins" seriously and try to follow them on the chain.
| Layer | Example from this trace | Evidential strength |
|---|---|---|
| Chain fact | cca7507… spends 10,000 BTC into two new outputs | hard — verifiable on any block explorer |
| Tracing convention | strict FIFO assigns 5,500 BTC tainted to the first depth-4 output | methodological — depends on the convention chosen |
| Behavioral inference | 18ZChq… appearing across both flows is consistent with single-actor control | probabilistic — chain-only evidence, not identity proof |
| Narrative claim | jercos funded a road trip with the proceeds | unsupported by chain data; based on his 2016 interview at Bitcoin Who's Who |
Most of the genre lives in the bottom row and presents it with the top row's confidence. Naming the rungs is most of the work.
What happens is that within a few hops you are no longer following coins. You are following taint under your chosen convention. The descendant graph is real, but which fraction of which output you call "pizza-tainted" depends on a choice you made before you started. Strict positional FIFO gives one set of numbers. Poison taint would mark every output of every consuming transaction and give a maximalist answer. Haircut would dilute proportionally and lose positional information. None of those is wrong, and none of them is the chain "saying so" either.
This is not a defect of bitcoin. It is the fungibility property working as intended. But it does mean that when a journalist or analyst makes a present-tense claim about "the pizza bitcoins" sitting in some wallet, or being eaten by an exchange, or moving last week, that claim has a convention buried under it that nobody states. The honest version of any such claim names the convention and the horizon. Without those two pieces, it is a story, not a finding.
This trace says one thing about the actual coins. Under strict positional FIFO, the 1 BTC dust threshold, the depth-5 horizon, and a one-step frontier check, all 10,000 BTC of pizza taint at the horizon sat in three frontier UTXOs that were themselves further spent in the next transaction beyond the cutoff. Nothing in that frontier suggests a uniquely identifiable dormant Pizza-Day UTXO is still resting somewhere on chain. The trace does not, and cannot from a single-case chain-only analysis, characterise the full descendant population beyond the frontier — only the named convention's frontier behaviour. Through the depth-3 consolidation, the activity is consistent with common or coordinated control of the involved addresses. Beyond that horizon, the question stops being "which coins" and becomes "how diluted is each convention's taint pool." Under the three conventions tested here, the answer at depth 5 is: enough to discipline the question.
If you re-run this with a different convention and get a different answer, you have done it correctly. The repo, the methodology document, and the raw CSVs are linked at the top.
