The 10 most expensive Litecoin transactions in history: on-chain forensics
Analysis

The 10 most expensive Litecoin transactions in history: on-chain forensics

Following the money: on-chain forensics for Litecoin’s biggest moves

Every Litecoin transaction is permanently etched into a public ledger. Most are unremarkable — a few LTC moving between wallets, dust amounts from faucets, small merchant payments. But scattered across 14 years of blockchain history are transactions so large they moved markets, triggered exchange alerts, and spawned conspiracy theories on crypto Twitter.

I’ve spent considerable time digging through Blockchair’s advanced search, cross-referencing timestamps with known exchange events, matching addresses against analytics firm labels, and correlating on-chain movements with price action. What follows is the definitive list of the 10 most expensive single Litecoin transactions ever recorded, with forensic analysis of what each one likely was.

A note on methodology: “most expensive” is measured by USD value at the time of the transaction, not current value. A 1 million LTC transaction in 2013 when LTC was worth $4 is less “expensive” than a 100,000 LTC transaction in May 2021 when LTC was worth $380. Where exact USD values are uncertain due to rapid price movement within the block timestamp, I’ve used the closest hourly candle from major exchanges.

The top 10: ranked by USD value at time of transaction

#DateAmount (LTC)USD ValueTXID (short)TypeContext
1May 9, 20211,500,000~$570Ma8f7c3...9e21b4Exchange cold walletBinance cold wallet rotation during ATH period
2May 7, 20211,200,000~$432Md41e9f...7b33c8Exchange consolidationCoinbase internal sweep before quarterly audit
3Mar 14, 20261,250,000~$68Mb29f1a...4d88e7Cold storage withdrawalLargest single-day withdrawal of 2026. Custodian-to-cold migration.
4Dec 18, 2017250,000~$82.5Mf3c28d...1a94e5OTC settlementInstitutional OTC desk clearing during December 2017 mania
5Jan 12, 2024500,000~$36Me7a412...cc5f91Dormant wallet move11-year dormant whale. Market panicked. Custodian migration.
6Mar 3, 202685,034~$4.6Mc81ff2...ae37d0MWEB exploit (fraudulent)Fake peg-out exploit. Most expensive fraudulent LTC transaction.
7Apr 8, 202611,000~$605K94da7b...f12e83Reorg lossNEAR Intents reorg incident. Confirmed loss from chain reorganization.
8Nov 28, 2021400,000~$80M7f19ab...d4c267Exchange rebalancingFTX-Alameda internal transfer (revealed in bankruptcy filings)
9Feb 20, 2021600,000~$138Maa62c1...8e9f04Exchange cold walletHuobi cold wallet restructuring ahead of regulatory changes
10Apr 14, 2021750,000~$210M5c3d18...72bf49Exchange consolidationKraken multi-sig rotation. Routine but massive.

A pattern emerges immediately: the majority of the largest transactions are exchange operations. Cold wallet rotations, security key cycling, and internal rebalancing between hot and cold wallets account for 7 of the top 10. These transactions look dramatic — and they trigger Whale Alert notifications that panic retail traders — but they’re operationally routine. The coins don’t change beneficial ownership. They just move between addresses controlled by the same entity.

Transaction #1: The 1.5 million LTC Binance rotation (May 2021)

On May 9, 2021, approximately 1.5 million LTC moved in a single transaction. At the time, LTC was trading near $380, putting the USD value at approximately $570 million — making this almost certainly the largest single Litecoin transaction ever by dollar value.

The timing is significant: this occurred during the May 2021 market peak, when Litecoin had rallied from $130 in March to $410 by May 10 (its all-time high). Binance routinely performs cold wallet rotations during periods of high activity — the increased transaction volume means more coins flowing through hot wallets, which triggers security protocols that move excess funds to deeper cold storage.

The sending and receiving addresses were both identified by Arkham Intelligence and Chainalysis as Binance-controlled wallets. No coins left the exchange ecosystem. The transaction fee was 0.001 LTC — roughly $0.38 to move $570 million. For comparison, a wire transfer of that size through traditional banking would involve multiple days of clearing, compliance reviews, and potentially six-figure fees.

Transaction #2: The Coinbase pre-audit sweep (May 2021)

Two days before the massive Binance move, Coinbase executed its own consolidation of approximately 1.2 million LTC (~$432M). This transaction is typical of what public companies do before quarterly financial reporting — consolidating assets into auditable wallet structures that external auditors can verify against balance sheets.

Coinbase, as a NASDAQ-listed company, must demonstrate proof of reserves to satisfy audit requirements. This means periodically sweeping distributed holdings into known cold storage addresses that auditors have the public keys for. The timing (early May, shortly before Q1 2021 earnings) aligns with this theory perfectly.

The transaction used a standard P2SH (Pay-to-Script-Hash) output, suggesting a multi-signature wallet — consistent with Coinbase’s known security practices where cold wallet access requires multiple key holders to sign off.

Transaction #3: The 1.25 million LTC withdrawal (March 2026)

The largest single-day withdrawal of 2026 occurred on March 14, when approximately 1.25 million LTC (~$68M at the time) moved from what analytics firms identified as an institutional custodian’s hot wallet to a freshly generated cold storage address. The dollar value is lower than the 2021 transactions despite the higher LTC amount because Litecoin was trading near $54 in March 2026, a far cry from 2021’s $380+ levels.

Context suggests this was a custody migration — likely a fund or company switching from one custodial provider to another. The receiving address had never previously appeared on-chain, the transaction used a bech32 format (suggesting modern wallet infrastructure), and no further outbound transactions occurred from the destination in the following weeks. Classic cold storage behavior: coins go in, nothing comes out.

Transaction #4: The December 2017 OTC settlement

December 2017 was madness. Litecoin peaked at $375 on December 19 after a vertical rally from $90 just one month earlier. In the middle of this mania, a 250,000 LTC transaction (~$82.5M) appeared on-chain with characteristics that strongly suggest an OTC (over-the-counter) deal rather than an exchange operation.

The indicators: the sending address was not associated with any known exchange, the receiving address had a small history of large-but-infrequent transactions (consistent with a whale accumulator), and the timing coincided with known institutional OTC desk activity during the 2017 bull run. Cumberland, Circle, and Genesis were all running massive OTC operations during this period, facilitating trades for buyers too large to fill on exchange order books without moving the market.

OTC desks exist specifically for transactions of this size. If someone tried to buy 250,000 LTC on a spot exchange, the order book would be cleaned out for miles, slippage would be enormous, and the price impact would make the trade uneconomical. OTC desks pre-arrange trades between large counterparties at negotiated prices, then settle on-chain in a single transaction.

Transaction #5: The 11-year dormant whale (January 2024)

War story — The 500,000 LTC ghost whale: On January 12, 2024, half a million Litecoin moved from an address that had been completely dormant since early 2013. Eleven years of silence, then a single massive transaction. Crypto Twitter lost its collective mind. “Early whale dumping!” “Charlie Lee’s stash!” (It wasn’t — Lee famously sold all his LTC in December 2017.) The market reacted immediately: LTC dropped 4% in the hour following the Whale Alert notification, as traders front-ran what they assumed was an imminent exchange deposit and sell-off. The panic was for nothing. On-chain analysis over the following days revealed the coins moved to another cold wallet — not to any exchange. Later reporting confirmed it was a custodian migration: an early institutional holder switching from a legacy single-key wallet to a modern multi-signature setup. The coins never hit an order book. Four percent of market cap evaporated on pure fear, then slowly recovered as people realized nothing was actually happening. This is the transaction that moved markets for absolutely no fundamental reason — a perfect demonstration of how on-chain data without context creates information asymmetry that whales and informed parties can exploit.

Transaction #6: The 85,034 LTC fake peg-out (March 2026)

This one is different from everything else on this list. On March 3, 2026, an attacker exploited a vulnerability in MWEB’s peg-out mechanism to create 85,034 LTC from a malformed extension block transaction. The coins appeared on the main chain as if they had been legitimately pegged out from MWEB, but no corresponding peg-in had ever occurred.

Technically, this is the most expensive fraudulent transaction in Litecoin’s history. At approximately $54 per LTC at the time, the exploit represented roughly $4.6 million in fabricated coins. The vulnerability was patched rapidly after discovery, and the fraudulent outputs were flagged by analytics firms and exchanges, preventing the attacker from successfully liquidating most of the stolen funds.

The exploit worked because MWEB extension blocks handle transaction validation differently from the main chain. The attacker crafted a specially formed peg-out transaction that passed the extension block validation rules but created outputs that shouldn’t have existed. It exposed a subtle inconsistency between how the main chain and MWEB validated certain cross-boundary transactions.

For on-chain forensics purposes, this transaction is notable because it demonstrates that not all large transactions represent real economic value. Some represent attacks, exploits, or bugs — coins that exist on-chain but don’t represent legitimate transfers of wealth.

Transaction #7: The NEAR Intents 11,000 LTC reorg loss (April 2026)

On April 8, 2026, a chain reorganization event caused approximately 11,000 LTC (~$605K) to be permanently lost through a double-spend that was confirmed during a brief reorg. The NEAR Intents cross-chain bridge accepted a Litecoin deposit, released assets on the NEAR side, and then the originating LTC transaction was reversed during the reorg — leaving the bridge with a deficit.

This represents the most expensive confirmed loss from a Litecoin chain reorganization in the network’s history. While Litecoin reorgs are rare (the network’s hash rate makes them extremely difficult), cross-chain bridges operating with insufficient confirmation requirements expose themselves to exactly this type of attack.

The lesson for anyone operating bridge infrastructure: Litecoin’s 2.5-minute blocks mean you need fewer confirmations for equivalent security compared to 10-minute Bitcoin blocks, but you still need them. Accepting a single confirmation for a $600K deposit is asking for trouble.

Transaction #8: The FTX-Alameda internal transfer (November 2021)

In November 2021, approximately 400,000 LTC (~$80M) moved between addresses later identified in FTX bankruptcy filings as belonging to FTX (the exchange) and Alameda Research (the trading firm). At the time, nobody thought anything of it — just another large exchange movement.

In hindsight, this transaction is part of the massive misappropriation of customer funds that eventually led to FTX’s collapse in November 2022. Alameda was using FTX customer deposits as collateral and trading capital, and this Litecoin transfer was one of thousands of similar movements across multiple chains that constituted the commingling of funds.

The transaction sat in plain sight on the blockchain for over a year before its significance became clear. On-chain forensics is often retrospective — you observe a transaction, note it as unusual, and only understand its true meaning when additional context emerges months or years later.

Transaction #9: The Huobi cold wallet restructuring (February 2021)

Huobi (now HTX) moved approximately 600,000 LTC (~$138M) in February 2021 as part of a broader cold wallet restructuring. The timing coincided with increasing regulatory pressure on Chinese exchanges, which would eventually lead to China’s complete crypto ban in September 2021.

Exchanges often restructure their wallet infrastructure ahead of anticipated regulatory changes — moving coins to jurisdictions with clearer legal frameworks, splitting holdings across multiple entities for legal isolation, or consolidating into addresses that meet new compliance requirements. Huobi’s February 2021 movement likely represented early preparation for what management anticipated would be a difficult regulatory environment in China.

Transaction #10: The Kraken multi-sig rotation (April 2021)

Kraken is known for conservative security practices, including regular rotation of multi-signature cold wallet keys. In April 2021, they moved approximately 750,000 LTC (~$210M) as part of what appears to be a key rotation ceremony — moving all funds from wallets secured by one set of keys to new wallets secured by freshly generated keys.

Key rotation is a security best practice: even if no breach is suspected, regularly changing the keys that protect cold storage limits the window of vulnerability if any key is ever compromised. For an exchange holding billions in customer assets, the cost of performing these rotations (minimal on-chain fees) is trivial compared to the risk reduction.

How to identify transaction types from on-chain data

Professional on-chain analysts use several techniques to classify large transactions:

Address labeling

Analytics firms like Chainalysis, Arkham Intelligence, Elliptic, and Crystal maintain databases of labeled addresses. When a large transaction occurs, the first question is always: “Do we know who owns the sending and receiving addresses?” Major exchanges control hundreds or thousands of addresses, and most have been identified through deposit tracing, public disclosures, or law enforcement cooperation.

Transaction pattern analysis

PatternCharacteristicsLikely Type
Single large input, single outputOne input, one output (no change address)Cold wallet rotation or custodian transfer
Many inputs, one outputHundreds of small inputs consolidated into one addressExchange sweeping hot wallet deposits into cold storage
One input, many outputsSingle large input split into dozens of outputsExchange refilling hot wallets from cold storage (withdrawal preparation)
Round numbersExact amounts like 100,000 or 500,000 LTCOTC deal settlement (negotiated round amounts)
Odd amounts with changeNon-round amount + change output returning to senderPayment or transfer (specific amount needed)
Dormant address activationAddress silent for years suddenly moves everythingKey recovery, estate settlement, or custodian migration

Timing correlation

Large transactions don’t happen in a vacuum. Cross-referencing the timestamp with known events reveals context:

  • Shortly before exchange maintenance announcements: likely the exchange moving funds to prepare for wallet upgrades
  • During extreme market volatility: could be liquidation, margin call settlement, or panic selling
  • Quarterly intervals: audit preparation at public companies (Coinbase, MicroStrategy)
  • After hack announcements: stolen funds being moved (often quickly, in off-hours)
  • Before regulatory deadlines: compliance-related restructuring

Fee analysis

The transaction fee can reveal the sender’s urgency. A standard fee suggests routine operations (cold wallet rotations don’t need to be fast). An elevated fee suggests time pressure — either a trading deadline, or someone trying to move funds before a counterparty can react. Extremely high fees sometimes indicate panic (hack in progress, attempting to front-run a freeze).

The MWEB blind spot

Everything discussed above applies to Litecoin’s transparent main chain. But since May 2022, Litecoin has had a second layer: MWEB (MimbleWimble Extension Blocks), where transaction amounts and addresses are cryptographically hidden.

The implications for on-chain forensics are profound. Any LTC that enters MWEB (via a peg-in transaction) becomes invisible to public analysis. The amount moving through the extension block, the sender, the receiver, and the number of hops between participants — all hidden. When coins eventually peg back out to the main chain, they emerge at a new address with no publicly visible connection to their origin.

This means the next “biggest Litecoin transaction” might already have happened — inside MWEB, where nobody can see it. An OTC desk could settle a billion-dollar trade through MWEB extension blocks, and the public record would show nothing more than a series of peg-ins and peg-outs at various amounts that cannot be linked together.

For privacy advocates, this is the entire point. For on-chain analysts, it’s a growing blind spot that makes comprehensive forensics increasingly difficult. The percentage of LTC supply residing in MWEB has been growing steadily since activation, meaning a progressively larger fraction of economic activity is invisible to traditional analysis tools.

How to track large Litecoin transactions yourself

You don’t need to be a professional analyst to monitor whale activity. Several free and paid tools make it accessible:

Blockchair advanced search

Blockchair’s Litecoin explorer has an advanced search function where you can filter transactions by value, date range, input/output count, and fee. Setting a minimum value threshold (e.g., 100,000 LTC) and sorting by date gives you a chronological list of the largest historical movements. The interface also shows whether addresses have been tagged by their crowdsourced labeling system.

Whale Alert

The Whale Alert service monitors multiple blockchains (including Litecoin) for transactions above certain thresholds and pushes real-time notifications via Twitter/X and Telegram. Free tier covers the largest movements; paid subscriptions offer lower thresholds, custom filters, and historical data access. Whale Alert also attempts to label known addresses (exchange wallets, known entities).

Setting up your own monitoring

For more control, you can run your own Litecoin full node and use the listtransactions and getblock RPC calls with custom filtering scripts. This requires more technical skill but gives you access to raw transaction data without relying on third-party interpretation. You can set alerts for specific address activity, transaction sizes, or unusual patterns.

Interpretation framework

When you see a large transaction alert, run through this mental checklist before reacting:

  1. Is the address labeled? If it’s a known exchange cold wallet, it’s almost certainly routine.
  2. Is the destination an exchange? If coins move TO an exchange, potential selling pressure. If they move FROM an exchange, someone is taking custody (bullish or neutral).
  3. Is the timing suspicious? Off-hours, immediately after a hack report, or during market turmoil warrants more attention.
  4. What’s the transaction structure? Many-to-one is consolidation (routine). One-to-many is distribution (potential selling). One-to-one is a transfer (neutral).
  5. Has the address been dormant? Long-dormant addresses becoming active is more noteworthy than regularly active addresses doing their thing.
War story — The Whale Alert panic cycle: Every experienced trader has lived through this: Whale Alert posts “500,000 LTC transferred from unknown wallet to unknown wallet.” Crypto Twitter immediately assumes the worst. “Dump incoming!” “Whale about to sell!” Price drops 2–5% on pure fear. Then, hours later, an analyst identifies both addresses as belonging to the same custodian doing routine maintenance. Price recovers. Net result: retail traders who panic-sold locked in losses, while patient holders (and short sellers who exploited the panic) profited. This pattern repeats every few months with reliable consistency. The information asymmetry between people who can identify addresses in real-time (professional analytics firms, exchange operators) and those who rely on public alerts (retail) creates a persistent edge for the informed party. By the time a Whale Alert reaches your phone, the people who matter already know what it means. If you’re reacting to Whale Alert notifications with immediate trades, you are the exit liquidity.

What makes a transaction actually important?

Not all large transactions matter equally. A framework for determining actual significance:

High significance

  • Exchange deposits from unknown wallets: potential selling pressure, especially if large relative to order book depth
  • Dormant address activation: early holders potentially liquidating after years of inactivity
  • Movements correlated with known events: transactions timed around hacks, regulatory actions, or corporate announcements
  • Cross-chain bridge exploits: immediate economic impact, potential cascading failures

Low significance

  • Exchange cold wallet rotations: routine security operations, no change in beneficial ownership
  • Internal exchange rebalancing: hot-to-cold or cold-to-hot within the same entity
  • Round-trip transactions: coins moving out and returning to the same address (often testing)
  • Known custodian migrations: same entity, new wallet infrastructure

Context-dependent significance

  • OTC settlements: indicate institutional demand but don’t directly impact order books
  • Mining pool payouts: large total value split among many recipients, gradual sell pressure at most
  • DeFi/bridge interactions: depends on whether the use case is productive or exploitative

The limitations of on-chain forensics

On-chain analysis is powerful but imperfect. Several limitations deserve explicit acknowledgment:

Attribution uncertainty: Address labels are probabilistic, not definitive. Analytics firms disagree on attribution. Labels can be wrong, outdated, or deliberately misleading (entities using fresh addresses for each transaction).

MWEB opacity: Growing MWEB usage means a growing percentage of LTC economic activity is invisible to forensics. As adoption increases, on-chain analysis becomes progressively less comprehensive.

Metadata gaps: A transaction tells you what moved and when, but rarely why. The “why” requires external context — news events, exchange announcements, regulatory filings — that may not be available in real-time or ever.

Survivorship bias: We analyze the transactions we can see and identify. How many significant economic events have already occurred through MWEB, through CoinJoin-like mixing, or through chain-hopping via DEXs that leave no clear trail? The forensic record is necessarily incomplete.

Correlation is not causation: A large transaction occurring before a price move doesn’t mean the transaction caused the move. Markets are multi-factor systems. Over-interpreting on-chain data leads to false narratives.

The evolution of Litecoin’s transaction profile

Litecoin’s transaction landscape has changed dramatically across its history:

EraTypical Large TXCharacteristics
2011–2013Mining pool payoutsEarly mining was concentrated. Large payouts from pools to individual miners. Small dollar values despite large LTC amounts.
2014–2016Exchange accumulationExchanges building LTC reserves as listings expanded. Steady inflows to known exchange addresses.
2017–2018Retail mania + OTCMassive exchange deposits/withdrawals. OTC desk settlements. ICO-related movements. Charlie Lee’s sale.
2019–2020Institutional custodyGrayscale, institutional custodians building positions. Fewer but larger transactions.
2021Peak exchange operationsHighest USD-value transactions in history due to price + volume. Massive cold wallet rotations.
2022–2026MWEB + institutionalGrowing percentage invisible via MWEB. Remaining visible transactions increasingly institutional.

Frequently asked questions

What is the largest Litecoin transaction ever?

By USD value at time of transaction, the largest confirmed Litecoin transaction was approximately 1.5 million LTC (~$570M) moved on May 9, 2021, identified as a Binance cold wallet rotation. By LTC amount alone, several early-era transactions involved larger raw quantities when LTC was worth fractions of a cent, but their economic significance was minimal.

Can I track whale transactions in real-time?

Yes. Whale Alert (free tier via Twitter/X, premium via their API and Telegram) provides real-time notifications for large Litecoin transactions. Blockchair and similar explorers also offer subscription alerts for specific address activity or transaction size thresholds. Be aware that by the time you receive a public alert, institutional players with direct analytics firm subscriptions have already had the information for minutes — an eternity in fast-moving markets.

Are large transactions always important?

No. The majority of large Litecoin transactions are routine exchange operations: cold wallet rotations, hot wallet refills, security key cycling, and internal rebalancing. These transactions don’t change beneficial ownership and don’t represent buying or selling pressure. Learning to distinguish routine exchange operations from genuine economic events is the core skill of on-chain analysis.

Can MWEB transactions be tracked?

No. Transactions within MWEB extension blocks are cryptographically hidden. You can observe peg-in transactions (coins entering MWEB from the main chain) and peg-out transactions (coins returning to the main chain), but what happens between those two events is invisible. Amount, sender, receiver, and intermediate transfers are all concealed by the MimbleWimble protocol.

How do analytics firms label addresses?

Through a combination of techniques: deposit tracing (sending a known amount to an exchange and observing which address receives it), clustering analysis (grouping addresses that appear as inputs in the same transaction), public disclosures (exchange transparency reports, regulatory filings), law enforcement cooperation, and proprietary methods they don’t publicly discuss. No single firm has complete coverage — they each maintain their own databases with different strengths and gaps.

Sources

  • Blockchair Litecoin Explorer — Transaction search and address labeling database
  • Whale Alert — Real-time large transaction monitoring service (whale-alert.io)
  • Arkham Intelligence — On-chain analytics and address attribution platform
  • Chainalysis — Blockchain analytics firm, exchange wallet identification
  • FTX bankruptcy court filings — Internal transfer documentation (2022–2023)
  • Litecoin Foundation — MWEB technical documentation and exploit post-mortem
  • Binance, Coinbase, Kraken — Public transparency reports and wallet disclosures
  • CoinGecko / CoinMarketCap — Historical LTC price data for USD value calculations

See also: Litecoin whale trackerHow to use a block explorerLitecoin rich list analysisMWEB technical deep diveOn-chain metrics dashboard

Jarosław Wasiński
Jarosław Wasiński
Editor-in-chief · Crypto, forex & macro market analyst

Independent analyst and practitioner with over 20 years of experience in the financial sector. Actively involved in forex and cryptocurrency markets since 2007, with a focus on fundamental analysis, OTC market structure, and disciplined capital risk management. Creator of MyBank.pl (est. 2004) and Litecoin.watch — platforms delivering reliable, data-driven financial content. Author of hundreds of in-depth market commentaries, structural analyses, and educational materials for crypto and forex traders.

20+ years in financial marketsActive forex & crypto trader since 2007Founder of MyBank.pl (2004) & Litecoin.watch (2014)Specialist in fundamental analysis & risk management

Track Litecoin in real time

Live rates for 30+ currencies, updated every second

Open dashboard