“You stole, please return some.”
Those words are now etched permanently into the Bitcoin blockchain, one of a handful directed at the wallet connected to the Coldcard hacker. Roughly $36 million in funds currently sits in that wallet. Each of these notes came attached to an actual payment, no matter how tiny the amount.
The address in question is “bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.” Researchers tracking the blockchain, Galaxy Research among them, have flagged it as one of the addresses under the attacker’s control in connection with the theft.
Multiple deposits have landed at the address since the Coldcard theft kicked off on July 30, and a good number of them carried written text. The bulk of them beg for the stolen money to be sent back. Some are pure theater. And at least one is a straight-up business proposal, offering to wash the stolen BTC.
Why you can write on a stranger’s wallet at all
These notes are possible thanks to an oddball Bitcoin function known as OP_RETURN, which allows anybody to bolt a short text string onto a transaction. That text is then permanently timestamped onto the chain right alongside the money moving.
Technical use cases are the reason the function was built. Timestamping documents and embedding small proofs are the typical developer applications. Yet there’s no barrier preventing anyone from scribbling personal notes instead, which is precisely what has unfolded here.
The result is a story as much about the mechanics of the Bitcoin blockchain as it is about hack victims spending money for the privilege of telling their robber exactly how they feel.
The breach behind the messages
The Coldcard hardware wallet exploit came to light on July 30. What followed has ballooned into one of the biggest self-custody failures on record, with verified losses now above $100 million.
The sheer size of the incident accounts for all the traffic arriving at the attacker’s address. The whole point of buying a hardware wallet is avoiding the need to trust an exchange, so when that device becomes the weak link, avenues for recovery evaporate quickly. Scrawling on the blockchain is the last option standing.
Reading the wall
The appeal that opened this piece has plenty of company. On-chain tracking firm Arkham Intelligence has spotted several comparable notes.
“Please Please Please” appears in one, paired with an address. A different one flatly requests “80% of my 5 BTC” back — phrasing that sounds less like an ultimatum than the first move in a negotiation.
Sorting the genuine victims from the opportunists riding the sympathy wave is nearly impossible. That’s the awkward reality of a public ledger: the chain records whatever anyone writes and has no way of knowing who’s honest.
The hustlers showed up too
Sympathy is nowhere to be found in some of these notes.
“I clean btc, do kyc and cashout. I take 10%,” reads one, Telegram handle included. It’s a money-laundering advertisement broadcast on-chain, angling to sign the hacker as a customer.
Then there’s the pleading “1 BTC for my Bitcoin journey,” a message with zero connection to the breach. Whoever sent it seems to be piggybacking on the spotlight aimed at the hacker’s wallet to beg from passersby.
And one entry lands somewhere near abstract verse: “Monday owns my day / five plus ten bitcoin stranger / let me call in free.”
It’s happened before, but not like this
Messaging a thief through OP_RETURN has precedent.
Back in the 2020 LuBian mining pool theft, where over 127,000 BTC disappeared, operators of the pool turned to OP_RETURN messages in an attempt to reach the attacker and broker a return of the coins.
Those notes wound up doing double duty. Down the line, analysts leaned on them as one of the signals for determining which wallets were LuBian’s and which belonged to the thief.
What sets the Coldcard case apart matters. LuBian amounted to a single operator bargaining with a single thief. This time there’s a mob — victims and opportunists alike — each one carving their message into a ledger that will outlive the news cycle.
Anyone curious about what a $100 million self-custody collapse looks like from the inside should skip the incident reports. Load up bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r and go through the transaction messages chronologically. The desperation, the grifting and the haiku are all sitting there, bought with satoshis, permanent.