A wallet associated with a hacker has transformed into an unexpected platform for messages, as victims of theft and others pay to leave notes for the perpetrator.
Victims and Opportunists Leave Messages on a $36 Million Stolen Bitcoin Wallet
Since July 30, a wallet that contains approximately $36 million in stolen bitcoin has become a public message board, with various individuals submitting messages that accompany their deposits.
One message reads, "You stole, please return some," as part of several communications now permanently inscribed on the Bitcoin blockchain. Each of these messages is linked to a small payment, highlighting the emotional pleas from victims.
The wallet in question, identified by blockchain analysts including those from Galaxy Research, is bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r. Since the theft was detected on July 30, it has received multiple deposits, many of which include written messages. Most are heartfelt requests for the return of the stolen funds, while others are opportunistic pitches, including one that offers to launder the stolen bitcoin for a 10% fee.
This phenomenon illustrates not just how the Bitcoin blockchain operates but also how victims are using it to express their feelings towards the thief.
The ability to attach messages to transactions is made possible by a unique Bitcoin feature known as OP_RETURN, which allows users to add a small text string to a transaction. This text is permanently recorded on the blockchain alongside the financial transaction, primarily intended for developers to timestamp documents or embed proofs. However, it has also been utilized for personal messages.
The exploit involving the Coldcard hardware wallet, first identified on July 30, has escalated into a significant breach of self-custody, with reported losses exceeding $100 million.
Examples of Messages Being Sent
The opening plea is just one of many similar messages that have emerged, according to Arkham Intelligence, which tracks on-chain activity.
One individual wrote, "Please Please Please" alongside a bitcoin address, while another directly requests, "80% of my 5 BTC" back. It remains unclear whether these messages are from genuine victims or opportunists looking to exploit the situation.
Some messages are more self-serving. For instance, one states, "I clean btc, do kyc and cashout. I take 10%,” along with a Telegram handle, indicating an offer to launder the funds. Another plea states, "1 BTC for my Bitcoin journey,” seemingly unrelated to the hack and appears to be an attempt to solicit funds from the hacker's audience.
One message stands out for its poetic style: "Monday owns my day / five plus ten bitcoin stranger / let me call in free."
A Recurring Theme in Crypto Theft
This scenario is not unprecedented; users have previously used OP_RETURN to communicate with thieves. For example, during the 2020 LuBian mining pool theft, where over 127,000 BTC was lost, operators attempted to contact the hacker through OP_RETURN messages to negotiate a return of the funds. Those messages later served as evidence in identifying which wallets belonged to the LuBian operation versus the attacker.
However, the current situation with the Coldcard wallet is different. It features a multitude of voices—some victims, some opportunists—all leaving their messages on the blockchain.