HOME/OPS LOG/sweeping native bitcoin: taproot psbt, runes, and ordinals routing without mempool frontrunning
BACK TO ALL LOGSGET ACCESS / DEPLOY
BitcoinTaprootRunesPSBT

sweeping native bitcoin: taproot psbt, runes, and ordinals routing without mempool frontrunning

r1ot dev
Mar 02, 20267 min read

99% of web3 drainer software on telegram only works on EVM chains. the developers learned how to write a basic ERC-20 approval call in Solidity and stopped there. when a whale connects a bitcoin wallet holding 1.4 BTC and rare ordinals worth $80,000, their script either crashes or ignores the balance completely.

bitcoin doesn't have an account model. it uses UTXOs (Unspent Transaction Outputs). you can't just call transferFrom() on a bitcoin address. you have to construct a valid cryptographic transaction, select the correct input UTXOs, calculate sats/vB gas fees, sign with Schnorr signatures (Taproot) or ECDSA (SegWit), and broadcast directly to mining nodes.

we spent 3 months engineering our native Bitcoin module to solve this exact problem. here is how it works under the hood.

taproot & schnorr signatures (bip-341 / bip-342)

modern bitcoin wallets (unisat, xverse, leather, magic eden) prioritize taproot addresses (bc1p...).

with taproot, all spend conditions look identical to a standard single-key spend on-chain. this gives us massive advantages:

  1. smaller transaction size: schnorr key aggregation compresses complex multi-sig or batch spending conditions into a standard 64-byte signature. smaller size means lower miner fee and faster block confirmation.
  2. privacy against block explorers: on-chain surveillance engines like mempool.space cannot distinguish between a standard peer-to-peer transfer and a batch asset liquidation.

psbt (partially signed bitcoin transactions)

to sweep ordinals, runes, and native satoshis in a single victim interaction, we utilize PSBT (BIP-174).

when the victim clicks "verify allocation" on a lander clone from our template gallery:

  1. utxo inventory index: our backend queries mempool indexers in 20ms, enumerating every UTXO in the target wallet. we catalog native bitcoin outputs, ordinal inscriptions (sat numbers), and Runes edicts.
  2. atomic psbt construction: we construct a single PSBT containing all valuable UTXO inputs and route the outputs directly to your cold storage address.
  3. single sign prompt: the victim sees a routine "sign PSBT" prompt in UniSat or Xverse that looks like an inscription bid or marketplace handshake.
  4. direct miner push: we bypass public mempool nodes and push the finalized transaction directly to private mining pools (mara pool, f2pool) to prevent frontrunning.

runes & ordinals zero-dust protection

inscriptions and Runes live on specific satoshis ("cardinal" and "ordinal" satoshis). if an amateur script attempts to sweep bitcoin without parsing satoshi ranges, it will spend the ordinal satoshi as miner fee, effectively destroying the inscription.

r1ot's engine features an intelligent sat-preservation router:

  • native BTC is consolidated into a liquid high-priority output.
  • high-value ordinals and Runes are isolated onto precise 546-sat dust outputs and routed to cold storage without fee burn.

own the multi-chain infrastructure

don't leave six-figure bitcoin bags on the table just because your current script only speaks EVM. r1ot provides unified routing across EVM, Solana, Bitcoin, and TRON under one single self-hosted roof.

stop paying 20% dev taxes to middleman teams. read our dev-to-dev teardowns or check out our apex source license to take 100% of your earnings.

RELATED TECHNICAL TEARDOWNS

VIEW ALL LOGS →
EVMOpSec

why your standard approve calls are getting flagged in 2026 (and how permit2 fixes it)

blockaid and blowfish are nuking every public drainer on telegram. if you're still prompting standard approve() calls, you're just donating ad traffic. here is how we use off-chain permit2 signatures to keep printing with zero red screens.

6 min readREAD →
SolanaSPL-2022

surgical solana: using versioned transactions to bypass phantom simulations

solana is fast money until phantom slaps a massive red warning on your lander and conversion drops to zero. here's how versioned transactions (v0) and address lookup tables let us sweep entire portfolios in 400ms.

7 min readREAD →
OpSecMonero

operational survival: hardened infrastructure and xmr-based isolation

you can have the cleanest bypasses in web3, but if you're logging into your panel from your home ip, you're just building a case file for feds. here is the real opsec protocol.

6 min readREAD →

quit being a tenant.
keep 100% of your hits.

stop paying a 20% cut to anonymous teams on telegram. the r1ot engine gives you total operational independence. own the code. own the bag.

own the code →launch app