A theft-proof way can be to avoid the anonymizing features of Bitcoin, that's it, by having the return address (for change in a transaction) being the same as t

A theft-proof way can be to avoid the anonymizing features of Bitcoin, that's it, by having the return address (for change in a transaction) being the same as the origin address. That way you can simply monitor the blockchain for every player's single Bitcoin address, without having any private key. Any transaction from those accounts should be explicitly initiated by the player, and for that you show QR codes in the game.