I'm pretty sure that stealing hundreds of thousands of dollars worth of a "thing", regardless of what that "thing" is, is a federal offense thanks to CFAA, if nothing else.

It depends. By design (for plausible deniability) the key is not a password, it's a mathematical fact which can be independently discovered.

If you generated weak keys then it's not theft for me to guess/calculate them and allocate those coins to myself.

This is why BTC is described as proving the strength of hash functions, etc. If it was easy to cheat, someone would claim the public bug bounty by giving themselves all the coins. Because they haven't, we have a fairly good minimum bound on the difficulty.

> If it was easy to cheat, someone would claim the public bug bounty by giving themselves all the coins.

But giving yourself all the coins means demonstrates that the system doesn't work conclusively, and guarantees that no one will accept the coins for goods and services, so while giving yourself "all the coins" destroys a lot of value, it doesn't actually capture any value. So, if you wanted to profit from an exploit you developed, you would not do that (if you wanted to discredit bitcoin and had developed the exploit, you would do that.)

Right, they'd trickle them in to keep it secret. But that doesn't change the bug-bounty nature.

It changes the (paraphrased) "we can tell its secure because no one has visibly compromised for profit it the way they would if they could" nature you suggested uphtread, because, for profit, you would avoid visibly compromising it.

The attempt to rob a bank, even a failed attempt as most are = federal prison. You don't need to steal hundreds of thousands of dollars from a bank for it to become a federal case, which was my original point.