Bitcoin graffiti wall
A Bitcoin wallet currently holding around $36 million in stolen cryptocurrency has transformed into an unexpected public forum. Victims of the Coldcard hack and other users have been paying small fees to leave written messages attached to transactions on the blockchain. These notes are directed at the unknown individual or group controlling the wallet, which is linked to the Coldcard hacking incident. The messages vary from heartfelt appeals for the return of stolen funds to outlandish attempts to profit from the situation.
Blockchain researchers, including those at Galaxy Research, have identified this wallet as one of the addresses controlled by the attacker. The unique identifier, 'bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r,' has been receiving deposits since the theft began on July 30. Each transaction includes a written message, made possible by a special Bitcoin protocol function called OP_RETURN.
OP_RETURN is primarily used for timestamping documents or embedding small proofs. However, in this case, it has turned into a platform for digital graffiti. Some messages are emotional pleas, while others are attempts to turn the situation into a business opportunity. The blockchain’s immutable nature ensures that these notes become a permanent part of the record.
What people are writing
One message reads, 'You stole, please return some.' This direct demand appears to come from a victim of the theft. Another message asks for '80% of my 5 BTC,' suggesting the sender may also have been a casualty. However, not all messages originate from individuals who have actually lost money.
One particularly bold message states, 'I clean BTC, do KYC and cashout. I take 10%,' with a Telegram handle attached. This is clearly an attempt to provide illicit services to the thief. Another, more cryptic message, says, '1 BTC for my Bitcoin journey,' which seems unrelated to the theft but cleverly piggybacks on the wallet’s visibility.
Some messages are even poetic in nature. One reads, 'Monday owns my day / five plus ten bitcoin stranger / let me call in free.' The meaning is open to interpretation, but it showcases how people are using the blockchain as a form of digital billboard. These notes, while varied in tone and intent, add a new dimension to the blockchain’s function.
Not the first time
This is not the first time users have used the blockchain to reach out to a thief. In 2020, during the LuBian mining pool theft involving over 127,000 BTC, the pool’s operators similarly used the OP_RETURN function to contact the perpetrator and try to negotiate the return of funds. Analysts later used these messages to help differentiate between the legitimate pool wallets and the attacker’s.
The Coldcard case is unique, however. It has become a public channel where both victims and opportunists post messages. The blockchain’s unchangeable nature ensures these notes remain permanently attached to the transactions, creating a kind of digital archive. The situation is still evolving, and the identity of the hacker remains unknown.
The Coldcard breach has grown into a serious security incident, with verified losses now surpassing $100 million. On-chain monitoring platforms like Arkham Intelligence are tracking the wallet’s activity, but the thief remains unidentified. As the situation unfolds, the blockchain continues to serve as both a financial ledger and a strange new form of public communication.
