Not the same thing as dust
Chapter 9 covered "dust" — a UTXO so small that the fee to spend it would cost more than it's worth. Dust is real, spendable coin; it's just not worth the trouble to move right now. This chapter is about something categorically different: coins that no living person can move at all, regardless of how much the fee would cost, because whatever is needed to authorize a spend — a private key, a password, a piece of paper — no longer exists anywhere.
Chapter 8 put it plainly: owning bitcoin reduces to being able to produce a valid signature, full stop, with no bank-style recourse if that ability disappears. This chapter is what happens when it does.
How a coin actually becomes unspendable
There's no "delete" button in Bitcoin and no customer-service line to call. A coin becomes permanently unspendable one of a few concrete ways:
The private key is lost. A hard drive fails with no backup. A seed phrase is thrown out, water-damaged, or simply forgotten. The most-cited real example: in 2013 an early miner named James Howells accidentally discarded a hard drive holding the private keys to roughly 8,000 BTC he'd mined years earlier, and it went to a landfill in Newport, Wales. He has spent years, and multiple failed legal efforts, trying to get permission to excavate and search for it. The coins are still there, in the sense that the blockchain still shows them as an unspent, valid UTXO — they're just permanently out of reach unless that specific hard drive is found and still readable.
The key is locked behind a forgotten password. Stefan Thomas, an early Bitcoin developer, has a hardware device (an IronKey) holding the keys to about 7,002 BTC, encrypted with a password he wrote down and then lost. The device permanently wipes itself after ten wrong guesses; as of widely reported accounts he had used eight. Unlike a bank password reset, there is no "forgot password" flow for a private key — the encryption doesn't care who's asking.
The output's script cannot be satisfied. Bitcoin allows outputs that are valid to create but impossible to spend under the script rules. A scriptPubKey beginning with OP_RETURN is one example; Bitcoin Core v29.0's CScript::IsUnspendable() explicitly recognizes it. This is different from a handmade-looking burn address: the appearance of an address does not prove that no usable private key can exist. A typo alone does not establish script-level unspendability either.
The owner is gone and never told anyone. A person who self-custodied bitcoin and died without leaving instructions, a password manager, or an inheritance plan for their keys leaves those coins in the same state as a lost hard drive — technically still assigned to a valid address, practically unreachable forever.
Counterparty's 1CounterpartyXXXXXXXXXXXXXXXUWLpVr address illustrates the address-based case. As discussed in El Khatib and Legout's Bitcoin Burn Addresses, it was deliberately constructed to make a corresponding usable key computationally infeasible to find. That is not proof that no corresponding private key can exist. The paper reports 3,197.61 BTC across addresses classified as burn addresses through block 840,682 (April 24, 2024), using manual review and machine learning. Section 2.1.2 explicitly cautions that address unspendability is a probability claim, not a mathematical proof. The total is not a census of OP_RETURN outputs or all lost coins, and this site has not independently reproduced it. The lost-Bitcoin reference page explains these evidence categories separately.
There is no "forgot password" flow for a private key. The math that makes Bitcoin unconfiscatable makes it exactly as unrecoverable.
The one nobody can confirm: Satoshi's coins
The largest single presumed-lost stash is also the most famous: blocks mined in Bitcoin's first year, widely attributed by on-chain analysis to Satoshi Nakamoto, commonly estimated around 1,000,000 BTC, that have never moved since they were mined. "Presumed" is the right word and worth sitting with — nobody can prove those coins are lost rather than simply held. The private keys could, in principle, still exist and be used tomorrow; Bitcoin's ledger has no way to distinguish "the keys are gone forever" from "the owner is patiently holding and hasn't transacted in over fifteen years." Both look identical on-chain: an unspent output that hasn't moved. That ambiguity is the honest state of almost every dormant balance discussed in this chapter, Satoshi's included — treat any specific figure attached to it as a widely repeated estimate, not a verified fact.
What's known, and what's genuinely just estimated
Because "lost" and "dormant" look identical on the ledger, nobody — not a company, not a researcher, not this book — can state a precise, provable figure for how much bitcoin is truly gone versus simply untouched in cold storage for a long time. What outside researchers and blockchain-analysis firms do is estimate, using heuristics like coins that have never moved since a specific early year, or that sit at addresses with characteristics (very early software, no known exchange association) that fit a lost-coin pattern more than an active-holder pattern. Different methodologies land in different places, but a range commonly cited across several years of this kind of research clusters in the low millions of BTC — genuinely a meaningful fraction of the roughly 19.7 million-plus BTC issued through recent years (the audited figure from Chapter 7), though nobody should treat any single number here as more precise than "estimate."
A decimal point is not a guarantee of certainty. A reported balance can be precise while the classification of its keys as lost remains uncertain. The comparison page distinguishes inferred burn addresses, lost-key estimates and dormant-supply figures; none should be substituted for a verified total of all lost coins.
What this does to the real supply
Chapter 1 derived the 21 million cap as a limit on how much bitcoin can ever be issued — the geometric series the protocol enforces on new coin creation. That cap says nothing about how much of the issued total remains reachable by anyone. Lost coins don't get "returned" to the schedule, recycled, or reissued; the protocol has no concept of reclaiming an output whose key is gone. They just sit, forever, as valid, immovable entries in the ledger, permanently subtracting from the effective, tradeable supply without ever subtracting from the 21 million issuance figure itself.
That distinction — issued supply versus effectively spendable supply — matters beyond bookkeeping. A later chapter on why Bitcoin's price moves the way it does returns to this exact point: a thinner pool of actually-circulating coins, on top of an already-fixed issuance schedule, is part of what makes the tradeable market smaller than the headline "coins issued" number suggests.
The same feature, both directions
It's worth closing on the symmetry rather than treating this as purely a cautionary tale. The property that makes a lost coin unrecoverable — no authority, no override, no master key that can reassign an output to a new owner — is the identical property that makes Chapter 7's audit trustworthy in the first place: nobody, including Satoshi, including any government, including this site, can move a coin without its actual private key, full stop. A system that let someone override that rule to "rescue" a lost coin would be a system where that same override could confiscate or reassign anyone else's coin too. The permanence is not a bug alongside the security; it is the security, and the loss described in this chapter is the cost that comes bundled with it.