A bitcoin address holding about $36 million in stolen funds has morphed into an unusual public noticeboard, as victims and opportunists alike pay small amounts to leave permanent messages for the hacker.
“You stole, please return some.”
That line is now immutably recorded on the Bitcoin blockchain—one of several notes aimed at the wallet tied to the Coldcard exploit. Each message is embedded in a transaction, meaning senders must attach a small payment to have their words preserved on-chain.
The address, “bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r,” has been identified by blockchain analysts, including Galaxy Research, as being controlled by the attacker. Since the breach began on July 30, it has received multiple deposits, many of which include attached messages. Most are appeals for the return of stolen funds, while others are opportunistic or self-promotional—including at least one offering to help launder the bitcoin.
The episode underscores a lesser-known Bitcoin feature called OP_RETURN, which allows users to attach short snippets of text to transactions. While primarily intended for technical uses like timestamping or embedding proofs, it can also be used to leave personal messages that are permanently recorded on the ledger.
The Coldcard exploit itself has escalated into a major self-custody breach, with confirmed losses exceeding $100 million.
The content of the messages varies widely. Some are straightforward pleas, such as “Please Please Please,” or requests for partial refunds like “80% of my 5 BTC.” It’s unclear whether all of these messages come from genuine victims or from opportunists trying to ride the wave of attention.
Others take a more transactional or opportunistic tone. One message reads, “I clean btc, do kyc and cashout. I take 10%,” complete with contact information—an apparent pitch for laundering services. Another simply asks for “1 BTC for my Bitcoin journey,” unrelated to the hack but leveraging the visibility of the wallet.
Some messages even border on the abstract, including one that reads: “Monday owns my day / five plus ten bitcoin stranger / let me call in free.”
This tactic isn’t entirely new. After the 2020 LuBian mining pool hack, operators used OP_RETURN messages to reach out to the attacker and attempt negotiations, leaving clues that later helped analysts distinguish between wallets.
What sets the Coldcard case apart is the scale and diversity of participation. Instead of a single party trying to contact the hacker, a wide range of users—from victims to opportunists—are now using the blockchain itself as a permanent canvas for appeals, pitches, and digital graffiti.
