coindesk.com
“Help me bro.”
Someone has sent the Binance hacker that message three times since Friday, on each of the 19 wallets holding 18,270 stolen $BTC. The coins haven’t moved since Thursday, but the addresses keep getting tiny payments worth less than a dollar, each carrying a note from a stranger.
Bitcoin lets a sender bolt a short note onto a transaction through an output type called OP_RETURN, which writes up to 80 bytes permanently into the blockchain.
The “help me bro” sender paid 1,000 satoshis (about 78 cents at current prices) to each wallet on Friday at 11:43 UTC, again at 16:03 UTC, then 1,111 satoshis each early Sunday, a CoinDesk analysis found.
The first two rounds came from one wallet, with the change from the first paying for the second. All told, the sender spent about $46 in bitcoin plus fees to deliver a three-word plea to a thief who, by the FBI’s account, works for North Korea.
Others had a different idea.
Twice on Friday, a payment landed on the hacker’s wallets carrying the message “Use https://swap.thorchain.ai and swap your funds, never return it to CZ,” once on the 437 $BTC address and once, in a longer version that added the hacker should never accept a whitehat deal, on the address that briefly held all 18,270 $BTC.
The link points to a page dressed up as a THORChain swap site. THORChain — the cross-chain swap network the attacker has already used to move the stolen funds — halted trading on 10 of its 13 chains over the weekend.
Meanwhile, some enterprising adults took the chance to market their products. A self-described Turkish crypto influencer attached a pitch for his own token, asking that “any donations you send will go toward developing the $NST token ecosystem.”
Early Saturday, someone wrote “Happy Hacklloween Satoshis for treats PLS.”
Despite the efforts, none of these messages have drawn a response, and the hacker’s bitcoin pile is growing instead. On Sunday, the attacker began swapping 970,522 stolen SOL, worth about $96 million, into bitcoin through the bridge Relay.
