Fnalysis.
On-Chain Graffiti
Since July 30, 2026, the address tied to the attacker who drained Coldcard wallets has been receiving small payments with text messages permanently etched into the blockchain via Bitcoin's OP_RETURN function. Victims and onlookers started writing to the thief directly: "You stole, please return some," "Please Please Please," or a blunt "80% of my 5 BTC," according to CoinDesk, citing blockchain tracker Arkham Intelligence.
Among the messages was a money-laundering pitch aimed at the thief himself: "I clean btc, do kyc and cashout. I take 10%," signed with a Telegram handle, in what looks like an attempt to scam the scammer. Another user used the wallet's spotlight to ask for "1 BTC for my Bitcoin journey," unrelated to the hack, and someone else left straight-up poetry: "Monday owns my day, five plus ten bitcoin stranger, let me call in free."
Source: CoinDesk →The only one charging lower fees than an exchange is the thief himself.