Nobody Can Steal Satoshi's Bitcoin

Somewhere on the Bitcoin blockchain, in public, readable by anyone, sit roughly a million coins that have not moved in fifteen years. They belonged to Satoshi Nakamoto, Bitcoin's vanished inventor, and at today's prices they're worth north of sixty billion dollars.1 2 3

Here is the strange part. There is no bank around them. No vault door, no guard, no alarm. The address is public. The rules of the system let anyone — you, right now, on the laptop you're reading this on — try to unlock them. You can try for free. You can try as fast as your computer will go. You can try forever, and no one will stop you, or slow you down, or even know you're trying.

So this really is, as people love to say, a safety-deposit box that anybody can attempt to crack, millions of times a second. The money is right there.

And yet it's still there. Nobody has taken it. Not in fifteen years, with the whole world watching and the prize growing into the billions. This is the story of why — a story that turns out to be less about money than about a number so large it breaks your sense of "large," and about the one honest crack in the wall that the number can't cover.

Part 1The lock is 256 coin-flips

To spend those coins, you need their private key. And a Bitcoin private key is almost insultingly simple: it's just a 256-bit number. Flip a coin 256 times, write down heads-or-tails as ones and zeros, and you have a key. Somewhere in that space of all possible 256-flip sequences is the one that opens Satoshi's address.

That's the whole secret. The address is public and easy to check: given a key, your computer can instantly work out which address it controls, and see if it's the one holding the money. There's no password-attempt limit, because there's nothing central to limit it — you're not logging into a server, you're just checking math on your own machine. The only thing standing between you and the fortune is which of the possible keys is the right one.

(One wrinkle we'll need later. If an address has never been used, even its public key stays hidden, and the attacker must search that whole space. But Satoshi's earliest coins use an old format that left their public keys sitting in the open from the very first block — and that, it turns out, makes the wall around them a different, shorter wall than the one most coins enjoy. Hold that thought; it's where the whole story bends.)

How many possible keys are there? Two to the 256th power.4 Written out, that's about 1 followed by 77 zeros.5 Which means nothing to you, because numbers that big mean nothing to anyone. So let's fix that, because it's the whole game.

Part 2How big is that, really?

Not "a lot." A different category of large.

Start with something already too big to picture: every grain of sand on every beach on Earth. That's about 10¹⁹ grains — a 1 with nineteen zeros.6 Now go bigger. Every star in the observable universe: about 10²³, ten thousand times more than all that sand.6

Now keep going, past anything you can point at, all the way to the atoms. Every atom in every star in every galaxy in the entire observable universe comes to roughly 10⁸⁰.5 And that — the count of every atom in existence — is finally in the same neighborhood as the number of possible Bitcoin keys. There are about 10⁷⁷ keys: very nearly the number of atoms in the universe, only about a thousandfold fewer.5

Sit with that. The lock has roughly as many combinations as there are atoms in the sky. If you could somehow assign one key to every atom in a thousand universes, you'd just about have enough atoms to label them all.

“But the probability isn't zero. Someone could get lucky and guess it on the very first try.”

True — and it's worth being precise, because "not zero" is doing a lot of dishonest work in that sentence. The chance of hitting the right key on one random guess is about 1 in 10⁷⁷. Here's a way to feel it: to match those odds, you would have to win a national lottery jackpot — a roughly 1-in-300-million shot — about nine times in a row. Buy a ticket for the next nine jackpots and hit all nine: that is one guess at the key. "Not impossible" and "possible" are not the same word. Past a certain point, a probability is so small that treating it as zero isn't a simplification; it's just accurate.

Part 3So people try. It doesn't matter.

You might think: fine, one laptop can't do it, but what about all the computers? People have built staggering machines to mine Bitcoin. Point all of them at guessing keys instead.

So let's be absurdly generous to the attacker. The entire Bitcoin mining network runs at something like 10²¹ operations per second — not "millions a second," a billion trillion a second, far more than any real key-cracking could manage.7 Now run that for the whole age of the universe: every computer on the network, going since the Big Bang, 13.8 billion years.

After all of that, you would have checked fewer than 1 in 10³⁸ of the possible keys.7 Not 1%. Not a millionth of a percent. A number with thirty-seven zeros after the decimal before you reach a non-zero digit. You run out of universe long, long before you run out of keys.

And here's the part that closes the door for good — the reason this isn't merely hard but impossible. Forget computing for a second. Forget cleverness. Just imagine a counter, and the simplest possible task: tick it up by one, 2²⁵⁶ times. Not check a key, not do any math — just count.

There's a law of physics — Landauer's limit — that sets the minimum energy to flip a single bit, even with perfect, lossless, far-future hardware.8 Multiply that floor by 2²⁵⁶, and the energy required just to count that high comes to more than you would get by taking well over a billion Suns and converting every atom of them entirely into energy.8 Not powering them — annihilating them, E = mc2, and pouring all of it into a counter.

That's the wall. It isn't that nobody has built a fast enough computer yet. It's that there isn't enough usable energy in a billion stars to run the counter to the end. The security isn't engineering. It's thermodynamics.

One honest caveat, and it's the hinge of this whole essay: that billion-Suns wall is the wall around a fresh key — one whose public key is still hidden. Satoshi's coins, with their public keys exposed since the first block, sit behind a shorter wall. Still far, far out of reach of any machine that could ever be built, as we're about to see — but not this cosmic one. Keep that difference in your pocket; Part 5 is where it comes due.

“This is a sleight of hand. A Bitcoin address is only a 160-bit hash, and for coins that have ever been spent the real security is just 128 bits, not 256. You're inflating the number.”

A fair and sharp objection — and exactly the wrinkle from Part 1, come due. The honest answer is that there are three walls, not one.4 If an address has never been used, an attacker has to guess the full key — that's the 2²⁵⁶ wall above. The address itself is a 160-bit fingerprint of the key, so finding any key that fits it is "only" a 2¹⁶⁰ problem — still about 10⁴⁸, still hopeless. And if the public key is known — which for most addresses happens the moment you spend from them, and which for Satoshi's old-format coins has been true since the block they were mined in — there's a shortcut called Pollard's rho that cracks it in about 2¹²⁸ steps instead.4 So yes: the honest floor for Satoshi's exposed coins is 128 bits, not 256.

Now, a careful reader catches something alarming here. 2¹²⁸ is about 10³⁸ — and that's roughly the same 10³⁸ we just got for the entire network grinding since the Big Bang. Have we accidentally shown the coins are crackable? No — and the reason matters. Those 10³⁸ were SHA hashes, the blazing-fast operation mining chips are built for. An actual elliptic-curve key-crack is a different, far heavier computation — at least ten billion times slower per step.9 Redo the "since the Big Bang" sum in real elliptic-curve operations and you reach only about 10²⁸ — still ten orders of magnitude short of 2¹²⁸. So the exposed-key wall isn't cosmic like the 2²⁵⁶ one; it's "merely" that no classical machine that could ever be built finishes in any span of time that means anything. (All of this also leans on a decades-old, unproven conjecture: that no one ever finds a fast classical shortcut for the elliptic-curve problem. None is in sight — but, like all of public-key cryptography, it's an assumption, not a theorem.) A smaller wall. Still a wall. Hold onto that 128-bit number, though — it's where the one real danger lives.

Part 4So how is crypto stolen? Around the lock.

Because crypto obviously does get stolen. Billions of dollars of it, in headline after headline. If the lock is so perfect, what's going on?

Here's the thing every big theft has in common: not one of them broke the lock. They all walked in a side door.

Mt. Gox, which lost something like 650,000 to 850,000 bitcoin in 2014, wasn't cracked — it was an exchange that held everyone's keys for them and lost control of them, through mismanagement and a transaction bug, over years.10 The exchange hacks, the drained wallets, the SIM-swaps: phishing emails, malware that silently swaps the address you paste, a support rep tricked into moving your phone number, a company that kept your keys on a server someone broke into. The math was never touched. The humans and the software around it were.

And there's one cheap door that looks like cracking but isn't: bad randomness. If a key wasn't 256 honest coin-flips — if it came from a weak random-number generator, or from a "brainwallet" passphrase someone could remember — then it doesn't live in that vast space of 10⁷⁷ at all. It lives in a tiny human-sized corner of maybe 10¹⁵ possibilities, and that corner gets swept clean in seconds. One researcher emptied about nine hundred such wallets with a laptop.11 The math can even be undone one layer up: every signature needs its own fresh random number too, and if a wallet ever reuses or botches that, the private key falls straight out of two signatures by schoolbook algebra — which is precisely how some early thefts worked.11

So the lesson isn't that the lock is weak. It's that the randomness is the product. A key is only as strong as it is unguessable, and the only way to make it that strong is to make it truly, boringly random — and then never hand it, or the keys to it, to anyone who can lose them. And that perfection cuts both ways: the lock no attacker can pick is just as merciless to an owner who loses the key. More bitcoin has been lost forever to forgotten passphrases and dead hard drives than to every thief combined — and whether Satoshi's billions are kept or simply lost is a question no one can answer.

Part 5The one real asterisk

There is exactly one way the wall genuinely cracks, and honesty demands we walk straight into it.

A quantum computer would not guess faster. That's the common misconception. It would do something different in kind: it would solve. There's an algorithm — Shor's — that, on a big enough quantum machine, computes a private key directly from a public key, not by trying possibilities but by taking a mathematical shortcut through them.12 It turns that 2¹²⁸ wall from "no computer could finish in the life of the Sun" into something a sufficiently large quantum computer could do in hours.

Crucially, it only works when the public key is exposed. For an address you've never spent from, the public key is still hidden behind that 160-bit hash, and Shor has nothing to grab onto. (There's a separate quantum trick, Grover's algorithm, but it only speeds up blind search — the kind you'd aim at a hidden address hash — and only by halving the exponent, turning a 2¹⁶⁰ hunt into 2⁸⁰, still out of reach. It's Shor, not Grover, that threatens the elliptic-curve key, and Shor doesn't halve the problem — it dissolves it.12)

And here is why Satoshi, specifically, is the bullseye. Satoshi's earliest coins are stored in an old format that puts the public key right there on the blockchain, in the open, for everyone to see.4 Most people can defend themselves the day quantum gets close: just move your coins to a fresh address, and the public key goes back into hiding. But Satoshi has not touched these coins in fifteen years and, as far as anyone knows, never will. The keys are exposed and frozen in place. That makes this the single most quantum-vulnerable pile of money on Earth.

“So quantum is going to take it. Or — no, quantum is hype that's been 'ten years away' for thirty years. Which is it?”

Neither, and the honest answer is the boring middle. No quantum computer that exists today is remotely close.

Breaking Bitcoin's curve with Shor's algorithm would take thousands of error-corrected qubits — which translates to something like one to thirteen million physical ones, with full error correction.13 The best machines today have on the order of a thousand physical qubits, noisy and uncorrected — a count that climbs every year, but against the millions of error-corrected ones Shor needs, the gap is still enormous, and the error correction is a kind of reliability nobody has yet built at scale.13 Surveys of the experts put a real threat somewhere in the 2030s to 2040s, with wide disagreement and a serious contingent saying never at that scale.14 Give it a range, not a date.

And the defense is already standardized — new "post-quantum" signature schemes finalized in 2024, which Bitcoin could adopt, plus the simple act of moving exposed coins to safety.14 There's even a collective version of that fix: Bitcoin has rewritten its own rules before (SegWit, Taproot), so the network could, in principle, agree to migrate or freeze the old exposed coins ahead of any quantum attacker — protecting Satoshi's fortune without Satoshi. It's a real option, with precedent. But it runs into two hard walls of its own: whether consensus could form in time, against an attacker who only has to succeed once; and whether a community that treats "not your keys, not your coins" as sacred could ever stomach freezing coins without their owner's key — even these.15 The point is: this is a real, distant, uncertain risk that the world has time to prepare for — and the only person who can't prepare is the one who vanished.

Still there

So the money sits there, in the open, behind a lock anyone may try and no one can pick. Not because it's hidden, or guarded, or defended by anything you could photograph. It's defended by a number — one specific sequence of 256 coin-flips, drawn from a pool as deep as the atoms in the sky.

That's the quiet miracle buried in all the crypto noise. We tend to think security is a thing you build — thicker walls, better guards, smarter alarms. Here it's something you count to, except no one can: a fresh key hides behind a wall of pure thermodynamics, and even Satoshi's exposed coins sit behind a number no machine we could ever build could finish solving. Against any computer that could exist, the safest fortune in history isn't protected by walls, or guns, or men.

It's protected by a number — and, for as long as the one machine that could finally solve it goes unbuilt, that is enough. The only way in was never to guess it.