The 18,270 BTC stolen from Binance has not moved since the theft. The wallets holding it, however, have developed an active social life.
Strangers keep sending the hacker tiny Bitcoin payments, each worth less than a dollar and each carrying a short note. Some ask for a share of the funds. Others promote tokens. The result is a public comment section attached to one of the largest thefts the industry has recorded.
How the messages work
The notes ride on a Bitcoin feature called OP_RETURN. It is an output type that lets a sender attach up to 80 bytes of data to a transaction — enough for a sentence or two — and once a block confirms it, the note stays on the blockchain permanently.
There is an irony in the mechanics: to leave a note, each sender has to make a payment. The people asking the hacker for Bitcoin are, technically, handing the hacker Bitcoin first.
How the coins got there
On October 29, attackers drained approximately $6.3 billion in digital assets from Binance hot wallets across several blockchains.
The Bitcoin portion came to about 18,270 BTC, worth roughly $1.4 billion at the time of the theft. It left a Binance hot wallet in 11 transactions, all confirmed in Bitcoin block 973,732.
From there the coins were split across 19 addresses. Seventeen of them hold exactly 1,000 BTC each, while the remaining two hold the balance. As of early October 30, none of those 19 wallets had made a further transaction.
Blockchain intelligence firms TRM Labs and Chainalysis, along with an FBI statement, point to a high probability that North Korea's TraderTraitor hacking group carried out the attack. The FBI has attributed the theft to the group.
Binance has said it will use its Secure Asset Fund for Users, known as SAFU, along with company reserves to cover customer losses. The exchange has also paused all withdrawals while it investigates the breach and works to secure its platform. Roughly $3 billion in assets tied to the breach have been frozen with help from law enforcement.
Traceable, but not freezable
The $3 billion figure shows how unevenly recovery works across chains. Issuer-controlled tokens can be restricted by the platforms behind them. Bitcoin has no such off switch.
The 18,270 BTC is therefore fully visible and fully out of reach. Anyone can watch the 19 addresses in real time — which is exactly how strangers found them to send messages — but nobody can stop the coins from moving if the holder decides to move them.
Binance has been here before, at a smaller scale. Its 2019 hack resulted in the theft of about 7,000 BTC. This time, the Bitcoin portion alone is far larger, and it is just one slice of a multi-chain theft.
What it means for customers
For Binance customers, the most immediate issue is not the messages. It is the withdrawal pause. Until the exchange lifts it, users cannot pull funds out, regardless of how solid the SAFU backstop turns out to be.
The SAFU pledge matters for confidence, but the arithmetic is worth watching. About $3 billion of the approximately $6.3 billion is frozen. The rest, including the parked Bitcoin, depends on reserves, recovery efforts, or both.
The OP_RETURN messages are a sideshow, but a revealing one. They show how public Bitcoin's ledger really is: a holder can keep the coins but cannot hide where they are, and cannot stop strangers from adding notes alongside them. Those notes are now a permanent part of Bitcoin's history, attached to the addresses tied to the theft.
