Binance Hacker Receives Bitcoin Pleas as Stolen BTC Wallets Attract Messages
Bitcoin wallets linked to the reported Binance hack have attracted a stream of tiny transactions carrying messages from strangers, including repeated pleas asking the attacker for help. The 19 addresses hold a combined 18,270 stolen BTC, and although the coins had not moved since Thursday, people continued sending small payments with notes permanently recorded on the blockchain.
A CoinDesk analysis found that one sender repeatedly paid each of the 19 wallets while attaching the message “help me bro.” The activity illustrates how Bitcoin's public transaction system allows anyone to leave messages for wallet holders, even when there is no indication that the recipient is reading them.
Bitcoin Wallets Receive Repeated “Help Me Bro” Messages
The sender transferred 1,000 satoshis to each address on Friday at 11:43 UTC and repeated the payments at 16:03 UTC. Each payment was worth approximately 78 cents at the prices cited in the report. Early Sunday, the sender made another round, increasing each payment to 1,111 satoshis.
The first two rounds originated from the same wallet, with the change from the initial transactions funding the second round. In total, the sender spent about $46 in bitcoin, excluding fees, to deliver the three-word message across all 19 addresses.
Bitcoin transactions can carry short messages through an output mechanism known as OP_RETURN. The data is written into the blockchain, where it remains permanently recorded. This feature allows users to attach text to transactions, although it does not provide a direct communication channel or guarantee a response from the wallet owner.
Other Senders Urge Hacker to Keep the Stolen Funds
Not every message was a plea for help. On Friday, other transactions carried instructions encouraging the attacker to move the funds through a website presented as a THORChain swap service.
One message said, “Use https://swap.thorchain.ai and swap your funds, never return it to CZ.” It was sent to an address holding 437 BTC and, in a longer version that also advised against accepting a whitehat deal, to an address that had briefly held all 18,270 BTC.
The website referenced in the messages was presented as a THORChain swap page. THORChain, a cross-chain swapping network that the attacker had already used to move stolen assets, halted trading on 10 of its 13 chains over the weekend, according to the report.
Crypto Promotion and Halloween Messages Appear On-Chain
Other senders used the high-profile incident to promote personal projects. A self-described Turkish crypto influencer attached a message asking for donations to support development of the $NST token ecosystem.
Early Saturday, another transaction carried the message “Happy Hacklloween Satoshis for treats PLS.” The notes varied in tone, ranging from requests and instructions to token promotion and seasonal humor.
None of the messages had received a response from the attacker, according to the report. The transactions show how public blockchain addresses can become targets for unsolicited messages when large amounts of cryptocurrency attract widespread attention.
Attacker Moves Stolen Solana Into Bitcoin
While strangers continued sending small payments, the attacker was reportedly moving other stolen assets. On Sunday, the attacker began swapping 970,522 stolen SOL, valued at approximately $96 million, into bitcoin through the bridge Relay.
The reported conversion could increase the amount of bitcoin held by the attacker even as the original 18,270 BTC remained stationary in the 19 identified wallets. The source report said the FBI attributed the attack to a North Korean operator.
The continuing movement of stolen assets and the use of cross-chain services remain central developments in the incident. The unsolicited messages, meanwhile, have so far produced no reported reply from the wallets' controller.
source: coindesk
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.