XBT forked to fight spam. It's still 40% junk, and stock Knots lets most of it through
XBT split from bitcoin over spam. A new tracker, cesspool.lol, tests every transaction since the fork and says the job isn't done: 39.6% of block space in the last 24 hours went to data, not payments. Most of it is the kind stock Knots still lets through.
The numbers
| Oct 26 | |
|---|---|
| Spam share of block space, last 24h | 39.6% |
| Spam transactions mined, last 24h | 1,107 |
| Fees paid to carry it, last 24h | 0.0827 XBT |
| Clean blocks, last 24h | 51 of 169 (41 with no data at all) |
| Spam payload since the fork | 451 MB in 133,079 transactions |
| Share a Plumb node refuses | 96.4% |
| Share stock Knots refuses | 8.0% |
The daily number swings. The same page showed 60.8% on Oct 25. The site labels fees as BTC; it's measuring the XBT chain.
What the tracker is
cesspool.lol is built by Jason Sopko (GitHub: jasonsopko), who also maintains Plumb and is one of the reviewers who approved the 180-day coinbase lock (#468). Its source is public. It doesn't write its own spam rules. It runs Plumb's actual policy code on every transaction, so in its words, "this page and a Plumb node cannot disagree about a transaction."
- "Sewage" is any transaction a Plumb node refuses because it carries data.
- Blocks are graded Pristine, Tainted (under 1% of weight), Foul (1% to 10%) or Raw (over 10%).
- It never shows what the spam contains, only its type, size and where it sits.
- Pools are named from coinbase tags and payout addresses. Blocks from home miners using DATUM are listed separately.
What Plumb is
Plumb is Bitcoin Knots with every reviewed spam filter switched on: "Policy only, same consensus." It's a drop-in swap, using the same config file and data directory. On top of what Knots already refuses (inscriptions, runestones, Counterparty, bare multisig), it adds:
| Filter | What it counts as data | From |
|---|---|---|
-rejectfakemultisig | Multisig keys no signature proves, beyond 10 per script | Knots #422 |
-rejectfakeoutputs | Outputs whose key or hash is really data | Knots #389 |
-rejectdeadbranches | Data hidden in a script branch that can never run | Knots #400 |
-rejectbareenvelopes | Pushes that are simply dropped | Knots #319 |
-rejecttokenmessages | JSON token and Omni messages in OP_RETURN | Plumb |
Plumb also cuts the OP_RETURN allowance from 83 bytes to 42. One caveat from the release page: the Linux binaries are "one person's builds on one machine, not reproducible builds."
Why stock Knots misses most of it
Spammers on XBT have moved to shapes Knots' defaults don't count as data, mostly fake multisig: 1-of-N scripts where the "keys" are really stored bytes. The filters that catch them exist as Knots PRs, but none are on by default in a Knots release yet.
chrisguida's #481 goes further. Instead of one rule per trick, it would relay only known input script shapes and count every unproven field as data. In his words, each new spam shape "would need its own rule" otherwise. It's open and still in review.
Who's mining it
The tracker's seven-day Hall of Shame: DATUM miners via B2Pool (71.2% of their block space went to spam), Legata (69.6%) and Rabid (64.0%). Remember that a node's mempool policy only controls what it relays. Miners decide what goes in blocks, and spam that reaches a miner directly skips relay filters entirely.
Our take
The fork changed who mines XBT. It didn't change what gets mined. Filters are policy, and policy is a choice every node runner makes. If you want spam out of your mempool, Plumb is the strictest option available today. If you'd rather wait for Knots, watch #422 and #481. Either way, the 8%-versus-96% gap is the clearest picture yet of how much the defaults matter.
Check any block on cesspool.lolKnots PR tracker
Sources: cesspool.lol home, about and Plumb pages (Oct 26, 2026); Plumb v29.4.2.knots20260508.plumb7 release notes; Knots PR #481. Spam share is cesspool.lol's measure using Plumb's policy. Quotes are verbatim and trimmed.
Have an XBT story? Write for xbt.live.