First, some background knowledge — bitcoins are a form of cryptocurrency that can be stored in "addresses". Each bitcoin address is linked to a specific private key. To access bitcoins in a specific address, a person needs a private key in order to do so. To put simply — for each bitcoin address (analogous to a bank account), there is a corresponding private key (analogous to a password) to unlock and access the bitcoins.

Now, let's say some genius finds a previously unknown mathematical method to crack private keys faster than brute force. Can he legally claim bitcoins for himself by doing the following?

  1. He deliberately finds bitcoin addresses that have been dormant for years (indicating that it is very possible that their owners have lost their keys and are unable to access the coins. Lost bitcoins are very common - approximately 20% of all bitcoins in existence are lost.), and hacks their private keys.

  2. He transacts the coins to a custodial address first.

  3. He then sends a message to the hacked address and informs the owners that he has found their bitcoins, and requests that the owner claim them within a specific time period.

  4. Once the deadline is up, and no one shows up to claim the coins, he takes them for himself.

In this case, would the "finders keepers" law apply? Meaning that if I find someone else's money, I try to inform the owner and no one shows up to claim the money, I can basically take the money for myself.

I'm asking this question because there is a group known as the "Large Bitcoin Collider" who is trying to brute force other people's private keys and claim the funds for themselves. According to the group, it will give the original owner six months to claim the funds before the group takes the money for themselves, which is "in accordance with European laws." Is this actually legal? (See here)

  • 1
    In the UK there is no "finders keepers" law for physical property. If you find someone's property (e.g. a cellphone) then it remains their property, and if you keep it then you are a thief. bbc.co.uk/news/uk-england-39130530 Apr 21, 2020 at 9:35
  • 1
    @PaulJohnson Except "If you make a reasonable attempt to find the person who lost it and they don't come forward, you could keep [your discovery] with a clear conscience," - such as, posting the address and waiting a couple of months; some countries have specific time periods such as 6 months or 12 months in the law.
    – jpa
    Apr 21, 2020 at 16:04
  • 5
    This isn't conceptually different from picking up someone's safe and finding its lock combination, then claiming the safe's contents.
    – mustaccio
    Apr 21, 2020 at 16:08
  • 4
    "He then sends a message to the hacked address" - how exactly can you send a message to the hacked address? As far as I know, bitcoin addressess are anonymous. Apr 21, 2020 at 17:57
  • 2
    @CaiusJard in essence, the main flaw in your argument is in the assertion that there isn't any legitimate owner; courts in various countries have asserted that there is legitimate ownership of bitcoin. What (e.g.) bitcoin network enforces is conceptually about possession, which is fundamentally distinct from ownership. If someone has possession of something I own (e.g. the private keys to some bitcoin where I can successfully assert in court that any value derived from them belongs to me) then I have the legal right to force them to return possession or compensate me with other assets.
    – Peteris
    May 6, 2020 at 12:04

1 Answer 1


In the UK it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer (s1 Computer Misuse Act 1990).

It seems likely that other European jurisdictions have similar laws. Certainly Germany does: Penal Code 202a data espionage (German text - English translation). (I mention Germany because the linked thread does.)

It might constitute theft in the jurisdiction if the finder did not take reasonable steps to find the owner - which may include informing the police of the find.

Depending on the jurisdiction it might count as 'treasure' or abandoned property such that the finder is obliged to inform the authorities (the jurisdiction has the presumption of ownership of abandoned or lost property - e.g. Scotland), which then decide what to do with it.

Legally speaking it seems to me that, to declare it legal, we have to get over such hurdles.


There seems to be some dispute in the comments that cryptocurrency is subject to any regulation, counts as property, is something of value or is something that is owned and can be stolen, such that the person in the questioner's scenario could be held to account under the law for his behaviour.

Aren't they merely numbers? No - plainly they do have value because people trade them with currency and goods and services. The UK's tax authority, HMRC, "does not consider cryptoassets to be currency or money" but sees them as having economic value because "they can be 'turned to account' - for example, exchanging them for goods, services, fiat currency (that is money declared by a government to be legal tender) or other tokens". They are "a new type of intangible asset". Individuals are liable "to pay UK tax if they are a UK resident and carry out a transaction with their tokens which is subject to UK tax". They are liable for "Income Tax and National Insurance contributions on cryptoassets which they receive from their employer as a form of non-cash payment [or from] mining, transaction confirmation or airdrops." (HMRC cryptoassets for individuals)

Are they property? Something that can be owned, something that can be dishonestly appropriate (i.e. stolen)? That's the interesting dispute.

Recently, the High Court of England and Wales ruled in a bitcoin ransomware-related case that "for the purpose of granting an interim injunction in the form of an interim proprietary injunction ... crypto currencies are a form of property capable of being the subject of a proprietary injunction". In that judgment there is some discussion of the authorities for considering or deciding they are property. ([2019] EWHC 3556 (Comm)) read from para 50 if not the whole judgment.

In at least two other cryptocurrency-related cases the High Court treated the cryptocurrency as property. Vorotyntseva v Money-4 Limited, trading as Nebeus.com [2018] EWHC 2598 (Ch) and Liam David Robertson v Persons Unknown 2019.

There was also a suggestion in the comments that the police would not understand and would not be interested. But there are several jurisdictions where people have been investigated, arrested, prosecuted and convicted of crimes relating to cryptocurrencies. A simple internet search for bitcoin theft, fraud or money laundering will result in some reports. In any case their interest or lack of it is irrelevant to what the law may say.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Apr 22, 2020 at 1:16
  • re: "it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer". Even your own? The blockchain information is distributed to every user of bitcoins. So this would amount to gaining access to some of the encrypted information on one's own computer. And the encrypted information was made public by its original creators. Is it really the case that I can't decrypt any information that a 3rd party got me to copy to my computer in an encrypted format?
    – grovkin
    Apr 23, 2020 at 15:51
  • @grovkin I don't think the CMA has been tested in that respect. But there isn't an absolute freedom to do anything you want with data on your computer. Take reverse engineering for example: there isn't an absolute freedom to reverse engineer software regardless of your method or how you intend to use the information. It depends on how you do it and what you want to do with it.
    – Lag
    May 6, 2020 at 7:01
  • Wouldn't that mean that you can't run an anti-virus program? It removes (and in doing so accesses) viruses despite a lack of authorization from a virus maker? While I ask this in jest, it demonstrates the general principle that you can't know what is hidden in the data/programs that are present on your own computer unless you have the right (even if not the ability) to examine it.
    – grovkin
    May 7, 2020 at 2:21
  • @grovkin Surely this depends on who can authorise what? In the infinitesimally unlikely event there is a prosecuted complaint from the virus writer, I think it's reasonable to assume the court will rule that you can authorise yourself to run anti-virus software on your computer for the purpose of checking for and removing viruses from your computer. I don't think it's reasonable to assume a court would rule that you can authorise yourself to do something with data on your computer for the purpose of dishonestly enriching yourself at someone else's expense.
    – Lag
    May 7, 2020 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .