“You Stole It—Give Some Back”: Coldcard Hacker Wallet Flooded With Messages

A bitcoin wallet holding roughly $36 million in stolen funds has unexpectedly turned into a public message board, with victims and opportunists alike paying small fees to leave permanent notes for the hacker.

“You stole, please return some.”

That message is now etched into the Bitcoin blockchain, one of many directed at the address linked to the Coldcard exploit. Each note is embedded in a transaction, meaning senders must attach a small amount of bitcoin to have their words recorded.

The wallet—“bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r”—has been flagged by blockchain analysts, including Galaxy Research, as belonging to the attacker. Since the hack began on July 30, the address has received multiple incoming transactions, many carrying messages. Most plead for the return of stolen funds, while others are opportunistic or even promotional, with at least one offering laundering services.

The phenomenon highlights a lesser-known feature of Bitcoin known as OP_RETURN, which allows users to attach short text data to transactions. While originally designed for technical uses like timestamping or embedding proofs, it has increasingly been used to leave personal messages—permanently recorded on-chain.

The Coldcard exploit itself has grown into a major self-custody breach, with confirmed losses now exceeding $100 million.

The messages vary widely in tone and intent. Some are desperate appeals, such as “Please Please Please” or requests for partial refunds like “80% of my 5 BTC.” It’s unclear whether all of these come from actual victims or from opportunists trying to capitalize on the situation.

Others take a different angle. One message advertises, “I clean btc, do kyc and cashout. I take 10%,” complete with contact details—an apparent attempt to offer laundering services to the hacker. Another simply asks for “1 BTC for my Bitcoin journey,” unrelated to the hack but leveraging the attention around the wallet.

A few messages even veer into the surreal, including one that reads like poetry: “Monday owns my day / five plus ten bitcoin stranger / let me call in free.”

This isn’t the first time OP_RETURN has been used to communicate with hackers. Following the 2020 LuBian mining pool theft, operators used similar messages to reach out to the attacker and attempt negotiations, leaving a trace that later helped analysts identify associated wallets.

What’s different this time is the scale and nature of participation. Instead of a single entity trying to contact the hacker, a crowd has emerged—some seeking restitution, others chasing visibility—turning the blockchain into a permanent record of appeals, pitches, and digital graffiti.