- if we are saying many people should benefit from the dig, surely there should be a limit on clam clients on how many addresses they can dig, daily or over the lifetime
I don't think this point was fully addressed in SuperClam's answer.
Note that the CLAM client is open source. Any limit we put in the client could easily be changed or removed.
There is no network consensus rule about "digs per client per day", and there cannot be, because it is impossible to tell clients apart from each other.
To spend an initial-distribution output all you need to do is sign a transaction that spends it. Each initial-distrubition output was created using the BTC (or LTC, or DOGE) address' public key, and so to spend it you need the corresponding private key.
Any exploit that is able to spend other people's initial-distribution CLAMs on the CLAM blockchain would also be able to spend their BTC on the BTC blockchain, since exactly the same mechanism is used in both cases.
Yesterday I spent some time looking at the BTC addresses which were "dug" recently. I fed them into
https://www.walletexplorer.com/ which calls itself a "Bitcoin block explorer with address grouping and wallet labeling". The idea is that for each BTC address you give it, it tells you which site's hot wallet the address is in.
It was unable to identify the wallet of very many of the dug addresses I tried. It was only able to identify the wallet of about 1% of the addresses I looked up, and in every case it identified them as being in the BetVIP.com wallet. BetVIP appears to have
launched in March 2014 and
shut down in June 2015.
Here's a video of its founder talking
in April 2015, claiming (at 0:30) that it officially launched in June 2014. I guess it's possible that their hot wallet was stolen by or sold to the digger, or that someone from BetVIP is the digger.
It seems unlikely that a relatively unknown site that launched just 2 months before (or one month after) the CLAM snapshot could have received 3% of the CLAM distribution, and so it remains a mystery where the bulk of the addresses have come from.
I'm not sure how accurate or complete walletexplorer.com is, but I would expect it to have shown up at least one hit on the MtGox or BTC-e wallets if it was them who were digging...
