How Much Bitcoin Is Lost Forever?

Exactly 182.68 BTC are provably lost. Not estimated — proven, by arithmetic anyone with a full node can rerun.

Every larger number you have read is a model. The gap between the proof and the models is roughly four orders of magnitude, and the assumption sitting inside each model does all of the work.

The only number that can be proven

In May 2020, Bitcoin Core contributor Fabian Jahr reconciled the UTXO set against the issuance schedule and published the difference. His finding, Where are the coins?, stands at 182.67920835 BTC missing and provably unspendable as of block 629,038.

The mechanism is mundane. As Jahr puts it, gettxoutsetinfo "does not report the theoretical number of the inflation schedule but the actual number of unspent coins that the node knows about." Coins nobody can ever spend are left out of the database rather than bloating every node on earth forever.

Two disciplines come with citing this. First, always carry the block height — OP_RETURN burns have only grown since 2020, so the true figure today is higher and nobody has published it. Second, don't extend the logic to vanity burn addresses. 1BitcoinEaterAddressDontSendf59kuE holds 13.41694965 BTC, none ever spent, but no key is proven not to exist. Only the opcode proves anything.

Even the genesis block is less tidy than it's told. The Bitcoin wiki records that it's unknown whether the quirk was intentional, and unknown whether Satoshi held that key at all. People have sent the address 7.23 BTC in tribute regardless.

Every estimate, and the assumption doing the work

The Chainalysis 2017 estimate is the one that escaped. Kim Grauer, then a senior economist there, segmented coins by age and activity and put the loss at 2.78M to 3.79M — 17% to 23%. That percentage was measured against a supply of roughly 16.7 million. Bitcoin now has 20,057,259 BTC in circulation at block 958,335. The number still gets quoted against the new denominator, which is simply a different claim.

River disagrees with River

The most methodologically careful public estimate contradicts itself four times, across two of its own pages.

Its 2025 Custody Report opens with "more than 3 million bitcoin have been either permanently lost through poor key management or lost by exchanges." Its body states 1.57 million bitcoin have been permanently lost, with 98% of those losses occurring before 2020 — that figure covers self-custody only. River's explainer page leads its key takeaways with "nearly 4 million bitcoin are estimated to be lost forever," then says in the body "we estimate that roughly 1.57 million bitcoin are lost."

That's a 2.5× internal spread from the people who did the most rigorous work in the field. River is candid about why: "it is impossible to determine the full extent of bitcoin lost by exchanges."

Glassnode reached the same wall and just named it. Its standard metric is called "Hodled or Lost Coins" — (1 − Liveliness) × circulating supply — and the "or" has never been resolved, because on-chain data cannot distinguish a dead man's keys from a patient holder.

Satoshi's 1.1 million

The largest single block of possibly-lost coins isn't attributed by signature. It's attributed by a fingerprint in the nonce.

Sergio Demian Lerner noticed that one early miner's nonces landed only in narrow ranges — the last byte within 0–9 or 19–58, where every other miner used the full 0–255. He named it Patoshi: a miner that "in 2009-2010 mined about 1.1M bitcoins, and that some people associate with Satoshi Nakamoto." That last clause is Lerner's own hedge, and it's usually dropped.

Whale Alert's reconstruction puts hard numbers on it: 1,125,150 BTC mined across 22,503 of the first 54,316 blocks, the miner switching off in May 2010. It estimates the miner held around 60% of network processing power early on and throttled down deliberately as the network grew.

The common claim that these coins never moved is false. 907 BTC were spent across 18 confirmed blocks, including 10 BTC sent to Hal Finney. The accurate statement: 1,122,693 BTC remain unspent, with no outbound movement from the cluster in over 15 years.

Karl T. Ulrich of Wharton modelled what would happen if they moved, in a June 2026 arXiv preprint: ~1.148M BTC is 5.7% of mined supply but 7.6% of freely circulating supply, and a liquidation would cut the price 12–13% over ten years at his base elasticity, or 25–27% over five in the aggressive case. He calls his own results "structured upper bounds under stated inputs, not measurement."

Note how he gets from 5.7% to 7.6%: he nets out lost coins, estimated at 2.78–3.79 million BTC. That's the Chainalysis 2017 range. A Wharton preprint from last month computes its headline ratio from a nine-year-old number. The vintage problem isn't only a journalism problem — it's in the literature.

The documented cases

Read down the right-hand column. The three biggest headline "losses" in bitcoin history — Mt. Gox, Quadriga, the 80,000 BTC hoard — were not losses at all.

Mt. Gox was theft. WizSec found "the MtGox hot wallet private keys were stolen, in a case of a simple copied wallet.dat file" in September 2011 — Bitcoin's wallet encryption arrived in version 0.4, late that same month, just slightly too late. Roughly 630,000 BTC were drained by mid-2013, about 300,000 of it through BTC-e. Alexander Vinnik, WizSec is explicit, was the launderer and not the original thief. Then about 200,000 BTC turned up in an old wallet after the 2014 collapse. Repayments began in July 2024 through five firms — Bitbank, SBI VC Trade, Kraken, Bitstamp and BitGo — and the trustee has pushed the deadline to 31 October 2026.

Quadriga was fraud. The story was that $190M died with CEO Gerald Cotten in December 2018. The OSC's staff review, published 11 June 2020, found 76,000 clients owed $215 million had lost at least $169 million — and that $115 million of it went to Cotten's fraudulent trading on accounts under aliases, with fictitious balances traded against real clients. "In effect, this meant that Quadriga operated like a Ponzi scheme." Any loss estimate built on claimed losses inherits every lie anyone told.

Howells is the real thing, and a judge said why. Dismissing his claim, HHJ Keyser KC wrote the sentence this entire page is about: "The Bitcoin exists independently of any physical device used to access it." The drive became Newport council's property under s.14(6)(c) of the Control of Pollution Act 1974 the moment it was deposited, and the constructive-trust claim was time-barred. The Court of Appeal refused permission in March 2025. In August 2025 Howells gave up: "I am no longer pursuing the purchase of the landfill. I am no longer pursuing excavation." The coins are fine. They're just past a wall of law and rubbish.

Thomas may not have lost anything. His 7,002 BTC — about $448 million at bitcoin's $64,003 price on 16 July 2026 — sit behind an IronKey S200 in a Swiss vault with eight of ten password attempts burned. In October 2023, Unciphered proved to WIRED it could bypass the limit, having decapped an Atmel chip in nitric acid and run some 200 trillion attempts against a test drive. Thomas declined: other experts had already "been promised a cut," and "I'm no longer free to negotiate with someone new." Unciphered's Nick Fedoroff: "We cracked the IronKey. Now we have to crack Stefan. This is turning out to be the hardest part." Those coins are one conversation from moving.

Dormant is not lost

On 5 July 2025, eight wallets dormant for over 14 years moved 80,000 BTC, worth over $8.6 billion. Arkham traced the coins to acquisitions on 2 April or 4 May 2011, when bitcoin traded around 78 cents.

Twenty days later, Galaxy announced it had sold more than 80,000 BTC — over $9 billion — for "a Satoshi-era investor, representing one of the earliest and most significant exits from the digital asset market," as part of "the investor's broader estate planning strategy." The largest notional bitcoin transaction ever executed.

Every dormancy model on earth had those coins in the lost column. They weren't lost. They were an estate plan.

This keeps happening. Fortune reported that in the week of 25 March 2024, 172 long-dormant wallets became active — 169 holding under 50 BTC, one holding over 1,000. In January 2026, 909 BTC woke after 12 years. In May 2026, a whale dormant since November 2013 moved $40 million — 12 and a half years of silence, ended on a Sunday evening.

Each one is a false positive for every threshold model in the table above. And nobody can ever be proven right, because a coin is provably lost only when the code says so. Everything else is a coin that hasn't moved yet — and Satoshi's haven't moved for sixteen years, which is exactly as long as bitcoin has existed.

What it means for supply

The cap isn't 21 million to begin with. A rounding artifact in how block subsidies are stored puts the true asymptote at 20,999,999.9769 BTC.

From there, everyone subtracts. River figures the losses effectively lower the cap to 19–20 million, "or about 18 million" if Satoshi's coins stay dormant. BitGo — undated, unbylined, treat accordingly — puts effective circulating supply at 15.8–17.5 million and claims more than 566 BTC per day age into its lost bucket against 450 BTC per day of new issuance. That second figure is at least checkable: 3.125 BTC × 144 blocks is exactly 450.

Satoshi called this outcome in 2010, in a thread titled "Dying bitcoins": "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone."

The coins we may lose on purpose

In the same post, replying to Laszlo Hanyecz asking whether attackers might one day find cracking keys more profitable than mining, Satoshi wrote: "Computers have to get about 2^200 times faster before that starts to be a problem."

Sixteen years later, BIP-361 — "Post Quantum Migration and Legacy Signature Sunset," draft status, authored by Jameson Lopp and five others — proposes freezing exactly those coins. Its premise: "As of March 1, 2026, over 34% of all bitcoin have revealed a public key on-chain; those UTXOs could be stolen by an attacker with a sufficiently powerful quantum computer," while "academic road-maps now estimate a cryptographically-relevant quantum computer as early as 2027-2030." Phase A blocks sends to quantum-vulnerable addresses ~3 years after activation; Phase B disables legacy spends two years later.

Lopp makes the argument by inverting Satoshi's line directly: "Quantum recovered coins only make everyone else's coins worth less. Think of it as a theft from everyone."

Which closes the loop. The answer to "how much bitcoin is lost forever" is 182.68 BTC, and nobody can prove a single satoshi more. But if BIP-361 or something like it activates, that number stops being an accident of code and starts being a decision — and for the first time, the count will be exact.

Cite this article