A bitcoin address holding roughly $36 million in stolen funds has turned into an unusual public forum, as victims and opportunists alike send small transactions to attach permanent messages for the hacker.

“You stole, please return some.”

That message now lives on the Bitcoin blockchain, one of many aimed at the wallet linked to the Coldcard exploit. Because each note is embedded in a transaction, users must include a small payment to have their words recorded permanently.

The address—“bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r”—has been identified by blockchain analysts, including Galaxy Research, as belonging to the attacker. Since the breach began on July 30, it has received multiple deposits, many carrying messages. Most are appeals for the return of funds, while others are opportunistic or promotional, including at least one offering laundering services.

The episode highlights a lesser-known Bitcoin feature called OP_RETURN, which allows short pieces of text to be embedded in transactions. While originally intended for technical functions like timestamping data, it also enables users to leave messages that become a permanent part of the blockchain.

The Coldcard exploit has since escalated into a major self-custody breach, with confirmed losses exceeding $100 million.

The messages themselves vary widely. Some are direct pleas, such as “Please Please Please,” or requests to recover a portion of lost funds like “80% of my 5 BTC.” It’s unclear how many come from genuine victims versus opportunists trying to capitalize on the situation.

Others are more self-serving. One message reads, “I clean btc, do kyc and cashout. I take 10%,” including contact details—an apparent attempt to offer laundering services. Another asks for “1 BTC for my Bitcoin journey,” unrelated to the hack but taking advantage of the attention around the wallet.

A few messages veer into the abstract, including one that reads: “Monday owns my day / five plus ten bitcoin stranger / let me call in free.”

This approach isn’t new. After the 2020 LuBian mining pool hack, operators used OP_RETURN messages to contact the attacker and attempt negotiations, leaving a trail that later helped analysts distinguish wallets.

What sets the Coldcard case apart is the scale and open participation. Rather than a single party reaching out, a broad mix of users—victims, opportunists, and observers—are turning the blockchain into a permanent record of pleas, pitches, and digital graffiti.