By Staff
Somewhere between 2.3 million and 3.7 million bitcoin sit quietly in addresses that appear untouched. The math says you cannot take them, the law says they are not yours, and anyone promising an easy shortcut is almost certainly after your money.
The idea that dormant coins are fair game – a digital lost-and-found ripe for plundering – is one of cryptocurrency’s most persistent fables. It also fuels a multi-billion-dollar fraudulent recovery industry. But looking past the hype reveals a stark reality: unmoving coins are either permanently inaccessible or simply being held by patient owners.
How Much Bitcoin Is Actually Missing?
Nobody knows for certain, and any single definitive number is guesswork. Blockchains record transactions, not human intent; a public ledger shows which coins have sat still, but it cannot explain why.
Analysts generally measure coin inactivity and assume that longer silence implies a lost private key:
- Chainalysis first estimated in 2017 that between 2.78 million and 3.79 million BTC were lost, later standardizing around 3.7 million.
- Ledger places the current range between 2.3 million and 3.7 million BTC.
- Unchained estimates 3.0 million to 3.8 million BTC.
- CoinDesk noted that around 5.6 million coins have remained unmoved for over a decade—though “dormant” and “permanently lost” are fundamentally distinct categories.
A standard industry heuristic treats coins unmoved for five years as likely lost, but the assumption fails regularly. In June, a wallet holding 30 BTC unmoved since August 2011 processed its first outgoing transfer after nearly 15 years. The owner had not lost access; they were simply waiting.
With bitcoin hovering near $84,000 and around 20.1 million mined so far, that 2.3-to-3.7-million range represents roughly $193 billion to $310 billion – between 11% and 18% of the total mined supply. Most of these stranded balances date back to the early days when bitcoin traded for pennies and keys were saved on desktop hard drives.
Even technical professionals were caught off guard:
- James Howells, an IT specialist in Wales, discarded a hard drive containing the private keys to 8,000 BTC into a local landfill in 2013. Following a January 2025 court dismissal blocking his excavation efforts, the roughly $671 million stash remains buried under trash.
- Stefan Thomas, a San Francisco programmer, holds 7,002 BTC on an IronKey USB drive that locks permanently after 10 failed password attempts. Having exhausted eight attempts, nearly $590 million sits behind his two remaining guesses.
Why Brute-Force Guessing Is Impossible
Bitcoin security relies on numbers so vast they defy conventional intuition.
A Bitcoin private key is essentially a number selected from an address space of roughly $10^{77}$ possibilities, which map to roughly 1.5 × 10⁴⁸ addresses. If an attacker constructed a machine capable of testing one trillion keys per second and ran it continuously for the entire age of the universe (about 13.8 billion years), it would cycle through roughly $4 \times 10^{29}$ guesses. That accounts for just one part in three billion billion of the usable space.
A dormant wallet created in 2010 relies on the exact same cryptographic barriers as a newly minted address. Satoshi Nakamoto’s roughly 1.1 million coins have stood as an untouched, publicly visible bounty for well over a decade, defying every hacker and opportunist on earth.
While historical software flaws – such as flawed random-number generation in select early browser-based wallets – and potential future quantum shifts exist, they do not turn dormant addresses into open property. Exploiting a flaw to take what belongs to someone else remains theft.
What Legitimate Recovery Involves
Legitimate recovery services do exist, but their work never starts from scratch – it requires direct cooperation with the owner and access to the original digital artifacts.
- Password cracking on owned files: Companies like Wallet Recovery Services and Crypto Asset Recovery test millions of permutations of partial passwords provided by the client. Legitimate firms report modest success rates (roughly 30% to 35%), charge on contingency (often 20% of recovered funds), and state plainly that brute-forcing the network without clues is mathematically impossible.
- Hardware exploits: Specialized security engineers, such as Joe Grand, have occasionally recovered funds by physically glitching vulnerable microcontrollers to extract PINs. Similarly, firm Unciphered developed an attack against older IronKeys. In all genuine engagements, the hardware owner is in the room; reputable shops routinely turn down third parties seeking access to wallets they do not own.
Exploiting Greed and Despair
The impossibility of an easy shortcut has made recovery fraud a booming enterprise. The FBI’s Internet Crime Complaint Center (IC3) reported $20.9 billion in total internet crime losses for 2025, with cryptocurrency tied to $11.4 billion of it. Fraudulent “asset recovery” services accounted for $1.4 billion across 10,516 complaints.
These scams operate on well-worn patterns:
- Contacting victims unprompted, leveraging leaked breach lists or prior fraud records.
- Demanding upfront payments via cryptocurrency or untraceable gift cards.
- Promising legal seizure or forensic powers that only law enforcement and courts actually possess.
A parallel racket preys on would-be thieves. Posing as confused novices online, scammers post seed phrases to wallets showing thousands of dollars in Tether. When an opportunistic bystander deposits a small amount of TRX or ETH to pay the network transfer fee, automated scripts instantly siphon off the deposit. The victim thought they were stealing an abandoned wallet; in reality, they walked into a multi-signature trap.
The Legal Reality: The $300 Billion Test Case
The flawed theory of “abandoned” crypto has even surfaced in state courtrooms. In March 2026, an anonymous plaintiff group styling itself “Noah Doe” filed suit in New York County Supreme Court, seeking title to 39,069 long-dormant addresses holding roughly 3.8 million BTC (over $300 billion) under state lost-and-found statutes.
The legal arguments quickly ran aground:
- Misapplied law: New York’s lost-and-found statutes were written for tangible physical items turned over to local precincts, not digital cryptographic keys.
- State escheatment rules: New York’s 2022 amendments to the Abandoned Property Law explicitly route verified unclaimed virtual currency to the State Comptroller, not opportunistic private finders.
- Shifting balances: Dormant coins regularly move. As multiple addresses included in the claim suddenly transacted funds, the plaintiffs were forced to quietly strike dozens of them from their filing.
A court declaration would hand plaintiffs a piece of paper, not a private key. Without cryptographic control, access remains out of reach.
Practical Takeaways
Protecting your assets requires treating custody with technical discipline:
- Self-custody hygiene: Store seed phrases physically in multiple secure locations, verify recovery backups at least once, and ensure clear estate instructions exist for heirs.
- Lockout procedures: If you lose access, work strictly from original files, partial passwords, and physical hardware. Partner only with reputable specialists working on clear contingency terms who ask for no upfront fees.
- Recognize the landscape: Never share seed phrases, report fraud to official bodies like IC31, and ignore third parties claiming they can crack arbitrary addresses.
Unmoved bitcoin is not unclaimed treasure waiting to be scooped up. It is either someone’s secured wealth or their permanent loss, locked away behind mathematics that do not yield.
Reference Links
