Samourai Domain Hijack: A $6.4M Seized Reserve vs. New Scam Flows

The scam vector is now live. The domain of Samourai Wallet has been hijacked by criminals who are using it to host a phishing site. This fake site, complete with the wallet's branding, is actively designed to steal Bitcoin from unsuspecting users.

This immediate theft contrasts sharply with a massive, dormant reserve. The U.S. government holds nearly $6.4 million worth of Bitcoin seized from the Samourai developers. Crucially, this reserve has not been liquidated and will be added to a national Bitcoin fund.

The mechanics show a clear split: real-time theft via a compromised domain versus a frozen, strategic asset held by the state.

Contextualizing the Theft: A Drop in the Bucket

The immediate theft from the hijacked domain is a real loss, but its scale is dwarfed by institutional flows. Last week, Bitcoin ETFs saw their strongest weekly inflow in months, adding 20,685 BTC to holdings. This represents a massive, legitimate channel for capital moving into the asset.

That institutional inflow is over 100 times the scale of the average ransomware payment. In 2025, total on-chain ransomware payments stagnated at $820 million. The Samourai scam, while malicious, operates in a different economic stratum than these systemic, market-moving flows. The bottom line is one of relative magnitude. While the domain hijack is a security failure, the flow of capital through regulated ETFs continues to accelerate, setting a new high watermark for Bitcoin's institutional adoption.

Catalysts and Risks: The Real Flow Watchpoints

The real price catalysts are institutional flows, not domain hijacks. Watch Bitcoin ETF daily inflows and Open Interest for sustained demand. The recent surge to 20,685 BTC in a single week set a new high watermark. Sustained weekly inflows above 10,000 BTC signal a powerful, structural shift in capital allocation.

Monitor ransomware payment flows and Initial Access Broker (IAB) activity as lagging indicators of broader cybercrime. While total on-chain ransomware payments stagnated at $820 million in 2025, spikes in IAB inflows typically precede ransomware activity by about a month. This makes IAB data a useful, if delayed, signal for potential future extortion flows.

The bottom line is to track the big money. Institutional ETF flows are the primary driver of Bitcoin's price action. Cybercrime flows, while a persistent risk, are a secondary, high-frequency noise that can be monitored for early warnings of increased network activity or regulatory crackdowns.