I spent some time messing with Bitcoin libraries, not an expert by any means. Generating a new private key (and the corresponding address) is trivial. Generatin

I spent some time messing with Bitcoin libraries, not an expert by any means. Generating a new private key (and the corresponding address) is trivial. Generating a transaction is a bit less trivial, but not that hard. As far as I understand, you don't need a change address to send the money to another, the change can go straight back to the original address. Random example: https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354061abcdcd6962936ddcf890974fbae5 https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354... So all that mess with the deterministic change addresses is simply due to the laziness of the developers, who didn't bother to generate addresses and transactions using relatively simple crypto, and instead chose to use the existing software, which they didn't really understand. On the other hand, if the servers were hacked, almost nothing would help them. They should have kept most of their deposits in cold storage.