Stealing Bitcoin Is the Easy Part.
In my last note, I said quantum computers probably won't kill Bitcoin, because the likely fix freezes the coins nobody can move.
The obvious next question: what if that fix never passes? What if someone cracks old keys and takes the coins?
Here's what that question skips. Taking bitcoin is one problem. Selling it is a different one. And 2026 already gave us a live test.
This summer's heist
In late July, attackers started draining Coldcard hardware wallets. A firmware bug from 2021 meant some devices skipped their hardware random number generator when creating a seed. Weak randomness means guessable keys. The attackers guessed them.
Galaxy Research has confirmed about 1,780 BTC stolen. That's well over $100 million.
Two months later, about 82% of it still sat in the thieves' own addresses.

The thieves hold the keys. Nobody can stop them from moving the coins. So why are the coins just sitting there?
Everyone is watching
Every bitcoin transaction is public, forever. The moment a theft is reported, analysts tag the addresses and exchanges get the list. From then on, those coins are marked.
To turn bitcoin into dollars, you eventually need an exchange or an OTC desk. Those run on licenses. Licenses come from governments. Send marked coins there and you hand over your identity.
So thieves take the long road. They split the coins into small pieces, swap them onto other chains, run them through mixers, and sell slowly through desks that ask fewer questions. Some of the Coldcard coins have started down that road.
It works, sometimes. But it's slow, it costs money at every step, and every step leaves another trail.
The October theft tied to Ledger devices sold through one Southeast Asian reseller shows the same thing. The stolen USDT got frozen by Tether within days, so the thief swapped into a stablecoin Tether can't freeze and pushed Ether through a mixer. Bitcoin's transparency pushes thieves off Bitcoin.
Six years, and still caught
In 2016, a hacker took 119,754 BTC from the exchange Bitfinex.
He managed to launder about 25,000 of them over the following years. The other 94,000 never left the wallet. In 2022, US agents found the private key in his cloud storage and seized them all, worth $3.6 billion at the time.
Six years of waiting didn't make the coins clean. It just made them worth more to the government that took them.
The closest thing to a quantum heist
In December 2020, the Chinese mining pool LuBian lost about 127,000 BTC. Its wallets had been created with weak randomness, so the keys could be found by brute force. That's what a quantum attack would do, just on easier keys.
The coins then sat untouched for about three and a half years.
In October 2025, the US Justice Department said it held 127,271 BTC and filed to forfeit them, calling it the largest forfeiture in its history. Washington says the coins belong to a Cambodian scam boss. China's cyber agency says the US took them by hacking back in 2020.
Whichever story is true, the pattern is the same: a cracked key, a pile of coins nobody could sell, and a superpower at the end of the chain.
Governments are collecting
Since March 2025, forfeited bitcoin in the US goes into a Strategic Bitcoin Reserve, and the order says it is not to be sold. The UK holds about 61,000 BTC from a fraud case. China is fighting the US over LuBian's coins.
When the biggest states treat stolen bitcoin as something to capture, every large theft becomes a prize for them too.
Now apply it to quantum
Who builds the first quantum computer that can break a Bitcoin key? Not a lone hacker. It will cost a fortune to build and to run. It will belong to a government, or a company that answers to one.
Two things follow from that.
The machine is worth more as a secret. A state that can read other states' encrypted traffic doesn't announce it by moving old bitcoin. The moment Satoshi-era coins move, the whole world knows the capability exists.
A dump hurts the thief first. Anyone sitting on a huge stolen pile crushes the value of their own loot by selling it all at once. And the coins most exposed to quantum, the oldest outputs, are the most watched coins on the chain.
Even theft has to play by market rules.
What this doesn't mean
Thieves do cash out. North Korea pushed much of the $1.5 billion it took from Bybit in 2025 through swaps and bridges within weeks. With enough patience and the right network, stolen crypto gets out.
So I'm not saying stolen bitcoin is stuck forever. I'm saying it comes out slowly, in pieces, and at a cost. Not in one crash.
The point
The quantum scare pictures a thief who takes millions of coins and dumps them the same afternoon. Real thieves don't work that way, because they can't. The chain is public, the exits are licensed, and governments are hunting for exactly these coins.
Stealing bitcoin is the easy part. Selling it is where thieves get stuck.
— Toru
Get the next one by email: torusasaki.com/notes
---
Figures on recent thefts are from public on-chain tracking and may change as investigations continue. This note is for research and education only. It is not investment advice, and nothing here is a recommendation to buy or sell anything. Make your own decisions.



