Nineteen Bitcoin wallets tied to the Binance theft have become a public message board on-chain. The addresses hold 18,270.2 BTC in total, worth about $1.41 billion based on a Nov. 3 morning price of roughly $77,220, and none of that Bitcoin has moved so far. What has arrived instead are 77 small inbound transfers and 59 messages from strangers.
Some asked for money. Some promoted tokens. Some told the hacker not to send the funds back to Binance. According to the report, there has been no response from the hacker.
FBI list named the 19 Bitcoin addresses
The 19 addresses came from a list published by the U.S. Federal Bureau of Investigation. In an alert issued on Oct. 31 U.S. time, the FBI attributed the theft to the North Korean hacking group TraderTraitor, said the amount stolen exceeded $6 billion, and disclosed 19 Bitcoin addresses.
Most messages were requests for money
BlockTempo grouped the 59 messages by purpose and found that requests for money were the largest category, followed by messages urging the hacker to switch into other coins.
The most persistent message was 「help me bro」. It was sent in three rounds: at 7:43 p.m. on Oct. 30 to 18 wallets, at 12:03 a.m. on Oct. 31 to 19 wallets with 1,000 satoshis each, and again at 9:38 a.m. on Nov. 1 to 19 wallets with 1,111 satoshis each. All three rounds used the same funding source. The total came to about $45, or about $49 including fees.
The biggest spender was a sender who attached a long text. Around midday on Oct. 30, that person sent two batches containing 12 identical messages, each 5,391 bytes long. The text argued that dental amalgam should be banned worldwide, said the sender's family was close to becoming homeless, and asked the hacker for help. It ended with a PGP public key for contact. Fees on those 12 transactions alone totaled 75,402 satoshis, or about $58.
Promotional messages also showed up. A person describing himself as a Turkish crypto influencer left three messages on the morning of Oct. 30, including one asking the hacker to put donations into his $NST token ecosystem. Another sender pushed a crc-20 Bitcoin lending protocol by sending one message to each of 17 wallets, opening with the line 「bitcoin is the best collateral on earth」.
How text gets into a Bitcoin transaction
The report said Bitcoin transactions can include an output type called OP_RETURN, which allows text to be inserted into a transaction and written permanently to the blockchain. Anyone can read it, and it cannot be removed.
No permission from the wallet owner is needed to leave such a message. But if the sender wants the message to appear in the target wallet's transaction history, an actual transfer has to be made. That is why these messages came with tiny payments ranging from a few hundred to more than a thousand satoshis. The largest amount sent to a single wallet in one transaction was 2,277 satoshis, about $1.76.
Bitcoin remains untouched, but the Solana address is still active
There has been no outgoing transaction from any of the 19 Bitcoin wallets. The hacker has not replied. Other assets linked to the case are still moving, though.
On-chain analytics account Lookonchain said at 6:35 p.m. on Nov. 1 that the hacker was converting 970,522 SOL, then worth about $95.9 million, into Bitcoin through the cross-chain protocol Relay. The Solana address involved was the only Solana address on the FBI list.
Relay said in a post on X at 11:30 p.m. on Nov. 2 that some transactions and routes could be paused or delayed because it was trying to stop Binance-related stolen funds from moving through Relay and was working with Binance and law enforcement.
Solana on-chain records cited in the report showed that transfers from the address slowed after the announcement but did not stop. At 9:37 a.m. on Nov. 3, the address sent out another roughly 14,000 SOL. As of 9:50 a.m., about 399,000 SOL remained, worth around $36.9 million at roughly $92.5 per token, with about 59% already moved out in total.
FBI asked the industry to block related transactions
The FBI has asked the industry to block transactions that interact with these addresses or are derived from them. The report added that such activity could later be flagged by exchange risk-control systems.
