We have been building a daily series for ICP burned to cycles. The public API serves a cumulative figure, so a daily number takes a diff, and nobody publishes the result. Here are the last nine days, in ICP:
30 Jul 1,659
31 Jul 4,338
01 Aug 215
02 Aug 137
03 Aug 476
04 Aug 2,252
05 Aug 385
06 Aug 4,375
07 Aug 4,187
A factor of 32 between the quietest day and the busiest. What interested us was not the spread but what sits underneath it, so we pulled the individual burn transactions for five of those days and aggregated them by sending address.
02 Aug, the quietest day: 137 ICP across 46 addresses. Real dispersion, nothing above about 7%.
31 Jul: 4,338 ICP across 43 addresses. One burned 3,800, 87.6% of the day.
04 Aug: 2,252 ICP across 44 addresses. One burned 2,025, 89.9%.
06 Aug: 4,375 ICP across 37 addresses. Top one 50.9%, second 41.6%.
07 Aug: 4,187 ICP across 31 addresses. One burned 3,750, 89.6%.
On the four busy days the five largest addresses account for 94% to 97% of the total. On the quiet day, about a third.
Three addresses carry almost all of it, and none of them is a wallet.
Every transfer into them carries a memo, and the memos decode. 1347768404 is 0x50555054, which is the ASCII string TPUP read little-endian. 1095062083 is CREA. 1414416717 is MINT. These are the command memos the Cycles Minting Canister requires: top up a canister, create one, mint cycles. The addresses are the accounts those commands are paid into. They identify an operation, not an operator.
The 2021 records settle it. On 22 September 2021 the largest of the three received seven transfers of about 0.0611 ICP. Each time it burned 0.0002 and returned the remainder to the sender five seconds later. An address that refunds the unspent portion of what it receives is not somebody’s wallet. Those seven refunds are also the only transfers out it has ever made; the other two have none at all.
So the question is never who owns the burning address. It is who funds it.
The cadence is the part worth sitting with. From 2 May 2025 to 16 January 2026 the largest account burned 4,107.55 ICP ten times, the first nine at thirty day intervals. The figure moved twice across that run, once by 0.0001 ICP and once by five hundred-millionths, and otherwise held. The burn time drifted forward six to seven minutes every month, from 08:07 in June to 08:49 in December. People do not drift at a constant rate. That is a scheduler.
Then it stopped, and in July it came back weekly and in round numbers: 4,500 on the 15th, 3,625 on the 24th, 3,800 on the 31st, 3,750 on 7 August. Each large transfer preceded by a small test transfer of 1 or 25 ICP, minutes or hours beforehand. That is somebody at a keyboard.
The reason for the change is on the ledger. On 10 June 2026 the funding address received a single transfer of 17,721.31 ICP from 62dd39780d34f2dc21eb680f99962659a6a0c2ccd9c68ec365962ae0eaf293f0, and every burn since has been paid out of it. The cadence did not accelerate because consumption grew. It changed because the money arrived in a lump and is being spent down. Before that, in late April 2025, the same funding address was opened and filled with 41,149 ICP inside a single day, 37,185 of it withdrawn directly from Binance.
We have not identified who controls the sending address and we are claiming nothing about it beyond this one transfer. It is a large address with a broad payment history, and it is a separate case we are still working on.
The second account is where six canisters were created and are now being funded: six CREA memos, thirty three MINT. The third has received exactly 50.00000000 ICP, one thousand two hundred and thirty times since March 2023, every one carrying TPUP, and burned all of it. 61,500 ICP, more than the whole network burns in most months. Its funder is not one party either: it collects from 37 different payers, the largest of which is the OpenChat SNS treasury at 21,100 ICP. Thirty five of the others sent once and never returned. It is a shared payment path, and paying for canisters through one is entirely ordinary. The service currently holds 5,955 ICP and spends about 290 a day, so its runway is visible on the ledger: roughly three weeks at the present rate.
Which points at something worth saying plainly. The gap between a quiet day and a busy one on this network is not a wave of activity. It is two or three infrastructure budgets clearing. And the busier the day, the fewer addresses are involved, which is the opposite of what you would expect from broadening usage.
None of this is misconduct, and none of it is hidden. Buying cycles at scale is exactly what the network is for, and something running a thirty day scheduler is running real infrastructure. We do not know who is behind any of it. The ledger records what an address did, not who owns it, and we are not going to guess.
One thing we noticed while scanning. Almost every address in this chain has been sprayed by address-poisoning mimics of the addresses it transacts with, four to five leading characters and three to five trailing characters matched, dust amounts, nothing else. On one conduit we could time it: eighteen transfers arrived from an exchange over seven months, and a mimic of that exchange dusted the receiver six or seven seconds after each one, eighteen times out of eighteen. The most active of the three burn accounts, the one with 2,460 transactions, has never been touched, while the payment service that funds it carries thirty one mimic families. The campaign follows the humans who copy addresses, not the money. If you operate a wallet like this, do not copy an address out of a transaction list.
On method. The daily figures are day over day diffs of the ledger burn series. Two were checked against the transaction record by summing every individual burn: 02 Aug came to 136.5777 ICP against a series value of 136.58, and 06 Aug to 4,375.4355 against 4,375.44. Concentration figures are aggregations of the same transaction lists by sender. The memos, the refunds, the cadence and the funding chain come from complete transaction exports of all three burn accounts and of the shared payment service, and from full-history scans of the remaining funding addresses.
Two things we will not claim. The verified window is nine days, which is short. And the historical series contains a value we cannot reconcile: on 29 August 2025 it jumps by 89,469 ICP, while the 252 burn transactions recorded that day sum to a few hundred. We do not know why, and we would rather say so than quietly draw the chart.
Addresses and the full per-day breakdown are at app.icpulse.io/cases#most-icp-burned-to-cycles-on-a-busy-day-comes-from-one-standing-order for anyone who wants to check the arithmetic.