While studying the first Bitcoin blocks mined by Satoshi Nakamoto, we discovered something disturbing. Bitcoin blockchain - and probably any blockchain out there - is nothing more than an Excel workbook, with interconnected sheets. No security is embedded in the blockchain itself, whatsoever. All security within the network is provided by two kind of entities: the miners, and the wallet developers.

And while a malicious miner is not able to change any entries - with the exception of a 51% attack - a malicious wallet developer is able to hack into any wallet address - even without knowing any passphrase - and empty any wallet in the blink of an eye. It doesn't matter whether this is a cold storage wallet, a hot storage wallet, a hardware wallet, or a software wallet. Why? Because for any transaction sent to the network, is enough that the transaction is encrypted using any valid private/public encryption key combination. There is no limiting factor on how wallets transmit transactions within the network, and no validation is taking place.

A malicious wallet developer/user may have their wallet assigned any address - but it is profound they would be interested in those with the high balances, by simply examining the address balance on the blockchain. Satoshi Nakamoto himself was considering addresses to be used only one per transaction - so each address should have maximum balance of 50 BTC (and that, at a time when the price of each Bitcoin was exactly $0). With the address being anonymous, no identity check is taking place on the network or the blockchain - the network is based on the wallet developers integrity. The wallet itself is responsible for creating a random address, check whether this address already exists, and assigning it a valid private/public encryption key combination (used to transmit transactions over the network), and a passphrase. If a malicious developer goes to build a wallet from scratch, all is needed is simply the valid private/public encryption key used to encrypt transactions transmitted to the network. That's exactly what Satoshi Nakamoto did when he first submitted the first transfers in the blockchain; he simply encrypted the transmission on the transmitter side, and decrypted it on the miner side. All security features came much later. If you had Satoshi's original wallet software (or if you could develop one similar to that), you would be able to submit transactions to the network, literally on behalf of any address ever recorded on the blockchain.

It wouldn't come in surprise if such wallets actually do exist. And smart thieves steal either from addresses that have not transacted for years (dead wallets), or one or two Bitcoins from wallets containing thousands - who would notice such a transaction?