{
  "id": 160421,
  "title": "\"You stole, please return some.\" Coldcard hacker's wallet becomes a graffiti wall of pleas and hustles",
  "url": "https://urgent.news/2026/08/05/you-stole-please-return-some-coldcard-hackers-wallet-becomes-a",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-08-05T05:12:46.000Z",
  "source": {
    "name": "CoinDesk",
    "slug": "coindesk",
    "url": "https://www.coindesk.com/markets/2026/08/05/you-stole-please-return-some-coldcard-hacker-s-wallet-becomes-a-graffiti-wall-of-pleas-and-hustles"
  },
  "original_language": "en",
  "account": "The Bitcoin blockchain now hosts a series of messages, addressed to the wallet linked to the Coldcard hacker, which presently holds funds valued at approximately $36 million. Each message comes with a real payment attached, albeit minuscule. This wallet, identified as \"bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r,\" has been flagged by blockchain analysts, including those at Galaxy Research, as one of the addresses controlled by the attacker during the theft. Since the Coldcard theft commenced on July 30, the address has accumulated multiple deposits, many of which are accompanied by written messages. These messages predominantly express pleas for the return of the stolen funds; others serve as performative actions, and at least one offers services to launder the stolen BTC. This situation underscores not only the peculiarities of the Bitcoin blockchain but also the plight of its victims who resort to paying to communicate their sentiments to the perpetrators. The ability to write messages is facilitated by a feature within Bitcoin known as OP_RETURN, which permits individuals to append a brief text string to a transaction. This data becomes permanently recorded within the blockchain, alongside the exchange of funds. Initially designed for technical purposes such as timestamping documents or embedding small proofs, the function has found its way into personal communication. The Coldcard hardware wallet breach, detected on July 30, has escalated into a significant self-custody incident, with losses now exceeding $100 million. The plea featured in this article is not unique. Several similar messages have emerged, as per on-chain tracker Arkham Intelligence. One message reads \"Please Please Please\" alongside an address; another simply requests \"80% of my 5 BTC\" back. The authenticity of these messages remains uncertain, as it is unclear whether they originate from genuine victims of the hack or opportunists exploiting the wave of sympathy. Other messages are opportunistic in nature, rather than empathetic. One reads, \"I clean btc, do kyc and cashout. I take 10%,\" accompanied by a Telegram handle, essentially offering to launder the hacker's stolen BTC. Another message humbly asks, \"1 BTC for my Bitcoin journey,\" which is unrelated to the hack and appears to leverage the hacker's notoriety to solicit funds from strangers. One message even takes on an abstract quality: \"Monday owns my day / five plus ten bitcoin stranger / let me call in free.\" This scenario is not the first instance of users employing OP_RETURN to contact a thief. During the 2020 LuBian mining pool heist, in which over 127,000 BTC were stolen, the pool's operators utilized OP_RETURN messages to attempt contact with the attacker and negotiate the return of funds. These messages later served as a data point for analysts to differentiate between wallets belonging to the LuBian pool versus the attacker. The current situation on the Coldcard wallet differs in that it has transformed into a collective effort: some victims of the hack, others opportunists, all immortalizing their messages on the ledger. Binance, currently the leading cryptocurrency exchange, continues to expand its services, incorporating non-fungible tokens (NFTs), payments, savings, yield, and broader financial offerings.",
  "summary": "A wallet holding $36 million in stolen bitcoin has become an unlikely public message board, as hack victims and opportunists pay to leave permanent notes for the thief.",
  "key_points": [
    "Bitcoin wallet receives pleas and hustles from Coldcard hacker",
    "Messages attached to $36 million wallet via OPRETURN feature",
    "Situaton highlights Bitcoin's unique communication capabilities"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}