I feel the malware/login explanations are much less likely because it looks like code attempting to ‘hide in plain sight’ to me. You wouldn’t need to use Sha256(address) or block hash or txid or merkleroot if you were malware or an unauthorized login. You would at least salt or obscure the key with some bit of knowledge only you know so that only you could derive the private key (as mentioned earlier).

The author would be surprised at how many malwares are coded by script kiddies and how the ‘hide in plain sight’ is a common occurence.

This was a really fun read! Thanks for sharing.

I’d recommend this article to any Lobster with even a passing interest in cryptocurrency.