Strangers are sending tiny Bitcoin payments carrying public messages to addresses holding 18,270 BTC stolen from Binance, turning the attacker-linked wallets into an unusual onchain message board. The 19 addresses have received pleas for money, token promotions, laundering suggestions and jokes while the original stolen Bitcoin remains largely stationary. One sender spent about $46 plus transaction fees repeating “Help me bro” three times across all 19 wallets.
The activity follows the October 29 Binance breach, which removed more than $6 billion in assets across multiple networks. The FBI formally attributed the theft to North Korea’s TraderTraitor activity on October 31, while Binance has said compromised operational infrastructure may have enabled unauthorized withdrawals. The 18,270 BTC represents only the Bitcoin component of the wider $6.3 billion incident. The broader breach and subsequent asset freezes were previously detailed in the $6.3 billion Binance security incident.
Micropayments Turn Bitcoin Transactions Into Messages
One participant sent 1,000 satoshis to each of the 19 addresses twice on Friday, followed by 1,111 satoshis per address early Sunday. Other transactions included advice directing the attacker toward cross-chain swapping infrastructure, a warning against accepting a whitehat agreement and a promotional pitch for an NST token ecosystem. None of the observed messages had received an identifiable response from the attacker as of November 2.
The messages use OP_RETURN, an unspendable Bitcoin transaction output that can carry arbitrary data. The text itself does not transfer Bitcoin: senders construct transactions containing both the data output and separate spendable outputs directed to the attacker-linked addresses. That means the messages can be permanently recorded onchain while the accompanying micropayments marginally increase balances controlled by the recipient.
The often-cited 80-byte OP_RETURN ceiling is now outdated as a description of Bitcoin Core’s default policy. Bitcoin Core 30.0 increased -datacarriersize to 100,000 bytes and permitted multiple data-carrier outputs, effectively leaving transaction-size policy as the practical default constraint. The change did not modify Bitcoin consensus, and individual nodes or miners can still apply more restrictive relay policies.
Similar public communication has appeared around other Bitcoin thefts, including attacker addresses connected to the Coldcard incident. That case later developed into a broader laundering trail involving THORChain and CoinJoin movements. Public blockchain data can expose both attacker fund movements and unsolicited communications sent toward those addresses without revealing who controls every participating wallet.
Stolen Assets Continue Moving Across Chains
While the 18,270 BTC remained divided across 19 addresses, other Binance-linked stolen assets continued moving. On Sunday, analysts tracked 970,522 SOL, worth approximately $96 million, entering a conversion route toward Bitcoin through Relay infrastructure. The movement illustrates how an attacker can shift assets away from chains or tokens where issuers and other intermediaries have stronger intervention capabilities.
That laundering pressure has become a recurring issue following major crypto thefts. Earlier investigations described North Korea-linked laundering networks moving stolen assets across multiple blockchains, while the separate Bitget incident raised questions around how permissionless cross-chain infrastructure handles attacker-linked funds. Observable cross-chain transfers make stolen funds traceable, but traceability does not automatically make transactions reversible or assets recoverable.
The messages sent to Binance attacker wallets ultimately represent a small financial footnote beside billions of dollars in stolen assets, but they demonstrate an unusual consequence of a public settlement layer. Anyone can address a known Bitcoin wallet through an onchain transaction, yet neither the message nor its permanence creates an obligation for the wallet controller to respond. In this case, the blockchain records the pleas, promotions and unsolicited advice alongside the micropayments sent to the very addresses investigators are trying to track.
