Mentioned in This Article
1. What are strangers sending to the Binance hacker wallets?
Strangers are sending messages to the wallets that hold 18,270 stolen BTC from the Binance theft. Nineteen addresses have received only payments under one dollar since Thursday, October 29, each with a text note attached. The most persistent reads "Help me bro," and its sender has delivered it to every wallet three times since Friday, October 30.
The coins themselves have not moved since Thursday, October 29. That makes the small deposits the only visible activity on the addresses, apart from the later conversion of a different stolen asset, which is covered below. The FBI has said the person behind the theft works for North Korea, which gives the whole episode an unusual tone: anonymous strangers are appealing to an alleged state-linked thief through the one channel the blockchain leaves open to everyone.
None of the notes has drawn a reply. The senders range from someone hoping for a handout to someone offering a route for cleaning the money, and from a promoter advertising a token to a person joking about Halloween. Taken together they read as a snapshot of how a public ledger turns a major crime scene into a place where anyone can leave a message.
2. How can a payment worth less than a dollar carry a message?
The mechanism is a feature of the Bitcoin protocol called OP_RETURN. It lets a transaction include an output that carries up to 80 bytes of arbitrary data, which is enough for a short sentence. The data is not spendable value. It is simply written into the transaction and, once the transaction is confirmed in a block, it becomes a permanent part of the blockchain record that anyone can read.
OP_RETURN was designed so that people could attach small pieces of information, such as timestamps or document fingerprints, to bitcoin transactions without cluttering the set of spendable outputs. In practice it also serves as a graffiti wall. Because the message travels with the transaction, a sender only needs to pay the network fee and send a minimal amount of bitcoin to the target address for the note to appear next to it.
The amounts involved here show how cheap the exercise is. The "help me bro" payments were 1,000 satoshis per wallet, a satoshi being one hundred-millionth of a bitcoin. At prevailing prices, 1,000 satoshis is roughly 78 cents. A later round sent 1,111 satoshis to each wallet. Sending to all 19 addresses therefore costs a few dollars at most, which explains why the messages are cheap enough for any curious or desperate person to send.
3. Who is behind the "help me bro" notes?
The identity of the sender is unknown, but the transaction trail points to a single person acting alone. The first payment round landed on Friday at 11:43 UTC, with 1,000 satoshis going to every one of the 19 wallets. A second round followed the same day at 16:03 UTC. A third arrived early on Sunday, November 1, this time at 1,111 satoshis per wallet.
The first two rounds came from one wallet, and the change left over from the first round paid for the second. The total outlay across those two rounds was about $46, plus network fees. That is a trivial sum next to the value sitting in the targeted addresses, which hold 18,270 BTC, yet it is also a deliberate, repeated effort rather than a one-off joke.
The wording is blunt and informal, a direct request to a thief that costs the sender almost nothing and has almost no chance of working. Messages like this tend to reflect a mix of motives, from genuine hope that a windfall might be shared to simple curiosity about whether anyone on the other end is watching. No reply has come back, and nothing on the chain suggests the recipient is reading.
4. What do the other messages say?
Other senders chose different pitches. On Friday, two payments carried a message urging the holder to run the stolen funds through a THORChain web address and to avoid ever returning them to "CZ," the common nickname of Binance co-founder Changpeng Zhao. One of those notes went to the address holding 437 BTC. A longer version, which also warned against accepting a whitehat deal, was sent to the address that briefly held the entire 18,270 BTC.
That web address is not a genuine THORChain swap interface. The page it leads to imitates the look of a swap site, which suggests the message may be a lure rather than good-faith advice. The framing matters because THORChain is a cross-chain trading network, and the attacker had already used it to move part of the stolen money. Over the weekend, THORChain halted trading on 10 of its 13 chains.
A third message came from a self-described Turkish crypto influencer, who used the channel to promote his own token, "$NST," and asked that any donations go toward supporting its ecosystem. The pitch is a reminder that any highly visible address attracts attention-seekers, and that a note recorded permanently on the chain is a form of free advertising for whoever pays the small fee.
A fourth note arrived early on Saturday, October 31, and was Halloween-themed. It asked for "treats." Of the messages described, it is the lightest, and it too went unanswered.
5. Why do people write to a thief who never answers?
Public messages to wrongdoers are not new on Bitcoin. Addresses tied to large thefts, ransom demands and well-known holdings regularly attract notes, because the transaction format makes it so easy. The senders know the chance of a response is close to zero. The appeal lies in the act itself: it is a way to take part in a high-profile event, and the note stays on the ledger indefinitely.
Some senders are motivated by hope, however remote. A person who sees an eight-figure or nine-figure balance sitting idle may reason that a one-dollar appeal costs nothing, and that the holder might be generous. Others use the opportunity for attention, as the token promoter did, or for mischief, as the Halloween request suggests. A smaller group, such as the author of the laundering advice, may have intentions that are more deliberate and less harmless.
The practical risk lies with readers rather than with the thief. A message that points to a web address can steer a curious visitor to a page built to look like a legitimate service. Anyone who follows links found in on-chain notes, or connects a wallet to a site promoted this way, exposes themselves to the same kind of fraud that the notes seem designed to promote. The safest approach is to treat such messages as noise and to verify any service through official channels before using it.
6. Why can the stolen coins be seen but not touched?
The situation highlights a basic property of public blockchains. Every transaction and every balance is visible to anyone, so the stolen bitcoin can be watched in real time, and so can the messages attached to it. Visibility does not translate into control, however. Bitcoin has no administrator who can reverse a transfer or lock an address, which means the coins stay under the control of whoever holds the private keys.
Because of that, the public nature of the ledger works in two directions. It allows investigators, analysts and curious onlookers to follow the funds, flag addresses and warn exchanges. It also lets anyone, including opportunists, interact with those addresses. The same open design that makes tracing possible makes it impossible to stop a stranger from sending a one-line note to a thief.
For ordinary users, the practical lesson concerns transparency and trust. A theft on this scale cannot be hidden, and each step the thief takes becomes part of a permanent record. The messages are not a meaningful part of the story in themselves, but they show how long a stolen balance can remain a public spectacle, with the chain acting as both evidence and bulletin board.
Exchanges, compliance teams and analytics firms follow the same public data. When a large balance is visible, they can compare incoming and outgoing flows against lists of flagged addresses and decide whether to accept deposits from related wallets. That monitoring is the main practical tool available against a thief who cannot be stopped at the protocol level, and it depends on the funds eventually moving toward a venue that can say no.
7. What is the attacker doing with the funds now?
While strangers leave notes, the attacker has been busy with other assets. On Sunday, the thief began converting 970,522 stolen SOL, worth about $96 million, into bitcoin through the bridge Relay. A bridge of this kind lets a holder swap value from one blockchain to another, and the move shows the attacker consolidating stolen holdings into bitcoin.
The effect is that the pile of bitcoin is growing even as the original 18,270 BTC sits idle. The conversion also follows the attacker's earlier use of THORChain, which suggests a pattern of relying on cross-chain swap services to shift value between networks. The FBI's attribution of the theft to North Korea frames those steps as the work of a state-linked operation rather than an opportunistic individual.
The coins in the 19 wallets have not been spent, but the activity around them has not stopped. The next moves to watch are whether the attacker begins to shift the original bitcoin, whether further conversions through bridges and swap networks follow, and whether anyone responds to the notes. For now, the only traffic reaching the stolen bitcoin is a stream of sub-dollar payments, each with a message that nobody has answered.