Genz ©Created by JThemes.com
A cryptographic earthquake has shaken the Bitcoin world.
On July 4, 2025, eight dormant Bitcoin wallets—each untouched since 2011 and holding exactly 10,000 BTC—simultaneously moved their funds, totaling 80,000 BTC (about $8.6 billion)
While such “whale” awakenings are rare, the precision and drama behind this one are unprecedented.
Their sudden activity has launched a storm of speculation, a web of theories, and one burning question: Is Bitcoin’s foundational security under threat?
The BCH Test and BTC Execution: A Methodical Tactic
At 02:41:32 UTC, 10,000 BCH were moved—likely to verify key control—followed exactly one hour later, at 03:43:33 UTC, by the BTC transfers
This two-stage operation strongly suggests deliberate private-key confirmation across both Bitcoin and Bitcoin Cash networks—a calculated and expert move.
The Zombie Wallets Wake Up
These wallets, each holding around 10,000 BTC, date back to the Satoshi Nakamoto era. Their inactivity made them symbols of Bitcoin’s early days and presumed lost forever.
Their movement wasn’t random:
- They were consolidated into new, more secure address formats.
- One destination address was a vanity address—containing the explicit string “F.U.C.K”—suggesting deep technical knowledge and possibly a provocative message.
This alone would’ve caused a stir. But then came something even stranger…
The OP_RETURN Notices: Warnings on the Blockchain
Before the coins moved, four blockchain-embedded messages were sent to these wallets using the OP_RETURN function:
- “We have taken possession of this wallet and its contents.”
- “If the wallet is not abandoned, its owner must manifest before September 30.”
- A URL to SalomonBros.com claiming a legal right to abandoned digital assets.
- The mysterious numbers 4, 8, 15, 16, 23, 42—a direct reference to the TV series Lost.
The messages appeared to serve legal and psychological purposes. The Salomon Bros site mimicked legal language, inviting wallet owners to submit identity information to reclaim their coins—setting a 90-day countdown ending on October 5.
The Narrative: Artistry Meets Exploit
This as “cryptographic performance”—a blend of legal theater and psychological warfare. The deliberate timing (July 4), artistic references, and advanced vanity addresses (ending in “…fuck…”) underscore a highly intentional show designed to provoke, intimidate, and test reactions
A “Test” on Bitcoin Cash
Before moving the main BTC, 10,000 Bitcoin Cash (worth ~$4 million) were moved from a linked address—likely a test transaction using the same private keys.
This strongly indicates someone was verifying wallet access—either the original owner… or someone else.
The P2PKH Vulnerability
These old-format P2PKH addresses, lacking hierarchical derivation and often relying on flawed randomness, are highly susceptible to exploits—especially in light of biased ECDSA-nonce attacks identified by Cyphertux (ECDSA Nonces, Lattice, RNG et Patterns : Decrypting a Bitcoin Exploit).
Is Bitcoin’s Security at Risk?
The community quickly split into two camps:
The Owner Returns
One theory is that the original owner, alarmed by the notices or just being cautious, moved their funds to modern addresses to avoid future vulnerability—especially in light of quantum computing risks.
Or a Hacker Found a Flaw?
A more chilling possibility: someone cracked these wallets by exploiting poor randomness in early wallet generators. This wouldn’t be a flaw in Bitcoin itself, but rather a vulnerability in third-party tools used over a decade ago.
Such a breach would fundamentally shake trust in Bitcoin’s immutability.
Who Did It? The Leading Theories
1. Ross Ulbricht
Founder of Silk Road, pardoned in early 2025. Some speculate his release coincides too neatly with this awakening.
2. Roger Ver
“Bitcoin Jesus” and early evangelist. Some claim wallet ties, but evidence is inconclusive.
3. Craig Wright
The controversial self-proclaimed Satoshi. Known for theatrics and legal conflicts, some suspect he’s behind the messages or the transfers—possibly to sow distrust in Bitcoin.
4. U.S. Government Sting?
A theory suggests the DOJ or IRS sent the notices as bait to track old, undeclared Bitcoin holders or test dormant wallets.
5. Scam/Phishing Operation
BitMEX called it: a phishing scam. The SalomonBros website collects personal data under the guise of legality, possibly to harvest information from scared wallet owners.
What This Means for Bitcoin
- Cryptographic risk: AI-assisted recovery of private keys threatens old, vulnerable wallets.
- Psychological impact: The coordinated drama could destabilize confidence, trigger market movements.
- Protocol evolution: Urgent need for enhanced randomness, nonce-handling, quantum-resistant development.
Why It Matters for Everyone
This isn’t just about one whale.
If old wallets are being compromised, confidence in Bitcoin’s historical security could be shattered. This could trigger:
- Panic selling
- A collapse in market trust
- And major contagion across all crypto assets
Remember: Bitcoin is the anchor of the entire crypto ecosystem.
All Eyes on October 5
The SalomonBros “notice” sets a deadline:
October 5, 2025.
Will these wallets move again? Will the funds be sold? Will more old wallets suddenly awaken?
Whatever happens, the countdown is real—and the outcome will echo far beyond Bitcoin.
Lessons for the Crypto Community
- Use secure, modern address formats (SegWit, Taproot).
- Never trust unverified legal claims—especially ones asking for private data.
- Understand entropy: early wallets might be weaker due to flawed key generation.
- Be vigilant: even if Bitcoin’s code is strong, human error, social engineering, and old tools are real attack vectors.
Final Thoughts
Whether this event is a wake-up call or a warning shot, it underscores a vital truth:
Bitcoin is trustless—but the community isn’t.
Stay informed. Stay secure.
And if you’re holding BTC from the early days… maybe it’s time to move them.
Follow for more insights on blockchain security, DeFi risk, and cryptographic forensics.
Useful links
8 addresses: https://journalducoin.com/bitcoin/bit… .
Arkham tweet https://x.com/arkham/status/194157546…
Tweet Eric L: https://x.com/EricLarch/status/194214…
Legal conflict between Kleiman and Wright: https://x.com/captainordin/status/194…
Theory: IsSamSatoshi: https://x.com/issamsatoshi/status/194…
Bitmex warning: https://x.com/BitMEXResearch/status/1…
Craig Theory: Paper: https://x.com/Cyphertux/status/194230…
Roger Ver & Tax Fraud Theory: https://www.justice.gov/archives/opa/… https://x.com/ProfEduStream/status/19…
UnionChain (wallet link): https://unionchain.ai/
Salomon Bro’s Notice: https://salomonbros.com/about-notices
April 2025 Papers on ECDSA:
https://arxiv.org/html/2504.07265v1
https://arxiv.org/html/2504.13737v1
https://www.cyphertux.net/articles/fr…
