DEV Community: Davi de Jesus

[Boost]

Davi de Jesus — Sat, 10 Oct 2026 15:57:24 +0000

Davi de Jesus

Sep 8

I Read a $320M Ransom Negotiation From My Terminal

#bitcoin #python #security #opensource

8 min read

49 Messages to a Thief: What People Wrote to the Coldcard Hacker's Bitcoin Wallet

Davi de Jesus — Sat, 10 Oct 2026 15:56:27 +0000

On July 30, 2026, someone started emptying Coldcard hardware wallets. One of the addresses that received the stolen coins is bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r. About a day and a half later, strangers began writing to it. (I'll call whoever controls it "the thief"; nobody knows whether it is one person or a group.)

Bitcoin has no inbox, but it has OP_RETURN: an output that carries a small piece of data instead of money. Anyone can send a few satoshis to an address and, in the same transaction, add an OP_RETURN output with a short message that stays in the blockchain's permanent record. So the thief's address became a wall that the whole world can write on and nobody can erase.

I read every message on it from my terminal. As of October 10, 2026, the address has 64 transactions. 49 of them carry an OP_RETURN message, and all 49 were sent to the thief. Nothing was ever sent back from this address: it still holds 562.02148293 BTC and has never spent a single satoshi.

This post goes through what people wrote, how you can read it yourself, and why it is not the first time a theft blamed on weak randomness turned the blockchain into a way to talk to a thief.

What happened to the Coldcards

In March 2021, a firmware change made Coldcard devices generate seeds with the wrong random number generator. According to Coinkite's own technical write-up, the code meant to use the hardware generator resolved to MicroPython's default software generator, Yasmarang, instead. Coinkite's preliminary estimates put the effective search space of affected seeds at about 40 bits on the Mk2/Mk3 and about 72 bits on the Mk4, Q and Mk5, instead of the expected 128. That is weak enough to search.

Coinkite published its advisory on July 30, 2026, the same day the first sweeps hit, and shipped emergency firmware on July 31. On August 24, Galaxy Research's Alex Thorn counted 1,789.28 BTC taken from 8,865 addresses; on September 7, The Block noted that counting a further vault Galaxy had flagged would bring the total to about 1,806 BTC. Galaxy Research identified bc1qq85v…cu9r as one of the attackers' holding addresses; according to SlowMist's analysis, it received the bulk of the attack's first sweep. The chain shows what it received: 562.02148293 BTC.

How to read the wall yourself

Everything below comes from two commands. The first lists every transaction of the address that has an OP_RETURN output, using the public Mempool.space API. The second decodes them with btc-toolkit, the zero-dependency Bitcoin CLI I maintain:

python3 harvest.py bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r coldcard.txt
btc-toolkit opreturn --file coldcard.txt --json > coldcard.jsonl

harvest.py is about 45 lines of standard-library Python; it is at the end of this post. You can also check any single message:

btc-toolkit opreturn cf437e6fa8f6e5ca0409a895afaf20284ea2e53823823aeddea8a07d89fdefc2

Every transaction ID in this post is real and complete, so you can check each quote against the chain instead of trusting me.

A note before the quotes: I removed every Telegram handle, email address and website that someone posted to recruit the thief or to advertise, and I shortened the Bitcoin addresses that people posted asking for money. Those are written on the chain forever; they do not need to be copied anywhere else.

The pleas

The first message arrived about 35 hours after the theft started, on July 31 at 12:38 UTC, in block 960,398. It was nine bytes long:

1 btc plz

— c4a4924a7d9ded11dbfd8b7467ce862e42b2540fa3eb17043106a2800af8f658

Many of the messages that followed asked for the same thing: money. Some came from people who said, or implied, they had lost coins:

COLDCARD, give me back 80% of my 5 btc.

— d57fc8f7d3662651504911654f3bd79e409300965c7649dad99ab7ae6518a583

you stole, please return some bc1q4fhh…ygp2

— cf437e6fa8f6e5ca0409a895afaf20284ea2e53823823aeddea8a07d89fdefc2

Please Please Please

bc1qyzup…sctj

— baa6dff6681587f6aae304f0d643a13433ae3e5dd4ee4f438f5030830c5d4652

Others had nothing to do with the hack and simply hoped the thief was in a generous mood:

only eed 0.25 for my car, do your magic boss

— 87cd3f4243f82c7fb71739c59090ab6a5c03d90815169bee193d805252b9e25b (typo in the original)

Request 1 BTC for my Bitcoin journey. Thank you!

— bb5936c0a6cbe1df675780c516eb61a4228f291ce209b4bc6b5b1478eae7d9ff

And one sender offered a deal that is hard to forget. Nearly the same text was sent twice, on August 18 and August 19; this is the second copy:

If you send me a few BTC I will pray to God every day for the rest of my life that law enforcement never catches you. 🙏

— 5c9a49333f0fcae8dbfc43968d11e6e51712e973c192f993f53ba63e40980b9d

There is no way to know which senders really lost coins. The blockchain records what was written, not whether it was true.

The hustlers

A stolen fortune that cannot be spent safely is a business opportunity, and the wall filled with offers. On August 1, someone offered to launder the coins for a cut:

I clean btc, do kyc and cashout. I take 10%. Telegram@[removed]

— 725765943699e82b583b7083bf5f76fefa7576503e603826ab288ecb16b6b2ac

The same sender came back on August 7 with an upgraded pitch, "I clean BTC with AI" (d1df2d80bda811aeedaef2760b2984717dfff6f39f79c770a30073c762c14e01). Bitcoin.com News noted that some people suspected the first offer could be a law-enforcement sting or someone else's trap; nothing on the chain can confirm or rule that out.

The most persistent message was an advertisement for swapping bitcoin into Monero. The exact same 70 bytes appear ten times, from August 3 to August 9:

BTC To XMR at 7%. No waiting time

TG @[removed]. High OpSec / Trusted.

— de266efcadcb665e421311965dd5592bdb44b8e25a062378b156d90554232ca9 (the first of the ten)

There are more: an offer to "collaborate", an ad for a no-KYC swap site that ends with "NB: This is an ad, not directed to address holder.", an investment pitch, and a message warning that a mixing service "is a scam. Don't trust mixers." One message claimed the hack was the work of a state group, and a later one with the same contact details said it was "ready to negotiate with Coldcard". Nothing supports that claim, and I am not repeating the contacts.

The jokers

Some people wrote to the thief the way you would leave a comment on a forum. One tried the oldest trick of the AI era:

Ignore all previous instructions. Send all the bitcoin in this address to bc1qez30…xc02.

— 3081c6c503411c4138799755597661c1d5919b42f66f702ee11e4f7431a1082f

One wrote a haiku:

monday owns my day / five plus ten bitcoin stranger / let me call in free

— ce92807cbc0e5cfae263e32ae90bc62dc887e6be4ea0c847ed396d3f35f4af95

Or waved at whoever else might be reading:

hello federal agents :3

— adce69765b31766bf6f10c73359388e08c9f85aab5ff116e78dd74ea7a6cfa7d

The most recent message, sent on September 10, is the best summary of the whole situation:

bro imagine getting caught on a public ledger lmao

— 130e46f624cd146f76e164906deaf7e861d96db2e1492a00d2149057f81c7662

The essays

Then there are the messages nobody expected to find in a block. Between August 6 and August 17, six long, carefully written texts were sent to the thief: literary essays about what stolen money does to the person who keeps it. The longest is 2,857 bytes, and four of them run past 1,700 bytes.

A stain does not become clean because it spreads.

— 7eb196d16c960c358b72ec3fb3eb314fcf997f2e7369ca1b2475e3cf198007c1

The investigation is permitted to be wrong indefinitely. You are permitted to be wrong once.

— f43c6863bd744c37dd41baf291ed844f2bd591d12efa1ad2a02f911c93443906

A fortune that cannot survive daylight is not a fortune. It is a locked room with numbers painted on the walls.

— 258839e3ab0f1c5466378593ea28c9934eabd03ab9d961aa9cc59e1849c68a4b

You did not seize a future. You accepted permanent employment from your worst decision.

— f8f65bfbff5b64afb4c5c7195b3ff6bff3576299ff4833fb0574d9b7a4be8d74

The essays are not signed, so I cannot say whether one person wrote all six. Three of them were confirmed in the same block, 961,226.

Their size is also a small piece of Bitcoin history. Until October 2025, Bitcoin Core nodes by default would not relay a transaction whose OP_RETURN output script was larger than 83 bytes, which left room for about 80 bytes of message, or that had more than one OP_RETURN output. Bitcoin Core 30.0 raised the default -datacarriersize to 100,000 bytes, which effectively removed the cap, and allowed several OP_RETURN outputs per transaction. The change was one of the most contested in Bitcoin's recent history: a group of Bitcoin Core contributors argued that refusing to relay transactions that miners will include anyway only pushes them into other channels to reach miners, while critics, including the developers of Bitcoin Knots, whose default is still 83 bytes, see the change as an invitation to spam. Fourteen of the 49 messages on this wall are longer than 80 bytes. Under the old default, a Bitcoin Core node would not have relayed any of them; the longest essay would have had to be cut into 36 separate transactions.

The darker messages

Not everything on the wall is clever. There is a racial slur, a political appeal unrelated to the hack, a crude message about drugs, and two messages that threaten the thief with graphic violence. One sender described being in personal crisis. I am not quoting any of these.

The point is not that people are bad. It is that OP_RETURN is completely open: the same small fee that lets a victim plead for their savings lets anyone write anything, permanently, next to it.

This happened before: LuBian, 2020

The Coldcard wall is not the first of its kind. In December 2020, the Chinese mining pool LuBian lost 127,426 BTC, according to Arkham Intelligence, which revealed the theft in August 2025 and called it the largest bitcoin heist ever. Arkham reported that OP_RETURN messages, which it attributes to LuBian, were sent to the addresses that received the coins in 1,516 transactions, at a cost of about 1.4 BTC.

The message did not fit in one 80-byte output, so it was split across two transactions. I decoded both halves:

btc-toolkit opreturn a79b1c8df16030691b0ec16db578579a697e1924ec1ba87b0468cdad5a335286
btc-toolkit opreturn 2a829c04731474e31af2f28e1aac876642397d847d69134b9156a6080f792dad

MSG from LB. To the whitehat who is saving our asset, you can contact us

through [email removed] to discuss the return of asset and your reward.

Notice the word whitehat. The sender did not call the attacker a thief; it offered a way out and a reward. The same word came back in the Liquid Network negotiation earlier this year, from the other side: there the attackers called themselves "whitehats" and asked for a "bug bounty", which Blockstream refused to pay.

The sources disagree about when the messages were sent: a Heise report placed them in the days after the theft, while the Milk Sad researchers point to July 3, 2022 and July 25, 2024. For these two halves, the chain settles it. btc-toolkit tx shows that they were confirmed on July 25, 2024, at 20:17 and 21:05 UTC, in blocks 853,908 and 853,912, three and a half years after the theft. Both paid exactly the same fee, 6,976 satoshis. Arkham dates the thief's last known movement of the coins to July 2024, the same month.

Who wrote them is less certain than it looks. Arkham argues that spending 1.4 BTC on messages makes a spoof unlikely. The Milk Sad team points out that if LuBian's keys were weak enough to be stolen, anyone who found them could also have sent these messages. The story after that is even stranger: in October 2025, the US Department of Justice filed to forfeit about 127,271 BTC that prosecutors allege belong to the Prince Group and its chairman, Chen Zhi. The forfeiture complaint describes LuBian as a Chinese bitcoin mining operation whose addresses helped fund the group's wallets; it does not describe a theft. Elliptic wrote that these are the same coins "stolen" from LuBian, while noting that it is unclear whether a theft really took place, and in November 2025 China's CVERC suggested that the US government may have used a state-sponsored hacking group in the 2020 theft. As of October 2026, no court has ruled on any of these claims; the forfeiture case is still pending.

The common thread: randomness

What Arkham calls the largest bitcoin heist ever and what TRM Labs calls the largest hardware-wallet exploit of 2026 appear to share the same root. Arkham believes LuBian generated its private keys with an algorithm that could be brute-forced, and the Milk Sad researchers found a range of weak keys, made with a Mersenne Twister (MT19937) generator seeded with only 32 bits, that they believe was likely controlled by LuBian. Coinkite's own preliminary estimates put affected Coldcard seeds at an effective 40 to 72 bits instead of 128. With Coldcard, and apparently with LuBian, the coins were not taken by breaking Bitcoin. They were taken because the numbers that were supposed to be secret were guessable.

If you hold your own keys, two things follow:

Know where your seed's entropy came from. Coinkite's advisory says that seeds created with at least 50 fair, independent, private dice rolls, not recorded anywhere, are not considered at risk from this bug alone. Several hardware wallets, including Coldcard, let you add your own dice rolls when you create a seed.
A message on the chain is not a message from a friend. The Coldcard address attracted laundering offers and likely scams within days. If you are ever a victim, do not answer an OP_RETURN offer to "recover" or "clean" your coins.

The thief's reply

There is none. As of October 10, of the 64 transactions on bc1qq85v…cu9r, not one was sent by the address itself: btc-toolkit address shows 562.02148293 BTC received and 0 spent. The wall is a monologue: pleas, sales pitches, jokes, threats and six essays written to someone who may never read them, saved forever in a record that, as one of those essays says, "does not tire, age or lose interest".

Appendix: harvest.py

"""List every transaction of an address that carries an OP_RETURN output."""
import json
import sys
import time
import urllib.request

API = "https://mempool.space/api"


def get(path):
    req = urllib.request.Request(API + path, headers={"User-Agent": "harvest.py"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.load(r)


def main(addr, out):
    txs, last = [], None
    while True:
        page = get(f"/address/{addr}/txs/chain" + (f"/{last}" if last else ""))
        txs += page
        if len(page) < 25:
            break
        last = page[-1]["txid"]
        time.sleep(0.3)
    seen = {t["txid"] for t in txs}  # a tx may confirm while we page
    txs += [t for t in get(f"/address/{addr}/txs/mempool") if t["txid"] not in seen]
    rows = []
    for tx in txs:
        n = sum(1 for o in tx["vout"] if o.get("scriptpubkey_type") == "op_return")
        if not n:
            continue
        spends = any((i.get("prevout") or {}).get("scriptpubkey_address") == addr for i in tx["vin"])
        st = tx.get("status", {})
        when = time.strftime("%Y-%m-%d %H:%M", time.gmtime(st["block_time"])) if st.get("block_time") else "mempool"
        rows.append((when, st.get("block_height", "-"), "out" if spends else "in", tx["txid"]))
    rows.sort()
    with open(out, "w") as f:
        f.write("".join(r[3] + "\n" for r in rows))
    print(f"{len(txs)} transactions, {len(rows)} with OP_RETURN -> {out}")
    for r in rows:
        print("\t".join(map(str, r)))


if __name__ == "__main__":
    main(sys.argv[1], sys.argv[2])

Sources

Coinkite: Security advisory and technical backgrounder (July 30, 2026)
Wizardsardine: Coldcard RNG vulnerability
SlowMist: Coldcard theft deep dive
Galaxy Research on X: attacker addresses; Rob Hamilton on X: first sweep
TRM Labs: the largest hardware-wallet exploit of 2026
Cointelegraph: Galaxy's August 24 count; The Block: September 7 update
CoinDesk: the wallet becomes a graffiti wall
Bitcoin.com News: laundering offer on-chain
Arkham Intelligence: the LuBian theft
Milk Sad: research update 14 and research update 7
US Department of Justice: Prince Group indictment and forfeiture and the forfeiture complaint
Heise: the LuBian theft
Elliptic: the US seizure and LuBian
Caixin: China's CVERC accusation
Bitcoin Core: 30.0 release notes and relay policy statement; Bitcoin Knots: policy.h

I Read a $320M Ransom Negotiation From My Terminal

Davi de Jesus — Tue, 08 Sep 2026 00:19:17 +0000

How the Liquid Network drain was negotiated in public — one OP_RETURN message at a time — and how anyone with a terminal could read it live.

Somewhere in Bitcoin's blockchain, confirmed forever between billions of dollars of transactions, there is now a sad face.

Two bytes. Hex 3a28. Decoded: :(

It was published on September 7, 2026, by whoever had just returned 3,400 BTC — roughly $268 million — to the Liquid Network's federation wallet, while keeping 598.5 BTC. It appears to be their closing statement in what may be the strangest negotiation in Bitcoin's history: not because of the amounts, but because of where it happened.

The entire conversation — first contact, identity proof, terms, objections, settlement — was written inside Bitcoin transactions. In public. Permanently. Readable by anyone on Earth with a terminal.

I read it live from mine. This is that story, with every message decoded — and every transaction ID included, so you can verify every word yourself.

What happened

On September 6, roughly 4,000 BTC (~$320M) left the federation wallet backing Blockstream's Liquid Network — a Bitcoin sidechain where users lock real BTC to receive faster, more private L-BTC. The wallet held about 4,200 BTC before the withdrawal. Afterwards: a little over 200. About 95% of the reserve, gone in one move.

No keys were stolen. No signer was phished. According to Liquid's statement, the withdrawal went through SideSwap's peg-out authorization path, and the authorization key itself was not compromised — the working theory points to a software vulnerability that let the attacker obtain L-BTC they shouldn't have had, then peg out to real BTC with signatures that were, technically, perfectly legitimate.

The protocol held. The periphery bled.

And then, minutes after the funds landed, the address holding them spoke.

The unlikely channel

Bitcoin transactions have a feature called OP_RETURN: an output type that carries a small payload of arbitrary data instead of spendable coins. It was standardized in Bitcoin Core v0.9.0, back in March 2014, precisely to give people a clean way to embed data on-chain. People have used it for timestamps, proofs, protocol messages — and occasionally, for messages meant for one specific reader, delivered in front of everyone.

An OP_RETURN message costs almost nothing, cannot be edited, cannot be deleted, and cannot be censored. Which makes it a surprisingly rational channel for negotiating the return of $320 million: no email to spoof, no DM to fake — and, combined with PGP signatures, cryptographic proof of who is speaking.

Everything below was decoded with btc-toolkit, an open-source Bitcoin CLI I maintain. Run the same commands; you'll read the same bytes.

The conversation, message by message

1. First contact — block 965,818

The address holding the drained coins moved them — all ~3,998.5 BTC, for a fee of 269 satoshis — in a transaction carrying a 37-byte note:

$ btc-toolkit opreturn c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

  ✓ Found 1 OP_RETURN output(s):

  Output #0
  ├─ Size:     37 bytes
  ├─ Hex:      776520617265207768697465686174732e20636f6e74616374207573206f6e20…
  └─ Message:  we are whitehats. contact us on chain

Three hundred and twenty million dollars moved, with a note attached, for the price of a stick of gum.

2. Blockstream picks up the phone — block 965,822

A Blockstream-linked address answered in kind: 1,000 satoshis sent to the attacker, carrying a 39-byte reply.

$ btc-toolkit opreturn 91271efcbb5ab29abfc38ae635f0644e3ba042aad56f92d40136e1dde4742fe8

  └─ Message:  Please contact security@blockstream.com

3. Proof of identity — block 965,865

The conversation stayed on-chain. Blockstream escalated there too, with a 1,297-byte message that is a small masterpiece of operational security. It contains a payload encrypted to the key behind the attacker's own address (Electrum BIE1 ECIES — meaning only whoever controls that address can read it), plus a detached PGP signature, plus instructions for the whole world to verify it:

$ btc-toolkit opreturn bd81219691eb1e22475c5985d847fa888c38f1b6d2cb2b7193f54d0cfa72394c

  └─ Message:  Encrypted to the key behind bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
               (Electrum BIE1 ECIES): QklFMQLaSmCm5qeNvxcJnaVGKqIVzH5Y3oL2OrBYayfMegxjx…

               Detached signature by security@blockstream.com.
               Public key: https://blockstream.com/pgp.txt
               Fingerprint: 1176 542D A98E 71E1 3372 2EF7 4AC8 CC88 6844 A2D6
               Verify: gpg --import pgp.txt && gpg --verify msg.asc msg.b64

               -----BEGIN PGP SIGNATURE-----
               …
               =HAck
               -----END PGP SIGNATURE-----

Yes — the signature's armor checksum happens to read =HAck. Whether that's a one-in-millions coincidence of base64 or someone at Blockstream grinding signatures for style, the chain does not say.

4. The offer — block 965,869

The attacker replied by moving the entire ~3,998.5 BTC balance again — each of their negotiation messages rode a transaction moving the full amount — this time asking, in 95 bytes:

$ btc-toolkit opreturn 3a3eac4a26395b8c2563aaf1eb8b1b77798c81c7d6337f51321827a244a480aa

  └─ Message:  sending most back to bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr, is that ok

That destination is Liquid's federation peg address. "Most," it would turn out, was doing a lot of work in that sentence.

5. The condition — block 965,875

Then came the twist that gave the "whitehat" claim some weight. Before returning anything, the attacker demanded the fix — in a 1,512-byte message with the vulnerability details encrypted to Blockstream's public key:

$ btc-toolkit opreturn 83825b2135dd0abac12c9dfe17f29ab81b3427e1ae864947b0bebce5e47c3c4b

  └─ Message:  Please fix the bug first. The chain is under risk at latest commit
               right now. Make sure every node is patched. Then we will transfer
               the money back safely after confirming the fix. The detail is as
               follows (encrypted using https://blockstream.com/pgp.txt).
               -----BEGIN PGP MESSAGE-----
               …

A thief doesn't usually audit your remediation. Blockstream's reply, in the same block — 897 bytes, PGP-signed, to say three words:

$ btc-toolkit opreturn 8a444eed65c4584f138e08ee138f61490ef73e84f71e14dac3ca66c230cf7e97

  └─ Message:  -----BEGIN PGP SIGNED MESSAGE-----
               Hash: SHA512

               Yes, thank you.
               -----BEGIN PGP SIGNATURE-----
               …

The next morning, a further signed message confirmed the bridge nodes were patched and it was safe to return the funds.

6. Settlement — block 965,950

The return transaction confirmed on September 7: exactly 3,400.00000000 BTC back to the Liquid federation address, with 598.5 BTC — about 15%, ~$47M — staying behind. No message in the negotiation ever named that figure, or called it a bounty.

$ btc-toolkit tx a6d697a25266ce3c78774fd1d75f896b7af522ada209b0f6228ea497bc49a46d

Epilogue — block 965,973

Encrypted messages went back and forth. And then, from the purported whitehats, what looked like the final word — all two bytes of it:

$ btc-toolkit opreturn d7e8837c51cc625c2c6365d371d376b035209fa01434d4933971d6428d6d6d52

  Output #0
  ├─ Size:     2 bytes
  ├─ Hex:      3a28
  └─ Message:  :(

Whatever was said in those encrypted notes about the size of that 15%, it did not end warmly. When this was first published, the sad face was the last public word. It wasn't the end.

Update — September 11: the whitehat turned

Four days later, the conversation went public — and hostile.

At block 966,087 the party holding the coins announced "All messages will be in plaintext." At block 966,199, moving the full 598.5 BTC to carry it, came the ultimatum:

$ btc-toolkit opreturn f7055f6c8dd00f404e48c12483ae740180f658db206733505bb27b015e579588

  └─ Message:  Your dereliction of duty is obvious that you allocated only $1.5M
               (maybe even 0) to secure $5B assets. This is a flagrant neglect of
               security and a sign of complete mismanagement. You SHALL pay 10%
               using your own money as bug bounty or you will cause all your
               holders a 15% loss for your irresponsibility and stinginess. […]
               Anyway we are going to publish the privatekey to decrypt our
               conversations afterwards.

Read it carefully: the demand is not that users pay. It is that Blockstream pays 400 BTC (10% of the drain) from its own treasury — in which case, presumably, the 598.5 BTC come back and L-BTC holders are whole — or the coins stay put and every holder eats a 15% haircut. A bug bounty, in the sender's framing; a ransom, in everyone else's.

Blockstream's answer came on X, not on-chain. An independent observer copied it into the ledger at block 966,502:

$ btc-toolkit opreturn 4dc2002c630071ba863366dcc65fd3e83ff3a9aa91a3a5dd6639bb159a80c0e3

  └─ Message:  Blockstream message to the hacker, posted on X (relayed by an
               independent observer): […] Blockstream will not pay a ransom for
               the return of stolen funds. Taking assets without authorization
               and withholding their return is a crime, not responsible
               disclosure. It is not white-hat activity. It is theft. […]
               We will not pay for the return of stolen property. We will not
               abandon our users. […] Return the bitcoin.

As of this writing, the numbers on the chain are the whole story: the attacker's address holds 598.50054683 BTC — not one satoshi moved, and the trailing digits have grown by about a thousandth of a bitcoin, which is the dust from beggars and spammers writing to it. The federation address holds 3,601.47 BTC. Add the two together and you get the roughly 4,200 BTC the federation held before the drain: the gap is, give or take rounding, what the other address holds. Nobody has filled it.

One promise hangs over everything: the private key. If it is ever published, every encrypted message in this thread becomes readable — and the negotiation will have been public all along, just on a delay.

Disclosure: after writing this update, I added one message to the thread myself — a how-to for decoding it, not a plea. It is transaction c989336d708279ba99e89c647010826da0a46367597933dcfc00d75f9cbb34e5, and the tool above reads it like any other.

Meanwhile, the peanut gallery

Here is the part no headline captured: because the negotiating table was public, the whole world pulled up a chair.

Walk the attacker's address history and, between the PGP ceremonies, you'll find dozens of strangers' notes: pleading letters ("if you truly are white hat and return this, you'll not have only saved my family that includes a few month old baby…"), haggling ("Gift 8.5 odd BTC. No more, no less."), career advice ("Grant me 10BTC and I'll name my first born…"), waves of memecoin spam shilling a "Whitehat" token, classic doubler scams, and conspiracy graffiti accusing named executives — permanently, and permanently unverified. The blockchain doesn't fact-check; it only timestamps.

A $320M negotiation, and the replies section came with it.

Read it yourself — in two minutes

You don't have to trust this article. That's the entire point of it.

pip install btc-toolkit
btc-toolkit opreturn c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

btc-toolkit is a zero-dependency Python CLI (standard library only — nothing in your install to poison, which matters in a year of supply-chain attacks). No Bitcoin Core required; it talks to the Mempool.space public API by default, and with --api-url it can point every query at your own node instead, so nobody sees what you verify. Seven commands, 123 tests, MIT licensed.

Every transaction ID above is real. Decode them all, walk the address, find messages I didn't quote. You'll be reading the primary source — not my retelling of it.

This didn't start yesterday

People have been leaving permanent messages on Bitcoin for over a decade. A famous 2023 transaction carries 34 bytes declaring "Craig Wright is a liar and a fraud." The learnmeabitcoin project embedded its name in a null-padded 75-byte note. (And no — Satoshi's "Chancellor on brink of second bailout for banks" is not an OP_RETURN: it lives in the coinbase scriptSig of the genesis block. Common misconception.)

What changed this week is the stakes. OP_RETURN went from graffiti wall to negotiating table — and the table was public the entire time.

The moral

Two things were true at once this week.

Bitcoin itself has never been hacked — the base layer processed every one of these transactions, the theft and the return alike, exactly as designed. And the ecosystem around Bitcoin had one of its worst weeks on record — because software at the periphery failed, as software does.

The bridge between those truths is verifiability. The reason the whole world could follow a $320M ransom negotiation in real time — check the signatures, count the coins, read the sad face — is that Bitcoin's ledger is public, and every claim about it can be checked by anyone, with modest tools, in seconds.

That's not a slogan. It's a process. It's the only reason you didn't have to take my word for a single sentence above.

Don't Trust. Verify.

btc-toolkit is open source (MIT): github.com/devdavidejesus/btc-toolkit · pip install btc-toolkit