A CoinDesk analysis has found that strangers are using Bitcoin's public ledger to send direct messages to the wallets holding the 18,270 BTC stolen from Binance, with one sender repeatedly paying each of the 19 addresses while attaching the note "help me bro." The activity illustrates how Bitcoin's open transaction system allows anyone to leave messages for wallet holders, even when there is no indication that the recipient is reading them.

One Sender Pays All 19 Wallets Three Times

The sender transferred 1,000 satoshis to each address on Friday at 11:43 UTC and repeated the payments at 16:03 UTC. At the prices cited in the report, each payment was worth approximately 78 cents. Early Sunday, the sender made another round, increasing each payment to 1,111 satoshis.

The first two rounds originated from the same wallet, with the change from the initial transactions funding the second. In total, the sender spent about $46 in bitcoin, excluding fees, to deliver the three-word message across all 19 addresses. The outlay shows how cheaply anyone can attach a lasting public note to even the most closely watched wallets in crypto.

Bitcoin transactions can carry short messages through an output mechanism known as OP_RETURN. The data is written into the blockchain, where it remains permanently recorded. The feature allows users to attach text to transactions, although it does not provide a direct communication channel or guarantee a response from the wallet owner.

Other Senders Urge the Hacker to Keep the Stolen Funds

Not every message was a plea for help. On Friday, other transactions carried instructions encouraging the attacker to move the funds through a website presented as a THORChain swap service.

One message said, "Use and swap your funds, never return it to CZ ." It was sent to an address holding 437 BTC and, in a longer version that also advised against accepting a whitehat deal, to an address that had briefly held all 18,270 BTC.

THORChain, a cross-chain swapping network that the attacker had already used to move stolen assets, halted trading on 10 of its 13 chains over the weekend, according to the report. The weekend halt showed how cross-chain swapping services can become directly entangled in high-profile thefts once stolen funds move through them.

Token Promotion and Halloween Messages Appear On-Chain

Other senders used the high-profile incident to promote personal projects. A self-described Turkish crypto influencer attached a message asking for donations to support development of the $NST token ecosystem.

Early Saturday, another transaction carried the message "Happy Hacklloween Satoshis for treats PLS." The notes varied in tone, ranging from requests and instructions to token promotion and seasonal humor.

None of the messages had received a response from the attacker, according to the report. The transactions show how public blockchain addresses can become targets for unsolicited messages when large amounts of cryptocurrency attract widespread attention.

Attacker Reportedly Moves Stolen Solana Into Bitcoin

While strangers continued sending small payments, the attacker was reportedly moving other stolen assets. On Sunday, the attacker began swapping 970,522 stolen SOL, valued at approximately $96 million, into bitcoin through the bridge Relay.

The reported conversion could increase the amount of bitcoin held by the attacker even as the original 18,270 BTC remained stationary in the 19 identified wallets. The source report said the FBI attributed the attack to a North Korean operator.

The continuing movement of stolen assets and the use of cross-chain services remain central developments in the incident. Because the 19 bitcoin addresses are publicly known, any movement of the 18,270 BTC would be visible on the shared ledger. Open questions include whether the SOL-to-BTC conversion through Relay continues, whether THORChain restores trading on its suspended chains, and whether any of the on-chain messages eventually draw a reply from the wallets' controller.

Source: CoinDesk

Originally published by Hokanews. Writer: Ethan Collins.