Binance hack wallets draw scam pitches and pleas as 18,270 BTC remain idle

Traders Union
All News
Crypto
Binance hack wallets and messages

Highlights

19 wallets linked to the Binance hack still control 18,270 BTC, with only minor sub-dollar transactions and blockchain messages since Thursday.
Blockchain messages include repeated 'help me bro' pleas and laundering pitches urging the hacker to use THORChain swap services instead of returning funds.
THORChain, previously used by the attacker to move stolen assets, halted trading on 10 of 13 chains over the weekend, increasing operational stress.

Blockchain messages target dormant hack addresses

As reported by CoinDesk, the 19 wallets holding the stolen bitcoin have received no meaningful new funds since Thursday, only sub-dollar transactions that include short notes written into the blockchain. The messages have been sent to addresses linked to 18,270 BTC that have not moved since then.

One sender posted the phrase “help me bro” three times since Friday across all 19 wallets. CoinDesk’s analysis said the sender paid 1,000 satoshis to each wallet twice on Friday, at 11:43 UTC and 16:03 UTC, and then sent 1,111 satoshis to each wallet early Sunday.

Bitcoin allows users to attach short notes to transactions through an output type known as OP_RETURN, which can permanently write up to 80 bytes of data to the blockchain. The first two rounds of the “help me bro” payments came from the same wallet, with change from the first round helping fund the second, for a total spending of about $46 in bitcoin plus fees.

THORChain reference adds laundering angle

Other messages took a different approach, urging the holder of the stolen funds to swap the assets rather than return them. Two Friday transactions carried a note saying, “Use https://swap.thorchain.ai and swap your funds, never return it to CZ,” with one sent to the 437 BTC address and another, longer version sent to the address that briefly held all 18,270 BTC.

The linked page appears styled as a THORChain swap site. THORChain, the cross-chain swap network that the attacker has already used to move the stolen funds, halted trading on 10 of its 13 chains over the weekend, adding fresh operational strain to a case that remains closely watched across the crypto sector.

Our earlier article on cybersecurity funding highlighted that investor interest stayed strong, with global cybersecurity and privacy startups raising $6.8 billion in Q3 as larger late-stage rounds offset fewer overall deals. We also noted that AI-driven and identity security firms attracted the biggest checks, while major acquisitions underscored how the industry is scaling up to address rising fraud and security threats.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.