Twenty years of safety came from a boring property: those keys never touched a networked machine, so nothing leaked that could be copied. The coins themselves sit on chain in a form that is harder to defend than a modern wallet. Early coinbase pays went to P2PK outputs, which published the full public key; a P2PKH address reveals its key only at the moment of spending. Chain analysis puts the stash near 1.1 million coins in a single-key ECDSA setup. No multisig, no passphrase, no hardware behind it. That reframes the risk: the threat is not a stolen seed but a future machine running Shor on a key that has been public since 2009. Nearly twenty years of quiet says nobody ever got hold of that key. It says nothing about the next twenty.