Coldcard hacker's $36 million bitcoin (BTC) wallet becomes a graffiti wall of pleas and hustles

The Coldcard hacker's bitcoin wallet has turned into a graffiti wall of pleas, poetry and scams, as victims and opportunists pay to leave permanent messages using Bitcoin's OP_RETURN function.

Coldcard hacker's $36 million bitcoin (BTC) wallet becomes a graffiti wall of pleas and hustles

Markets

"You stole, please return some." Coldcard hacker's wallet becomes a graffiti wall of pleas and hustles

A wallet holding $36 million in stolen bitcoin has become an unlikely public message board, as hack victims and opportunists pay to leave permanent notes for the thief.

By

Omkar Godbole

Updated

Aug 5, 2026, 5:30 a.m.

Published

Aug 5, 2026, 5:12 a.m.

2

min read

Make

preferred on

Share

Share this article

Copy link

X icon

X (Twitter)

LinkedIn

Facebook

Email

Make

preferred on

Coldcard hacker's wallet becomes a graffiti of pleas. (Eynoxart/Pixabay)

Summary

Show

A wallet tied to the Coldcard hacker has received several deposits since July 30, with some carrying written messages attached via Bitcoin's OP_RETURN function.

Messages range from genuine-sounding pleas for the money back to opportunistic pitches, including one offering to launder the stolen funds for a 10% cut.

"You stole, please return some."

That's one of

several messages

now sitting permanently on the Bitcoin blockchain, addressed to the wallet tied to the Coldcard hacker, which currently holds funds worth roughly $36 million. Each message arrives with a real, if tiny, payment attached.

The wallet in question is “

bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.

” It has been

identified by

blockchain researchers, including those at Galaxy Research, as one of the attacker-controlled addresses tied to the theft.

The address has taken in several deposits since the Coldcard theft began on July 30, with many of those transactions carrying written messages. Most are pleas to return the stolen money; others are performative, and at least one offers services to launder the stolen BTC.

This is as much a story about how the Bitcoin blockchain functions as it is about hack victims paying to convey their sentiments to the person who took their money.

That's because the ability to write messages is tied to a quirky Bitcoin feature called OP_RETURN, which lets anyone attach a small text string to a transaction. The text gets permanently timestamped into the blockchain alongside the transfer of money. The function exists for technical purposes; mainly, developers use it to timestamp documents or embed small proofs. That said, users can use the function to leave personal notes.

The Coldcard hardware wallet exploit, first detected on July 30, has snowballed into a major self-custody breach, with confirmed losses now topping $100 million.

What people are actually writing

The plea that opened this article isn't the only one. Several similar messages have surfaced, according to on-chain tracker Arkham Intelligence.

One reads "Please Please Please" alongside an address; another bluntly asks for "80% of my 5 BTC" back. Whether these come from genuine hack victims or opportunists capitalizing on the sympathy wave is difficult to verify.

Other messages are opportunistic rather than sympathetic.

One reads, "I clean btc, do kyc and cashout. I take 10%," complete with a Telegram handle — a laundering pitch hoping to land the hacker as a client. Another begs, "1 BTC for my Bitcoin journey,” which is entirely unrelated to the hack. The sender seems to be using the hacker wallet's spotlight to solicit money from strangers.

One message reads like abstract poetry: "Monday owns my day / five plus ten bitcoin stranger / let me call in free."

Not the first time

This isn't the first instance of users turning to OP_RETURN to message a thief.

During the 2020 LuBian mining pool theft, in which more than 127,000 BTC vanished, the pool's operators used OP_RETURN messages to attempt to contact the attacker directly and negotiate a return. Those messages later became one data point analysts used to help confirm which wallets belonged to LuBian versus the attacker.

What's happening on the Coldcard wallet is different. Reaching out to the hacker is a crowd: some hack victims, others opportunists, all immortalizing their messages on the ledger.

Bitcoin News

Latest Crypto News

1

New Ethereum proposal would cut issuance to zero if staked ETH reaches $112 billion

1 hour ago

2

Bitcoin flat at $64,000 as stocks print records and Hormuz deal nears

3 hours ago

3

SpaceX tops Wall Street revenue forecast, posts $540 million loss on bitcoin holdings

11 hours ago

4

Open USD rattled Circle's stock, but its key backers still support USDC

13 hours ago

5

Samsung is poised to become a dominant stablecoin distributor, analysts say

14 hours ago

6

Clarity Act sits idle over Trump ethics question as Warren asks SEC to investigate him

15 hours ago

7

Wells Fargo joins JPMorgan and Citi in the race to tokenize Wall Street’s settlement rails

16 hours ago

8

Bitcoin’s $63,000 zone emerges as key battleground for buyers: Glassnode

16 hours ago

9

Polymarket targets $20 billion valuation as competition heats up in prediction market sector

17 hours ago

10

Intesa Sanpaolo slashed IBIT stake by 94% in 2Q, tripled ether ETF holding as crypto prices slumped

17 hours ago

Latest Research

The Evolution of the Crypto CEX Landscape: A Case Study on Binance

The Evolution of the Crypto CEX Landscape: A Case Study on Binance

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

By

CoinDesk Research

Jun 29, 2026

Commissioned by

Binance

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

Why it matters

:

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

View Full Report

More From

Markets

Bitcoin flat at $64,000 as stocks print records and Hormuz deal nears

Bitcoin’s $63,000 zone emerges as key battleground for buyers: Glassnode

Polymarket targets $20 billion valuation as competition heats up in prediction market sector

Crypto

CD20

$1,748.64

CD20 up 0.42 percent

0.42%

BTC

$64,005.76

BTC up 0.60 percent

0.60%

ETH

$1,864.65

ETH up 0.14 percent

0.14%

XRP

$1.06

XRP down 1.18 percent

1.18%

SOL

$73.70

SOL up 0.12 percent

0.12%