To grasp just how huge these amounts are, bear in mind that only 75 wallets today hold more than 10K BTC¹. In first place is Binance with its 248K BTC (it owns several others), followed by the likes of Bitfinex (130K), OKX (44K) and Crypto.com (21K).

So where did the money end up? Well… nowhere in particular. Each wallet was emptied and transferred to another. The destination wallets are all very recent, and the only things that point to a coordinated operation are the identical amounts, the creation dates of the drained wallets and the tightly bunched transfers. That, and the fact that they all come from primitive wallets that appear to be linked.

Fun detail: one of the target wallets has a rather surprising name: bc1qwq5geath93h0lnfsrmnwnfuck2f9ypv4ewyl4j. Enough to make you wonder whether it really is a coincidence.

Some then talk of a possible upgrade, or even something automated, and every hypothesis is on the table. But the next day, Eric Chennells publishes notes sent to the wallet a few days before the withdrawal.

• 1 July: LEGAL NOTICE: We have taken possession of this wallet and its contents
• 2 July: Not abandoned? Prove it by an on-chain transaction using private key by Sept 30
• 3 July: NOTICE TO OWNER: see www.salomonbros.com/owner_notice
• And finally 4 July, just before the withdrawal: 4 8 15 16 23 42

Which removes any doubt that the funds really were stolen.

As for Salomon Brothers, this is surprising too. The more seasoned (and less young) among you will have recognised the name of the legendary bank and asset manager, known for rigging the Treasury bond market, heavily sanctioned, then taken in hand by Warren Buffett, its leading shareholder at the time. After yet another blow during the dotcom crash, it was fined $1.4bn by the SEC and ended up absorbed by Citigroup.

Or at least, that was the story until recently. Because in 2022, Salomon alumni bought back the brand and relaunched the business, with the same name and the same logo.

So what the hell does it have to do with anything?

When I asked, a current executive at the firm told me they have no role whatsoever in the operation, that their website was hacked, and that the page has (indeed) been taken down. But that it is indeed their website.

The page no longer mentions 30 September, but 5 October 2025.

As for the string of numbers, it is the Valenzetti Equation, which predicts how long humanity has left before extinction… in Lost. The name of the series is probably the actual message, even though Twitter has been teeming for days with theories about these numbers, each more half-baked than the last.

Because you have to be careful not to over-interpret, starting from the answer to find the question. One investigator (cited below), for example, describes Salomon Brothers as the most powerful organisation in the world right now². Forgetting that we are talking about a firm that, according to my information, manages less than $5bn. Another replies that the address is the headquarters of EisnerAmper, a crypto forensics firm, where Gary Alford, the IRS agent who identified Ross Ulbricht, the founder of Silk Road, had been involved. Which is only partly true. EisnerAmper is first and foremost a huge accountancy firm, which does have a forensic division (not in that building), but crypto is fairly far from its field, and its involvement in the Silk Road case was very remote. One could just as well have mentioned Rosenberg & Estis, another tenant, a law firm that represented several thousand victims against Celsius, the collapsed crypto lender. But let’s stick to what we know.

So how is this whole mess even possible? Well, buckle up…