The 19 wallets holding 18,270 stolen bitcoins have seen no outgoing transfers since Thursday, only receiving tiny transfers worth less than $1 each, every one carrying a message ranging from pleas for help and money-laundering advice to token promotions.
"Help me, bro." Since last Friday, someone has sent this same message three times to each of the 19 wallets holding 18,270 stolen bitcoins.
Since Thursday, those bitcoins have not been moved, but the relevant addresses keep receiving tiny transfers worth less than $1, each accompanied by a message from a stranger.
Bitcoin allows senders to attach short messages to transactions through a transaction output type called OP_RETURN. This method can permanently write up to 80 bytes of data onto the blockchain.
Analysis found that at 11:43 UTC last Friday, one sender transferred 1,000 satoshis (the smallest unit of bitcoin, worth about $0.78 at current prices) to each wallet, along with the message "Help me, bro." At 16:03 that day, the same sender again transferred 1,000 satoshis to each wallet, and early Sunday morning sent 1,111 satoshis to each wallet for a third time. The first two rounds of transfers came from the same wallet, with the change generated by the first round used to pay for the second round. Overall, this sender spent about $46 worth of bitcoin plus extra transaction fees just to send this three-word plea to the hacker who stole Binance's assets.
Others had different ideas. Last Friday, the hacker's wallets twice received transfers with the following message: "Use this website to exchange your funds, never return the money to CZ (Binance founder Changpeng Zhao)." One transfer went to an address holding 437 bitcoins, while the other went to an address that had briefly held all 18,270 bitcoins. The latter carried a longer message that also advised the hacker never to accept a whitehat deal (in crypto security incidents, project teams sometimes offer attackers an agreement allowing them to keep part of the stolen assets as a reward in exchange for returning the rest). The link pointed to a page disguised as a THORChain token exchange website. THORChain is a cross-chain exchange network that attackers had previously used to move stolen funds. Over the weekend, THORChain suspended trading on 10 of the 13 blockchains it supports.
Meanwhile, some commercially minded people also took the opportunity to pitch their own products. A crypto influencer claiming to be from Turkey attached a message promoting his own token and said: "Any donation you send will be used to develop the $NST token ecosystem." Early last Saturday, someone else left a message saying: "Happy Hacklloween, please give me some satoshis as candy."
Despite all these efforts, none of the messages received a response. Instead, the amount of bitcoin held by the hacker continued to grow. On Sunday, the attacker began using the cross-chain bridge Relay to exchange 970,522 stolen SOL tokens, worth about $96 million, into bitcoin.
Comments