Coldcard: Why Are Users Sending On-Chain Messages to the Hacker's Address?

‍

A Bitcoin address linked to the recent Coldcard theft has unexpectedly transformed into an active public bulletin board that will be visible on the Bitcoin network forever. 

Rather than simply tracking the movement of stolen funds, on-chain analysts using Bitcoin explorers like Arkham are now watching a stream of communications sent directly to the hacker's wallet using the Bitcoin network's OP_RETURN function.

For context, the OP_RETURN function allows users to attach small amounts of arbitrary data to a Bitcoin transaction. Bitcoin users are using this feature to permanently add messages onto the blockchain, addressed directly to the thief. 

(Note: The OP_RETURN function was used by Arkham sleuths to discover the LuBian mining pool theft, which ended up being an inside job anyway. More on that story here.)

‍

‍

A Chaotic Public Forum

The messages range from desperate to absurd. 

Here are some of the most recent OP_RETURN messages with links to the transaction on Arkham: 

1. Request 1 BTC for my Bitcoin journey. Thank you!
2. Please Please Please bc1qyzupd4m046z0s98skkc0zkw2umsuhdvantsctj
3. you stole, please return some bc1q4fhhu308lr7a20ma4y2j7vrc5e83pf0f8rygp2
4. monday owns my day / five plus ten bitcoin stranger / let me call in free
5. „He who has nothing has nothing to lose, but he who steals loses himself.“
6. I clean btc, do kyc and cashout. I take 10%. Telegram@sandalwood214

How to View These Messages on Arkham

You can monitor this activity in real-time using Arkham. By searching for the hacker's address, you can view the complete transaction history and inspect the raw data attached to incoming transfers.

1. Navigate to the hacker's address on Arkham: https://arkm.com/explorer/address/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r
2. Scroll through the recent incoming transactions on the address dashboard.
3. Expand the transaction details (by clicking on the blue timestamp next to each transaction) to view the OP_RETURN data where the messages are permanently stored.

Tracking this address provides a unique look into the social dynamics that can occur on a public ledger. You can continue to use Arkham to monitor the wallet for further messages and any potential movement of the stolen funds.