$1.5B Bitcoin Private Keys: How a Random Number Generator Became the Biggest Heist Vector

October 2025 bombshell: US authorities seized 127,271 BTC (~$1.5B) from the Prince Group’s Chen Zhi—but not through hacking. They exploited a randomness vulnerability.

The plot twist? Trace back to December 2020. A mining pool called Lubian used MT19937-32 (a weak pseudorandom generator) instead of proper entropy. Bitcoin private keys should theoretically exist in 2^256 combinations; Lubian’s was more like picking from a rigged slot machine.

The damage:

• Between 2019-2020, 53,500 BTC accumulated in weak-key wallets
• December 28, 2020: ~136,951 BTC (~$3.7B at the time) drained in hours
• Nobody noticed. Bitcoin was mooning, people assumed it was liquidations

The dominoes kept falling:

• Trust Wallet (old version): Vulnerability quietly fixed November 2022, but hackers had already stolen ~50 BTC in January 2023
• Libbitcoin Explorer bx: MT19937 + 32-bit seed = only 2^32 key combinations. Hackers emptied wallets in July 2023

The missing link only surfaced when researchers reverse-engineered 2023 data and connected it to Lubian. Five years of dormant bitcoins on-chain finally traced to the Prince Group.

The lesson? “Not your keys, not your coins” is meaningless if the keys were generated by a broken coin-flipper.