A 2013 Wallet Wakes Up, Lightning's Patch Week, and ETFs Whipsaw

Dormant Isn't Abandoned

On Sunday, October 18, a Bitcoin address that had never sent a single coin since it was first funded on September 11, 2013, moved its entire balance: 411.45 BTC, worth about $33 million, in one transaction at block 972,036. When it was funded, Bitcoin traded near $130, so the holding cost roughly $54,000. Galaxy Research flagged the move and tagged the address "Noah Doe #970." That tag is the interesting part.

The lawsuit. In March, a pseudonymous plaintiff calling himself Noah Doe, along with two companies listed only as ABC Company and XYZ Company, sued in New York State Supreme Court (ABC Company, XYZ Company, and Noah Doe v. John Does 1-39,069). The suit names 39,069 dormant Bitcoin addresses holding about 3.8 million BTC, including coins widely attributed to Satoshi Nakamoto, and asks the court to treat them as abandoned under New York's law on found property. The plaintiffs do not hold the private keys. Their notice to the owners consisted of reports to the NYPD, public postings and messages written into Bitcoin transactions, followed by a 90-day claim period.

Where it stands. Over the summer the court put the case on hold and barred the plaintiffs from seeking a default judgment while it dealt with challenges. A pseudonymous owner identified in court papers as John Doe 33 moved to dismiss, arguing that a public address cannot be "found" under the law. The Bitcoin Policy Institute asked to join as a defendant, warning that the theory could reach long-term self-custody holdings like its own. We have found no ruling on the merits.

What the moving coins tell us. Spending requires the private keys. Every one of these moves is an owner, or someone holding the keys, saying the coins were never abandoned. This week's is not the first. By late July, Galaxy had counted 52 named addresses moving 34,335 BTC, and the plaintiffs had already dropped 44 addresses that became active. Galaxy's head of research, Alex Thorn, says these movements are accelerating month over month. Moving coins is not the same as selling them: this week's went to a single new address, and nothing shows a sale.

Why it matters to you. Leaving coins untouched for years is what a careful long-term holder is supposed to do. This case shows how that looks from the outside: like nobody is home. Legal commentators have raised serious doubts about the claim, and a court order cannot move coins without the keys. But the lesson for every holder is about the people around you, not the court. If something happens to you, your family needs to know the coins exist, that they are yours, and how to reach them. Silence on the blockchain is fine. Silence at home is the risk.

Lightning's Patch Week

Two security releases in five days. ACINQ shipped Eclair 0.14.4 on October 15 and 0.14.5 on October 20. Eclair is the Lightning node software behind ACINQ's own nodes. The first release closed a hole that could let a malicious website send commands to a node through a browser that had saved its login, and fixed issues in splicing, payment settlement and onion parsing. The second fixed weaknesses that hostile nodes could exploit, including one that, according to Bitcoin Optech, could let a malicious payer steal funds from nodes that forward trampoline payments. Two security researchers reported the problems responsibly. There are no confirmed attacks or losses. If you run Eclair, upgrade to 0.14.5, even if you installed 0.14.4 last week, and verify the signed release files. Existing channels do not need to close.

The rest of Lightning followed. LND published release candidates for versions 0.21.5 and 0.20.6 with fixes for fee updates, channel message limits and memory handling. The Lightning specification itself changed too: software reading a standard Lightning invoice must now reject any invoice that does not carry exactly one payment hash and one payment secret. Optech says the change addresses a mismatch between invoice parsers that attackers exploited against LNP2PBot, a peer-to-peer trading bot.

BTCPay Server, too. Developers merged a fix for a flaw that let API keys with limited permissions act with broader ones, plus a fix that stops duplicate Lightning payouts. If you take payments with BTCPay, install the next release when it ships, and review which API keys you have issued and what each one can do.

Still waiting on Bitcoin Core 32.0. As of Friday, the latest version on bitcoincore.org is still 31.1. Version 32.0 missed its October 10 target, as we reported last week, and no new date has been announced.

None of this is cause for alarm. Bugs found by researchers, fixed, released with signed files and disclosed once operators can upgrade is the system working. It does mean that if you run your own Lightning node or payment server, updates are not optional this month.

ETFs Whipsaw, and a Rule About Cash Purchases

Spot Bitcoin ETFs took in about $1.07 billion over three days, from Monday, October 19, to Wednesday, October 21, led by $526.7 million on Monday and $524.8 million on Wednesday. Then on Thursday they lost $635.6 million, the largest single-day outflow since June 25. The four days still netted about $439 million in.

The price followed the same arc. Bitcoin climbed to about $84,800 on Wednesday, then fell back below $81,000 early Friday after the Nasdaq dropped 2.6% on Thursday, when Tesla lowered its spending forecast and revived doubts about AI investment. On Friday morning it was near $81,600, down about 0.5% on the week. Brent crude touched about $112 on Tuesday, its highest since May, and the 10-year Treasury yield closed Monday at 5.15%.

One thing did ease. The odds of a rate hike at the Fed's October 27 to 28 meeting fell from about 42% on the day of last week's hot inflation report to about 17% on Monday and about 15% on Tuesday, after weak housing data, according to CME FedWatch figures.

A rule worth knowing about. The Commodity Futures Trading Commission has published an early-stage proposal, open for public comment until December 14, on how futures law applies to retail Bitcoin purchases. Under its preliminary reading, as summarized by TFTC, even a fully paid cash purchase could fall under futures rules if the seller offered financing, unless the buyer takes actual delivery. Moving the coins to a wallet you control within 28 days is the clearest way to qualify, and a balance that sits only on an exchange's own books may not. It is a proposal, not a rule, and it may change. It is one more reason to withdraw what you buy.