No credible evidence US government hacked Chinese Bitcoin wallets to “steal” $13 billion BTC

Quick takeaway

Short version: a Chinese agency accused the U.S. of hacking wallets tied to a huge 2020 Bitcoin drain, but the open-source sleuthing that people actually rely on says something much less cinematic happened — weak keys, massive brute-forcing, and later legal seizure. There’s a difference between “someone found the coins” and “a government stole them.”

What we actually know (vs. what people are yelling)

Back in late December 2020, a large number of Bitcoin addresses tied to a mining pool were emptied in a few hours. Chain researchers pieced together that about 127k BTC moved in coordinated sweeps. The forensic work points to a predictable technical screw-up: wallets were created using software that seeded a random number generator with only 32 bits of entropy. That tiny seed space makes it shockingly easy to brute-force private keys.

Brute forcing a 2^32 seed space isn’t sci-fi. At roughly a million guesses per second, a single rig can comb through those seeds in hours; spread that work across GPUs or a few machines and the job gets even faster. That explains how an attacker could sweep thousands of vulnerable addresses in one go and why the fee and transaction patterns looked so uniform.

Investigators later tracked many of those drained coins into consolidated wallets and, ultimately, into custody claimed by U.S. authorities as proceeds in a criminal case. That custody event — and the fact the money sat dormant for years — is what sent rumor mills into overdrive, leaping from “weak keys exploited” to “state-level theft.”

Why the accusation that the U.S. government “stole” the coins is weak sauce

There’s a gap between the cryptographic mechanics (which are well-documented) and the identity of the person who flipped the switch in 2020 (which is not). Independent blockchain forensics groups traced the flows and matched address clusters, but they have not publicly produced evidence linking the 2020 exploit to a government hacking operation. In plain English: method and movement are clear; attribution to a state actor is not.

Some arguments for state involvement hinge on circumstantial stuff — the odd multi-year dormancy, then a tidy consolidation before seizure — and that’s interesting but not proof. Attribution normally needs more: persistent infrastructure overlaps, unique tooling signatures, leaked operational chatter, or other forensic breadcrumbs. Those are missing from the public record.

So what’s most plausible? That someone discovered the weak key vulnerability, used brute-force to grab the coins (it’s technically feasible and consistent with the transaction fingerprints), and then the coins moved around until they eventually ended up in government custody via legal action. That chain of events fits the technical findings without invoking international cloak-and-dagger drama.

If you like conspiracy thrillers, the “U.S. government stole it” version is delicious. If you prefer evidence and reproducible analysis, the simpler weak-key + brute-force explanation wins by a mile.

Bottom line: the people who did the digging explain the how clearly; they stop short of naming a state actor for the original 2020 withdrawals. Until new, verifiable forensic evidence appears, shouting “the U.S. stole $13 billion” is a headline, not a conclusion.