- Published on
'You stole, please return some.' Coldcard hacker's wallet becomes a graffiti wall of pleas and hustles
- Authors
- Name
- DeepHorus
A bitcoin wallet holding $36 million in stolen funds has become an unlikely public message board, as hack victims and opportunists pay tiny amounts to attach permanent notes to the thief. The wallet, tied to the Coldcard hacker, has received several deposits since July 30, with messages ranging from genuine pleas to outright hustle pitches. One simply reads: "You stole, please return some."
The Coldcard hardware wallet exploit, first detected on July 30, has snowballed into a major self-custody breach, with confirmed losses now topping $100 million. Blockchain researchers, including those at Galaxy Research, identified the address bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r as attacker-controlled. The address has taken in deposits carrying written messages attached via Bitcoin's OP_RETURN function, which permanently timestamps text into the blockchain.
Most messages are pleas for the return of funds. One reads "Please Please Please" alongside an address; another bluntly asks for "80% of my 5 BTC" back. But whether these come from genuine victims or opportunists capitalizing on the sympathy wave is difficult to verify. At least one message offers to launder stolen bitcoin for a 10% cut, complete with a Telegram handle. Another begs "1 BTC for my Bitcoin journey," entirely unrelated to the hack, using the wallet's spotlight to solicit money from strangers.
The ability to write these messages comes from a quirky Bitcoin feature. OP_RETURN lets anyone attach a small text string to a transaction, permanently recording it alongside the transfer of value. The function was designed for technical purposes, such as timestamping documents, but users have repurposed it for personal notes. Each message arrives with a real, if tiny, BTC payment attached.
The impact extends beyond the wallet owner. Coldcard users who lost funds are watching their messages become permanent artifacts, while the public gains a raw look at desperation and opportunism in crypto. Arkham Intelligence has tracked the messages, noting that most are pleas, while others are performative or poetic. One reads like abstract poetry: "Monday owns my day / five plus ten bitcoin stranger / let me call in free."
This is not the first time OP_RETURN has been used to contact a thief. During the 2020 LuBian mining pool theft, where more than 127,000 BTC vanished, operators used OP_RETURN messages to negotiate directly with the attacker. Those messages later became key data points for analysts confirming wallet ownership. For Coldcard, this open channel may not recover the $36 million, but it creates a forensic trail and a permanent, public record.
Looking ahead, the messages could aid investigators and highlight Bitcoin's transparency paradox. The blockchain lets anyone speak to an anonymous thief, yet the thief remains pseudonymous and under no obligation to reply. This incident also underscores the rising stakes of self-custody breaches, as hardware wallet exploits grow more costly and victims turn to blockchain graffiti as a last resort.
