Graffiti News

A stolen bitcoin address has turned into a public message board

Since the Coldcard hardware wallet exploit was first detected on 30 July 2026, strangers have been leaving written messages on a bitcoin address identified as controlled by the attacker. According to CoinDesk, the address holds roughly 36 million dollars in bitcoin and has taken in several deposits since 30 July, many of them carrying short written notes. Blockchain researchers including those at Galaxy Research identified it as one of the attacker-controlled addresses tied to the theft. CoinDesk reported that confirmed losses from the Coldcard breach now top 100 million dollars.

How do you write on somebody else's wallet?

The messages are written using a bitcoin feature called OP_RETURN. As CoinDesk explains, OP_RETURN lets anyone attach a small text string to a transaction, and the text is permanently timestamped into the blockchain alongside the transfer of money. It exists for technical purposes, mainly so developers can timestamp documents or embed small proofs, but people can also use it to leave personal notes.

The part that matters is that it is not free. CoinDesk reported that each message arrives with a real, if tiny, payment attached. To write on this surface, you have to send the person who took your money a little more of it.

What is written on the wall

The messages, tracked by the on-chain service Arkham Intelligence, do not share a single tone. CoinDesk quoted several of them.

• "You stole, please return some." A direct plea.
• "Please Please Please", left alongside an address.
• "80% of my 5 BTC", a request for most of a specific holding back.
• "I clean btc, do kyc and cashout. I take 10%", a laundering pitch complete with a Telegram handle.
• "1 BTC for my Bitcoin journey", unrelated to the hack, using the attention on the address to ask strangers for money.
• "Monday owns my day / five plus ten bitcoin stranger / let me call in free", which reads like abstract poetry.

CoinDesk noted that whether these come from genuine victims or from opportunists riding a wave of sympathy is difficult to verify.

Why this looks like graffiti

What has accumulated on this address resembles writing on a wall in several specific ways.

First, it is written on a surface the writer does not own. Nobody leaving a message controls that address, and nobody asked.

Second, it addresses one person and is read by everyone. The notes are aimed at the thief, but the actual audience is whoever looks at the chain. Most short writing on street walls works the same way.

Third, it costs something. On the street the price is paint and risk. Here it is a fee and a small transfer. Surfaces that cost nothing to write on do not accumulate this kind of writing in this way.

Fourth, it mixes. A desperate plea, a sales pitch, an unrelated request for money and one piece of unattributed poetry sit in the same place. That is what actually happens at a wall people know about.

Where it stops resembling a wall

The difference may matter more than the resemblance. Walls get erased. Councils paint over them, owners scrub them, the next person writes on top. Street writing exists on the assumption that it will disappear, which is exactly why photographing it means something.

Writing on a blockchain does not get painted over. CoinDesk described OP_RETURN messages as permanently timestamped alongside the transaction. Nobody has yet watched, over a long period, what accumulates on a surface where no one can remove anything.

This has happened before, but not like this

CoinDesk pointed to the 2020 LuBian mining pool theft as a precedent. More than 127,000 BTC vanished, and the pool's operators used OP_RETURN messages to try to contact the attacker directly and negotiate a return. Those messages later became one of the data points analysts used to confirm which wallets belonged to LuBian and which belonged to the attacker.

The difference now is who is writing. This is not one organisation leaving a negotiating record. It is a crowd of people who do not know each other, each putting something on the same address for their own reasons.

The same thing happens on real walls

Once a particular wall becomes known, writing of very different kinds piles up on it. What is happening on this bitcoin address shows that process running unusually fast, and in a form that cannot be removed.

To see how it plays out on walls in a city, the Wallscape map and feed hold what people have photographed.