A wallet holds access—not coins · 2011

The first major reported theft: 25,000 BTC

On June 13, 2011, a BitcoinTalk user named allinvain reported that 25,000 BTC had left his computer. The transfer was visible on the blockchain, but the exact method of compromise and the thief’s identity were never conclusively established.

The report that reached the entire forum

Allinvain wrote that he woke up to find an outgoing transaction for 25,000 BTC plus a fee. He published the recipient address and the time of the transfer, then asked the community to help trace the funds. The transfer remains part of the network's public history.

A warning appeared before the loss

According to the owner, someone had accessed his mining-pool account shortly before the incident and replaced its payout address. Suspicious files were also found on the computer. He changed the pool password but continued using the same working machine with a live wallet.

Why the backup did not help

A copy of wallet.dat preserves keys if a device fails or disappears. The blockchain, however, does not distinguish an owner from an attacker; it verifies a valid digital signature. If another person copied the key or controlled the wallet software on an infected computer, restoring an older file could not reverse a confirmed transaction.

What is verifiable—and what remains a claim

The transfer can be inspected independently. The forum account does not prove the precise attack path, a particular piece of malware or the recipient's identity. It is therefore more accurate to call this the first major publicly reported theft than to present every detail of the owner's explanation as established fact.

The practical lesson

Backup and protection solve different problems. Keys controlling a meaningful amount should not remain permanently on an everyday computer. Hardware or offline storage, separate devices, address verification on a trusted screen and a limited mobile-wallet balance can reduce the consequences of compromise. Continue with our wallet guide.

A backup can restore a lost key. It cannot reverse a transfer signed by someone who has already gained access to that key.

Historical and educational material. The cause of the incident is based on the owner’s public account and was not conclusively proven. Not financial advice.