A wallet containing 80,000 BTC, dormant for over a decade, was mysteriously reactivated on July 4, 2025. Behind these transactions, a technical and legal operation could reveal the exploitation of a vulnerability in Bitcoin.
Old wallets and 80,000 BTC at stake — What really happened? An artistic performance or a genuine legal move?
On July 4, 2025, several transactions on the Bitcoin blockchain shook the ecosystem: 80,000 BTC, worth more than $8.6 billion, were moved from eight addresses that had been inactive for more than 14 years.
Several elements link these eight transactions: they all took place on the same day, each transferred 10,000 BTC, and, most importantly, the old addresses received micro-transactions containing messages that appeared to be aimed directly at the owner of the funds.
These messages take the form of legal warnings, apparently from notaries wishing to verify that the owner no longer had access to their BTC.
- First message: “LEGAL NOTICE: We have taken possession of this wallet and its contents.”
- Second message: “Not abandoned? Prove it by an on-chain transaction using private key by Sept 30.”
- Third message: “NOTICE TO OWNER: see www.salomonbros.com/owner_notice.”
The Internet page mentioned in the last message was posted on July 3, but is no longer accessible. It was reportedly published by Salomon Brothers, a New York-based investment bank, to provide legal guidance on taking possession of the 80,000 BTC that had been inactive for 14 years.
The bank, which may have been mandated by a client, relied on the doctrine of abandonment, a principle derived from real estate law whereby property that has not been claimed for a long time can be legally taken over by a third party, provided that the taking of possession is public, open, and documented.
The website published a notice of possession, setting a 90-day deadline (until October 5, 2025) for the rightful owners to prove their entitlement by signing with the private key. In the absence of a response, the funds would likely have been considered abandoned, allowing a third party to claim ownership without it being legally classified as theft.
This suggests that someone, probably a customer of Salomon Brothers, got hold of the private key to one or more of these wallets and took legal steps to protect themselves in the event of a dispute.
But beyond the symbolic date of July 4 (American Independence Day), other troubling details have fueled speculation. For example, other transactions were sent to these addresses shortly after those of Salomon Brothers, one of which contained the famous numbers from the TV series Lost: “4 8 15 16 23 42.” Even stranger, October 5, 2025, corresponds exactly to the 20th anniversary of the broadcast of the episode in which these numbers are featured.
Finally, one of the new destination addresses: bc1qwq5geath93h01nfsrmnwnfuck2f9ypv4ewyl4j, explicitly contains the word “fuck,” an unlikely coincidence that has reinforced theories that this operation could also be a carefully orchestrated work of art.
The most credible explanation to date
So far, one might think that the July 4, 2025 operation is the result of an attempt to legally recover Bitcoins. Someone could have obtained the private key to an old wallet generated with low entropy, then set up an administrative process to protect themselves legally once the funds were moved.
In Bitcoin cryptography, a private key is a random sequence of 256 bits, which is one combination out of 2²⁵⁶ possibilities, or 115,792 billion billion billion billion billion. Its entropy refers to the degree of randomness used when it was created. If this entropy is low, for example due to a poor random number generator, the key can become predictable and therefore potentially calculable by a third party, exposing the funds.
However, other dormant addresses have received the same OP_RETURN messages, including the address 1PYMXhJMYveTXY3sHQEeA7answwqkR5qD5 (400 BTC) and 15MZvKjqeNz4AVz2QrHumQcRJq2JVHjFUz (nearly 4,000 BTC). This suggests that it is more likely to be mass spam sent to several old addresses by someone linked to Salomon Brothers.
In this scenario, no one got hold of a private key and one of the targeted owners panicked when they saw these messages, believing them to be credible, and decided to move their 80,000 BTC to avoid any risk of a real attack.
The references to figures from Lost would then be a simple joke from other people, used to add to the mystery, as would the presence of the word “fuck” in one of the new addresses, probably a sarcastic message from the owner to the spammers.
Despite everything, this case continues to fuel theories. Some see parallels with Craig Wright, Roger Ver, or other figures in the ecosystem. It is unlikely that we will have clear answers anytime soon.
