To understand how wallets dormant for 14 years could be emptied, you first need to grasp one thing: the Bitcoin of 2011 is the equivalent of a Nokia 3310 next to an iPhone 15. Functional, robust, but with security standards that would raise eyebrows today.
Back then, P2PKH3 was used massively. A barbaric name hiding a simple idea: instead of sending bitcoins directly to a public key (as was done in the very early days), you send them to that key’s cryptographic fingerprint. As if, instead of giving out your full address, you just gave your postcode - but a magic postcode that can only belong to you.
These addresses all start with “1”, like our 7 mystery wallets. It is the signature of the Satoshi era, the time stamp of an age when Bitcoin was worth less than a coffee and nobody imagined we would one day be talking in billions.
To put it simply, imagine you want to receive bitcoins. With P2PKH:
To spend those funds, you have to prove two things: that you know the corresponding private key AND that this private key really matches the fingerprint stored on the blockchain. It’s elegant, it’s simple, it’s... vulnerable to certain attacks nobody suspected in 2009.
So how is all this possible?
Arkham Intelligence4, a crypto analytics platform, put out a reassuring hypothesis on Sunday evening: the 80,000 BTC were not stolen, merely migrated. A format upgrade, from P2PKH (addresses starting with “1”) to Bech32 (addresses starting with “bc1q”). Like going from Windows 95 to Windows 11, but with $8bn attached.
Technically, it’s plausible. If you hold the private key to an old address, nothing stops you from moving your funds to a modern address that you also control. Thousands of holders do it regularly to:
Except that several details don’t add up in this pretty story:
The total absence of activity for 14 years. We are talking about wallets completely dead since 2011. Not one movement, not one test, nothing. And bam, 7 of them wake up on the same day, with round amounts of exactly 10,000 BTC. It’s as if seven coma patients woke up at the same moment to go jogging.
The messages engraved in the blockchain. “LEGAL NOTICE: We have taken possession of this wallet”. “Prove ownership by on-chain transaction before Sept 30”. The numbers from Lost. It looks more like a digital hostage-taking than a quiet upgrade. If it really was the rightful owner, why all the theatre?
The absence of a cryptographic signature. The owner could have signed a message with his original private key to prove he still controls the funds. That’s the basics. Here: zilch.
Arkham provides no evidence. Its hypothesis rests solely on the observation that the funds land on bc1q addresses. That’s like saying a robbery isn’t a robbery because the notes ended up in a modern safe rather than under an old mattress.
Yes, migrating from P2PKH to Bech32 is common. But in this specific case, with the threatening messages, the perfect timing, the coordination between dormant wallets... everything points to an outside takeover.
Is it a quantum hack? A posthumous theft? Heirs who found the keys? We don’t know, but we can still sketch out several technical ways the hack could have been done. The vulnerabilities fall into three broad families, each with its own specifics.
Note: this section was written with the help of a blockchain expert, whom I thank. It was written on the Saturday, the day after the attack. On the Sunday, Cyphertux published a long investigation (in French) that partly reaches the same hypotheses, and this section has been partly enriched with its analysis.
The exposed public key. This is THE fundamental vulnerability of P2PKH. Unlike modern formats, as soon as you spend bitcoins, your full public key is revealed on the blockchain. It’s a time-bomb vulnerability: as long as you don’t spend, only the hash is visible. But once the public key is exposed, all that stands between you and your funds is ECDSA5.
ECDSA and the quantum threat. So P2PKH uses ECDSA, which is vulnerable to sufficiently powerful quantum computers. Google has just announced Willow with 105 physical qubits - a long way from the 1,000 to 3,000 logical qubits needed to break ECDSA with Shor’s algorithm. Contrary to popular belief, Taproot adopted Schnorr signatures for their efficiency and aggregation, not for quantum resistance: Schnorr is just as vulnerable as ECDSA to a quantum computer.
The double protection of SHA-256 + RIPEMD-160. Let’s be clear: this combo has never been broken. Never. It’s the cryptographic equivalent of a Swiss bunker. But in crypto, you don’t bet on “never”, you plan ahead. Hence the gradual migration to more modern standards, not because anything is broken, but because people prefer to stay three steps ahead.
Address reuse. The cardinal sin of early adopters. Reusing a P2PKH address after spending from it exposes your public key permanently. Should ECDSA ever weaken (notably with the advent of quantum computers), all the funds tied to that key would be compromised. Not to mention the total loss of privacy. SegWit and Taproot were designed precisely to make creating unique addresses as easy as a click.
Catastrophic storage. In 2011, no hardware wallets, no standardised seed phrases. Private keys were often stored unencrypted in wallet.dat files, on unencrypted hard drives, or even printed on paper kept in a drawer. What if all this theatre was only meant to cover up a perfectly ordinary burglary?
Dodgy random number generators. The 2013 Android bug remains the textbook case. A flaw in SecureRandom caused ECDSA nonces to be reused, making private keys computable. Hundreds of wallets were drained before the fix in August 2013. It was like handing out identical house keys to the whole neighbourhood. To this day, Google clearly advises against using these functions to protect anything6.
The case of the catastrophic seeds. A Mt.Gox developer had generated his wallet with a seed so weak that a 50-line Python script could recover it in a few hours7. His “secure password”? His username stuck to his date of birth. 100 BTC gone. At the time, it was “only” $1,000. Today, it’s $10M.
The lack of standards. Before 2013, there was no BIP32 for hierarchical deterministic keys, no BIP39 for recovery phrases. Every wallet cobbled together its own solution, sometimes with fragile approaches: short seeds, passwords hashed straight into private keys, insufficient entropy.