A Lawsuit Against 39,069 Bitcoin Wallets

This week, I came across the following story in a Telegram chat:

Noah Doe - obviously a pseudonym - is a resident of New York State who scanned the entire Bitcoin blockchain and identified 42,001 wallets that had been inactive for more than five years. Among them were many famous addresses: for example, some of the earliest addresses in Bitcoin history, associated with Satoshi Nakamoto, as well as the wallet that received coins from the Mt. Gox hack in 2014. In total, they contained 3.79 million BTC.

Under New York law, someone who finds lost property is required to try to locate the owner, and Doe spent a year doing exactly that: he sent notifications to every wallet through blockchain transactions and placed lost-property notices in 820 publications across 37 countries. 2,932 wallets showed activity and were excluded. But more than 39,000 still remained.

New York's lost property law says that if someone finds lost property, turns it over to the police, and the owner does not come forward within the required period, ownership of the property passes to the finder.

Doe brought three USB drives containing the list of addresses to the police. The police issued receipts confirming that the property had been accepted. On May 1, he filed a lawsuit in the Supreme Court of New York. The operation took a year to prepare and was carried out with great care.

Strange demand

When I first read this story, I assumed that, after receiving confirmation from the police that he had done everything he could to locate the owners, the plaintiff would thereby obtain the legal right to use the private keys for those addresses and take the bitcoins for himself.

And I thought that such a course of action deserved respect. Here is why.

• 1. From the point of view of Bitcoin consensus, anyone who presents the correct private key when signing a transaction has the right to spend the coins included in that transaction as inputs. It does not matter when or how they obtained that private key: whether they generated it before the coins were sent to the corresponding address, or saw it in a dream afterwards.
• 2. But from the point of view of widely accepted notions of fairness, the right to spend the coins should belong not to some random person who happens to be able to use the private key, but to the person for whom those coins were intended. For example, if you make an XMR to BTC exchange on rabbit.io, we send the bitcoins to the address you gave us on the assumption that you, and not anyone who randomly guesses the private key to that address, will be able to spend them.
• 3. It seemed to me that Noah Doe's actions found a balance between these two fundamentally different approaches. First, he would prove under the law that he had a right to the coins on thousands of addresses, and only then would he begin searching for the private keys to those addresses. If he ever managed to find them with the help of future quantum technology, he would have not only the authority to spend those coins under Bitcoin consensus rules, but also the full legal right to do so under the laws of the state where he lives.

Isn't that worthy of respect? I think it is.

But then I read how the story was being covered in the media, how it was being discussed on forums and on X, and came away with the impression that Noah Doe was not planning to search for the private keys at all. Everything was presented as if he were relying solely on the power of a court ruling. As if, should the court rule in his favor, information about the private keys to those addresses would somehow magically appear in his possession.

But that is absurd. I find it hard to believe that anyone in their right mind could be counting on that.

If the property handed over to the police consisted of three USB drives containing a list of addresses, then the plaintiff should at most be recognized as the lawful owner of those USB drives, and nothing else. If, on the other hand, he considers the unspent transaction outputs at those addresses to be his property, then to achieve his goal he should have sent those outputs to police addresses, not simply brought in some USB drives.

So I decided to examine the complaint itself and see what legal experts had to say about it.

What Noah Doe really wants

It turns out that Noah Doe is not acting alone. He has two assignee companies: ABC Company and XYZ Company. Their lawsuit seeks a declaratory judgment recognizing Noah Doe, ABC Company, and XYZ Company as the lawful owners of 39,069 abandoned wallets.

In paragraph 14 of the complaint, the plaintiffs also mention claims to the "contents" of those wallets, but in the prayer for relief they step back from that idea and focus only on the wallets themselves.

The complaint does not define what the plaintiffs mean by "wallet". But paragraphs 21-25 contain several descriptive characteristics, from which we can infer that the plaintiffs understand a digital wallet to be a tool for interacting with a blockchain in order to manage assets.

The full text of the complaint is available at this link.

So the plaintiffs are asking to be recognized as the owners of certain tools for managing assets on a blockchain. Why do they need that?

Because it may open the door to future claims to the contents as well. The bridge to that claim is quietly laid in the complaint through the passing reference to "contents" in paragraph 14.

Imagine that you find an old treasure map in a city archive. You have not found the treasure itself - only a map with coordinates, a map that, in principle, anyone who visited the archive could have found. You decide that the map belongs to no one, spend a year placing newspaper notices about it, then bring the map to the police and ask a court to confirm that the map is yours. The court does so. Now the question can be framed differently: if you own the only document that identifies the exact location of the treasure, what happens when someone digs that treasure up? Might you not have a right to demand that it be handed over to you?

In the case of a physical treasure, one could argue that you would. After all, under the very same law Noah Doe relies on, the finder would have to try to locate the owner and turn the treasure over to the police. And then you would appear with your map, the one that precisely identifies where the treasure was found. That map would be a serious basis for claiming that you are the lawful owner of the treasure.

With bitcoins, the scenario might look like this: if coins are ever moved from any of those 39,069 addresses to a regulated exchange operating under a U.S. license, the plaintiffs could present the court ruling and say: "The wallet used for this deposit is our property. Freeze the bitcoins until the matter is resolved." American exchanges are required to respond to such documents. Litigation would begin, and much would depend on the skill of the lawyers on both sides.

What are Noah Doe's prospects?

I will not dwell on the prospects of the lawsuit itself. They are brilliantly analyzed in this piece by Alex Thorn of Galaxy Research. I refer you to that research; it contains many interesting points, including an analysis of how Noah Doe declared that each wallet he found was worth less than $10, taking into account the absence of private keys and the uncertainty of recovering them. That was necessary because New York's lost property law provides an accelerated and simplified procedure for transferring ownership to the finder when the property is worth less than $10.

I want to talk instead about what might happen next if the court does rule in the plaintiffs' favor.

By December 2025, Doe had assigned his right to bring claims over all but eighteen of the wallets he had found to a company referred to in the complaint as "ABC Company". He then transferred 98% of his stake in ABC Company to an irrevocable trust, keeping 2% personally. ABC Company, in turn, assigned 17.7% of the wallets to "XYZ Company". This clearly looks like preparation for a broader litigation strategy.

Quantum computers are advancing. And some of the addresses on the list are early Bitcoin addresses, created at a time when public keys were written openly to the blockchain. If a sufficiently powerful quantum processor capable of reversing elliptic-curve cryptography ever appears, these addresses will be among the first to become vulnerable. Having a legal ruling on ownership in advance means being first in line when such a technology emerges. Or selling that option to someone who is ready to wait.

And whoever actually manages to obtain the private key with a quantum computer - or the original owner of each such address - will be facing a lawsuit. Not everyone will have the resources, the time, the money, and the nerves to endure it.

Most likely, in such a situation, the person who used the private key would have to prove that they did not use the "wallet" that had been declared the property of Noah Doe.

That can certainly be proven. Although the complaint is written in such a way as to make the private key appear to be part of the wallet, in reality a private key is just a number, and no number can belong to anyone. For example, here is a Bitcoin address whose private key is the number 2. Anyone who knows this can make transactions with the coins sent to that address. The most recent such transaction took place just two months ago. No one else's wallet was needed to sign it. All that was needed was the knowledge that substituting the number 2 as the private key would allow a valid transaction to be created.

If the person who moves the bitcoins has enough resources to fight in court, I have no doubt that a reasonable court will recognize that the number used cannot, in itself, be anyone's property. What can belong to someone is a tool for interacting with the blockchain: a hardware wallet, or a particular instance of wallet software running on a specific device.

So Noah Doe and the companies connected to him may have a realistic chance of profiting only if someone unknowingly moves bitcoins after years of cold storage to an exchange such as Coinbase, Kraken, or Binance US. But people who have kept bitcoins on non-custodial addresses for years are unlikely to do that.

Conclusion

Noah Doe has staged and shown us a fascinating story. It is a story about how an attack on coins in the world's most secure cryptocurrency network can be organized. The attack vector is legal. And there are scenarios in which it could work. But for that to happen, the disputed bitcoins would have to be sent to a known address of an American company, giving Noah Doe and his accomplices someone to send a freeze request to. And then the other side would also have to decline to fight in court.

If you do not have the resources for litigation but do have access to such bitcoins, simply do not send them to centralized exchanges. And if you need to exchange them for something else, do it on rabbit.io.

Please don't send us coins from the address holding the stolen Mt. Gox bitcoins. But if the coins come from Satoshi Nakamoto's addresses, then please do! We would be delighted to process a crypto exchange for Bitcoin's creator - or for his heirs.