Summary
- A wallet tied to the Coldcard hacker has received several deposits since July 30, with some carrying written messages attached via Bitcoin's OP_RETURN function.
- Messages range from genuine-sounding pleas for the money back to opportunistic pitches, including one offering to launder the stolen funds for a 10% cut.
“You stole, please return some.”
That's one of several messages now sitting permanently on the Bitcoin blockchain, addressed to the wallet tied to the Coldcard hacker, which currently holds funds worth roughly $36 million. Each message arrives with a real, if tiny, payment attached.
The wallet in question is “bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.” It has been identified by blockchain researchers, including those at Galaxy Research, as one of the attacker-controlled addresses tied to the theft.
The address has taken in several deposits since the Coldcard theft began on July 30, with many of those transactions carrying written messages. Most are pleas to return the stolen money; others are performative, and at least one offers services to launder the stolen BTC.
This is as much a story about how the Bitcoin blockchain functions as it is about hack victims paying to convey their sentiments to the person who took their money.