TLDR
- Strangers are sending tiny bitcoin payments with notes to 19 wallets holding 18,270 stolen BTC.
- The coins have not moved since Thursday, and none of the messages have drawn a response.
- The notes use a Bitcoin feature called OP_RETURN, which stores up to 80 bytes of text on the blockchain permanently.
- Attackers drained about $6.3 billion from Binance on October 29, and the FBI has attributed the theft to North Korea’s TraderTraitor group.
- Binance paused withdrawals, will use its SAFU fund and reserves to cover losses, and about $3 billion in assets have been frozen.
Strangers are sending tiny bitcoin payments with messages to the wallets holding coins stolen from Binance. The notes range from pleas for money to token promotions.
Strangers are sending the Binance hacker tiny bitcoin payments carrying on-chain messages that beg for a share of the loot.
The 19 wallets holding 18,270 stolen BTC haven't moved since Thursday. One sender spent about $46 plus fees to send "Help me bro" three times to every… pic.twitter.com/2a0FiC3czi
— Jessica Gonzales (@lil_disruptor) November 2, 2026
The 19 wallets hold 18,270 BTC. The coins have not moved since Thursday, but the addresses keep receiving payments worth less than a dollar.
How the Messages Work
Bitcoin lets a sender attach a short note to a transaction using an output type called OP_RETURN. It writes up to 80 bytes of data into the blockchain.
Once a block confirms the note, it stays on the blockchain permanently. Each sender must also make a payment to leave one.
One sender wrote “Help me bro” three times since Friday. The sender paid 1,000 satoshis, about 78 cents, to each wallet on Friday at 11:43 UTC and again at 16:03 UTC.
A third round of 1,111 satoshis each followed early Sunday, a CoinDesk analysis found. The sender spent about $46 in bitcoin plus fees.
Another message told the hacker to use a link to swap funds and never return them to CZ. The link points to a page made to look like a THORChain swap site.
THORChain is the network the attacker has already used to move stolen funds. It halted trading on 10 of its 13 chains over the weekend.
A self-described Turkish crypto influencer pitched his own token. He asked that donations go toward developing the token ecosystem.
Early Saturday, someone wrote “Happy Hacklloween Satoshis for treats PLS.” None of the messages have drawn a response.
The Binance Theft
On October 29, 2026, attackers drained about $6.3 billion in digital assets from Binance hot wallets across several blockchains. The bitcoin portion was 18,270 BTC, worth about $1.4 billion at the time.
The coins left a Binance hot wallet in 11 transactions confirmed in block 973,732. They were then split across 19 addresses, with 17 holding exactly 1,000 BTC each.
TRM Labs and Chainalysis point to a high probability that North Korea’s TraderTraitor group carried out the attack. The FBI has attributed the theft to the group.
Binance said it will use its Secure Asset Fund for Users and company reserves to cover customer losses. The exchange has paused all withdrawals while it investigates.
About $3 billion in assets tied to the breach have been frozen with help from law enforcement. Binance was also hit in 2019, when about 7,000 BTC was stolen.
On Sunday, the attacker began swapping 970,522 stolen SOL, worth about $96 million, into bitcoin through the bridge Relay.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
