You could bot up every server at AmaGooBookSoft and still not make an appreciable amount of money mining Bitcoin, though I suppose that is not true if you go to one of the scrypt altcoins. CPU mining is very uncompetitive. A CPU miner is upper bounded at about 100 mega-hash per second (100 * 10^6 hashes) and more typically closer to 5 * 10^6. 100 megahash per second is worth approximately two cents per month. My off-the-cuff estimate for AmaGooBookSoft is 300k servers, which gets you about $6k a month or $200 a day if you rooted all of them and they were the most effective CPUs ever reported for mining Bitcoin.

The far more likely way for this bug resulting in someone exfiltrating lots of bitcoins is them hitting every Bitcoin exchange looking for e.g. cPanel on a development box, Wordpress hosted on Nginx with fastcgi, etc etc. If they find one, they've got the hot wallet inside of five minutes later if it is on the same box, a bit more if it is somewhere else on the local network.

(I've got to admit, the first thing I did after patching my boxes, to relax about the stress, was grepping Bitcoin Core for system calls. No obvious ones that I could see, for what it is worth.)

If I can emphasize again, though: just because you don't engage in risky behaviors like e.g. transacting in bitcoins, doesn't mean your boxes are safe. Every. Server. On. The. Internet. Will be probed for a variety of exploits enabled by this vulnerability. There will be dozens of independently administered for loops probing for it within 24 hours.

This affects current systems which were up-to-date before yesterday, so I question your assertion that this only affects older systems.

I guess most personal routers do not ship with bash. This is what mine says:

# ls -l /bin/*sh

lrwxrwxrwx 1 root root 12 Feb 9 2014 /bin/ash -> /bin/busybox

lrwxrwxrwx 1 root root 12 Feb 9 2014 /bin/sh -> /bin/busybox

A 0 day means we don't know of it's existence, if it's been previous mentioned and people have failed to patch it then it isn't a 0-day anymore. The term comes from the "zero days to fix". Since we've had time to fix this problem, and failed to, it is no longer a 0-day. Hypothetically, third parties might have been safe from this if they fixed it independently.