Coldcard Hacker's $36M Wallet Becomes Blockchain Message Board

The $36 Million Graffiti Wall

Confirmed losses from the Coldcard breach now top $100 million, making it a major self-custody breach. Yet what's unusual isn't just the scale of the theft—it's what's happened to the attacker-controlled wallet since.

The wallet has taken in several deposits since the Coldcard theft began, with many transactions carrying written messages. This is possible because of OP_RETURN, a Bitcoin feature that lets anyone attach a small text string to a transaction. The text gets permanently timestamped into the blockchain alongside the transfer of money.

Blockchain researchers, including those at Galaxy Research, have identified the hacker-controlled wallet address. This transparency has opened a channel—however one-sided—between the thief and the world.

Pleas, Performative Posts, and Laundering Pitches

Most messages are pleas to return the stolen money; others are performative, and at least one offers services to launder the stolen BTC.

Victims have left direct appeals. One message reads "Please Please Please" alongside an address. Another bluntly asks for "80% of my 5 BTC" back.

Then there are the hustlers. One message reads, "I clean btc, do kyc and cashout. I take 10%," complete with a Telegram handle—a laundering pitch hoping to catch the thief's eye.

A Precedent: The 2020 LuBian Theft

This isn't the first time OP_RETURN messages have been weaponized in a heist. During the 2020 LuBian mining pool theft, in which more than 127,000 BTC vanished, the pool's operators used OP_RETURN messages to attempt to contact the attacker directly and negotiate a return.

Several similar messages have surfaced on the Coldcard hacker's wallet, according to on-chain tracker Arkham Intelligence. Whether any of them will move the thief to act remains an open question. For now, the blockchain is simply recording every plea, every pitch, and every desperate attempt to reach someone who's chosen silence.