WORLDTECHBinance hacker's frozen Bitcoin stash attracts pleading messages from strangers
Wallets linked to the hack of Binance, the cryptocurrency exchange based in the United Arab Emirates, have turned into a public message board. Strangers are sending the hacker small Bitcoin payments, each worth less than a dollar, with notes attached, and some of those notes ask for a share of the stolen funds.
How the coins moved after the theft
According to the reporting, attackers drained approximately $6.3 billion in digital assets from Binance hot wallets across several blockchains on October 29, 2026. The Bitcoin portion left one Binance hot wallet through 11 transactions, all confirmed in block 973,732, and was then divided among 19 addresses.
As of early October 30, none of those 19 wallets had made a further transaction, the report states.
Attribution and Binance's response
Blockchain intelligence firms TRM Labs and Chainalysis, together with an FBI statement, assess it as highly probable that North Korea's TraderTraitor hacking group carried out the attack, and the FBI has linked the theft to that group.
Binance says it will draw on its Secure Asset Fund for Users, known as SAFU, and company reserves to cover customer losses. It has also paused all withdrawals while it investigates the breach and secures its platform. Roughly $3 billion in assets tied to the breach has been frozen with help from law enforcement.
Notes attached to micro-payments
Strangers have been sending the hacker Bitcoin payments of less than a dollar each, with short messages embedded through OP_RETURN, a Bitcoin feature that lets a sender attach up to 80 bytes of data to a transaction. Once a block confirms such a note, it remains on the blockchain permanently.
There is an irony in the exercise: each sender must make a payment to leave a note, so people asking the hacker for Bitcoin are, technically, sending it Bitcoin first. Some of the messages plead for a cut of the loot.
Why the stolen coins remain out of reach
The episode shows how unevenly recovery works across chains. Issuer-controlled tokens can be restricted by the platforms behind them, whereas the 18,270 BTC in the wallets is fully visible yet beyond reach. Anyone can watch the 19 addresses in real time, which is how the strangers found them.
Open questions
- Will the roughly $3 billion frozen with law enforcement be returned to customers or authorities?
- When will Binance resume withdrawals?