While it is not clear who made the transaction, Casa's CTO Jameson Lopp noted that it is likely an exchange of payment processor which appeared in late June and has since performed over 60000 transactions.
The entity is still actively making transactions, holds over 400 BTC, and it is not clear whether it is aware of the incident.
"The address in question that made the fee calculation error has the characteristics of a withdraw-only hot wallet from an enterprise. It looks like it only receives deposits from one address to top up its balance every now and then."
"I'd bet they have written their own payment processing software naively; clearly they're new to this space. This address just appeared in late June," Lopp added.
The transaction was broadcasted publicly and, baseed on timestamps, spent 6 minutes and 35 seconds in the mempool before being mined. The block was found by f2pool.
"Will put these 20 BTC on hold for now. To be redistributed to miners if nobody comes to claim it after three days," F2Pool's co-founder and administrator Chun Wang said on X.