ONE does not often find $100m in one's tatty old wallet. But that's just what Mt Gox, the shuttered Bitcoin exchange, says happened a few days ago. While Mt Gox has filed for bankruptcy in Japan and America, and initially said that it had lost 850,000 Bitcoins (valued then at nearly $600m), it uncovered 200,000 (about $100m at today's rates) in a disused wallet that it thought was empty. It seems as though Bitcoins are being plundered continuously. Flexcoin, a smaller service, had a significant theft following Mt Gox's initial announcement, and opted to shut down although most of its coins were secured. Poloniex suffered a similar fate to a larger percentage of its customer holdings but remains in operation. China-based Vircurex last week exhausted its reserves following thefts in 2013 and froze withdrawals from older accounts as it attempts to produce new revenue to repay lost coins.

Beyond the issues of competency, security and accounting at exchanges large and small, these losses highlight the difficulties of maintaining ready access to currency that, unlike legal tender, can exist in a sense simultaneously in many locations. Bitcoin relies on a secret: a private encryption key that is, of course, just a series of numbers, while a corresponding public key, which can be distributed freely and safely, is the "address" to which transactions may be sent. Those numbers remain inert potential until they are used for a transaction.

The public key is used to scramble other data in a manner that can only be done by someone in possession of the private key: thus the beauty of Bitcoin and similar systems is that ownership (but not identity) and security (defeating counterfeiting and thus double spending) are wrapped into the same transaction when value is transferred from one party to another. But while the private key isn't distributed, it must be protected from discovery by an intruder into a system or someone stealing an actual physical device, such as a USB stick or a laptop, that contains private keys.

Possession of the key allows the currency to be permanently transferred elsewhere. Loss of the key means the permanent loss of the currency's value, whether this occurs due to hardware failure (a dead hard drive), software failure (improper encryption or data corruption) or losing track of a password or other means that is typically used to wrap the private key in its own layer of encryption. (A short password can be strong enough to be uncrackable, and is used to unlock a much longer key that is then used for encrypting and decrypting a store of data, such as emails, financial records or a stash of private keys.)

This is a distinct problem with virtual currency. In the electronic ledgers that maintain bank and other balances, money must be transferred between parties and agreed upon for the corresponding value to shift. While such thefts occur on a routine basis through hacked accounts and suborned insiders, financial institutions facilitate the move and maintain records. With stolen legal tender, even if the serial numbers were never recorded and are untraceable, one must move sums around, which can be difficult across borders or through airports.

Thus with the ease of movement, many wonder about how to solve the need for private keys to be readily available for legitimate Bitcoin transfers while minimising risk. Exchanges and other participants in the ecosystem typically rely on "hot" and "cold" wallets. A hot wallet contains Bitcoins (and potentially other cryptographically protected currency) in computer systems that are directly connected to the internet to perform routine transactions. Layers of intrusion prevention and encryption are meant to prevent keys in the hot wallet from being stolen, but, as we can see, it's a routine occurrence, though not an inherent flaw in the Bitcoin protocols. (With Mt Gox's recovered wallet, ostensibly a hot one, the firm having forgotten about the keys was as good as them being destroyed.)

Sensible exchanges and other virtual-currency businesses must balance having sufficient liquidity in their hot wallets against the potential of the entire contents of those wallets being stolen. Thus the cold wallet comes into play, in which USB sticks, removable hard drives, optical discs and the like are used. The Bitcoin keys are typically generated on non-networked equipment, sometimes on single-purpose address-management hardware that is increasingly coming on the market. Cold storage is much like currency kept in a bank vault, and thus the irony of using a safe-deposit box is exquisite. (Audio-based hacking has had its feasibility demonstrated recently, which may add another layer of concern.)

Those engaged with Bitcoins often maintain multiple copies of their private keys, which might exist in both hot and cold wallets, to provide a backup in case of a system crash or other trouble. Until a Bitcoin address is used in a transaction (which transfers all of the value out of it) multiple stored versions of the same private key exist in a sort of superposition of states like Schrödinger's Cat. Spending the coins (even if one gets change in return) collapses the waveform so that one transaction is the only true one, and the identical private keys, no matter how they are stored, lose their value at once. (The entire value of a Bitcoin address must be transferred at once, but for transactions less than the entire amount, the remaining change can be sent to another address.)

All media may be infected with viruses, and thus it is of extreme importance to use systems that have been checked out, including booting from a "live" CD or DVD, which cannot be modified. Some Bitcoin holders and firms go a step farther and backwards, using paper as cold storage, with the Bitcoin address generated by a device, like the Piper, that has never touched an online service.

The key data is stored as a QR Code, a 2D code that can be converted through a snapshot by a smartphone or other device. Snapping the picture on a networked phone makes the cold storage turn hot, more or less.

Of course, such cold storage is only secure as long as it remains locked up and away from prying eyes. A Bloomberg TV host discovered this when he held up Bitcoin gift certificates he'd purchased to give two anchors, and flashed the private keys' QR Codes. A Bitcoin user immediately used a freeze-frame to snap the codes and transfer them to one of his addresses, and then posted about it as a cautionary tale.