Wallet linked to the Coldcard hardware wallet exploit holds roughly $36 million in stolen bitcoin and has received multiple transactions with attached messages since July 30, 2026. The address, identified as bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r, is tied to the attacker and was noted by Galaxy Research. Each transaction includes a small payment and a text string written via the OP_RETURN opcode, which embeds the data permanently in the blockchain. Messages range from direct pleas for the return of stolen funds, such as “You stole, please return some” and “Please Please Please,” to requests for a portion of the holdings, for example “80% of my 5 BTC.” An offer to launder the stolen BTC for a 10% fee, including a Telegram handle, and an unrelated appeal for “1 BTC for my Bitcoin journey” were also observed. A message read: “Monday owns my day / five plus ten bitcoin stranger / let me call in free.” The practice of using OP_RETURN to communicate with thieves dates back to the 2020 LuBian mining pool theft, where pool operators posted messages to negotiate the return of more than 127,000 BTC; those messages later assisted analysts in identifying attacker wallets. The wallet’s messages are now immutable on the ledger, and it remains unclear whether the attacker will respond or retrieve the funds.