Binance hacker’s frozen-in-place Bitcoin stash is drawing begging notes and token shills

The 18,270 BTC stolen from Binance has not budged since Thursday. The wallets holding it, however, have developed an active social life.

Strangers keep sending the hacker tiny Bitcoin payments, each worth less than a dollar and each carrying a short note. Some plead for a cut of the loot. Others promote tokens. It is the blockchain version of a celebrity’s comment section, except the celebrity is an alleged state-backed thief.

A ransom note in reverse

The mechanism is a Bitcoin feature called OP_RETURN. Think of it as the memo line on a check, except the memo gets carved into a public ledger that nobody can erase.

On the technical side, OP_RETURN is an output type that lets a sender attach up to 80 bytes of data to a transaction. That leaves room for a sentence or two. Once a block confirms it, the note stays on the blockchain permanently.

There is an irony baked into the whole exercise. To leave a note, each sender has to make a payment. The people asking the hacker for Bitcoin are, technically, handing the hacker Bitcoin first.

How the coins got there

On October 29, 2026, attackers drained approximately $6.3 billion in digital assets from Binance hot wallets across several blockchains.

The Bitcoin portion came to about 18,270 BTC, worth approximately $1.4 billion at the time of the theft. It left a Binance hot wallet in 11 transactions, all confirmed in Bitcoin block 973,732.

From there, the coins were split across 19 addresses. Seventeen of them hold exactly 1,000 BTC each. The remaining two hold the balance.

As of early October 30, none of those 19 wallets had made a further transaction.

Blockchain intelligence firms TRM Labs and Chainalysis, along with an FBI statement, point to a high probability that North Korea’s TraderTraitor hacking group carried out the attack. The FBI has attributed the theft to the group.

Binance has said it will use its Secure Asset Fund for Users, known as SAFU, along with company reserves to cover customer losses. The exchange has also paused all withdrawals while it investigates the breach and works to secure its platform. Roughly $3 billion in assets tied to the breach have been frozen with help from law enforcement.

Traceable, not freezable

That $3 billion figure shows how unevenly recovery works across chains. Issuer-controlled tokens can be restricted by the platforms behind them. Bitcoin has no such off switch.

The 18,270 BTC is therefore fully visible and fully out of reach. Anyone can watch the 19 addresses in real time, which is exactly how strangers found them to send messages. Nobody can stop the coins from moving if the holder decides to move them.

Binance has been here before, at a smaller scale. Its 2019 hack resulted in the theft of about 7,000 BTC. This time, the Bitcoin portion alone is far larger, and it is just one slice of a multi-chain theft.

What this means

For Binance customers, the most immediate issue is not the begging notes. It is the withdrawal pause. Until the exchange lifts it, users cannot pull funds out, regardless of how solid the SAFU backstop turns out to be.

The SAFU pledge matters for confidence, but the arithmetic is worth watching. About $3 billion of the approximately $6.3 billion is frozen. The rest, including the parked Bitcoin, depends on reserves, recovery efforts, or both.

The OP_RETURN messages are a sideshow, but a revealing one. They show how public Bitcoin’s ledger really is. A thief can hold the coins, but cannot hide where they are, and cannot stop strangers from scrawling on the walls.

Those notes are now a permanent part of Bitcoin’s history. Long after this case is resolved, the pleas and token pitches will still be sitting in the blocks, attached to one of the largest thefts the industry has recorded.