Strangers pay to beg the Binance hacker for help on the blockchain

Strangers are paying small amounts of Bitcoin to send pleas, ads and scam links to the 19 wallets holding the Binance hacker’s 18,270 BTC, with one sender repeating “Help me bro.” The attacker has not responded, and on Sunday, November 1, 2026, began swapping 970,522 SOL, about $96 million, into Bitcoin through Relay, according to CoinDesk.

Binance hacker becomes target of unusual Bitcoin messages

The Binance hacker linked to the theft of 18,270 Bitcoin has become the recipient of unusual messages from anonymous cryptocurrency users, with several individuals sending small Bitcoin transactions containing personal pleas, promotional messages and advice to the suspected attacker.

The activity, reported by CoinDesk and republished by CryptoNews.net, has drawn attention to the transparency of blockchain transactions and the unusual ways people are attempting to communicate with cryptocurrency addresses associated with major security incidents.

According to the report, the stolen Bitcoin remains distributed across 19 wallets, which collectively hold approximately 18,270 BTC. Although the funds have not moved since Thursday, the addresses have continued receiving small transactions worth less than one dollar.

One particularly persistent sender has repeatedly appealed to the Binance hacker with the message, “Help me bro.” The individual sent the same three-word request to all 19 wallets on multiple occasions, apparently hoping to attract the attention of whoever controls the stolen cryptocurrency.

The unusual development demonstrates how blockchain transparency allows anyone to interact with publicly visible wallet addresses, even when those addresses are associated with suspected criminal activity.

Bitcoin’s OP_RETURN feature enables direct on-chain communication

The messages have been made possible through Bitcoin’s OP_RETURN transaction feature, which allows users to attach small amounts of data to blockchain transactions. This feature can be used to store short text messages that remain publicly accessible once recorded on the network.

According to CoinDesk’s blockchain analysis, the individual behind the repeated pleas sent 1,000 satoshis to each of the 19 wallets on Friday at 11:43 UTC. Another round followed at 16:03 UTC, with a third batch of payments made early Sunday.

Each payment was worth approximately $0.78 at the prices cited in the report. Although the individual transactions were relatively insignificant financially, the combined effort cost the sender approximately $46 in Bitcoin, excluding transaction fees.

The sender reportedly used the change from the initial transaction to finance the second round of payments. This suggests that the activity was deliberate rather than a random collection of transfers.

However, the Binance hacker has not publicly acknowledged any of the messages. Other blockchain users also attempted to communicate with the attacker through the same mechanism.

One message encouraged the recipient to use a website presented as a THORChain swapping service, while advising against returning the stolen cryptocurrency to Binance founder Changpeng Zhao.

The message read: “Use and swap your funds, never return it to CZ.” The same recommendation was reportedly sent to two different wallet addresses, including one that had briefly held the entire 18,270 BTC balance.

THORChain and suspicious swapping recommendations raise concerns

The messages directed at the Binance hacker have also introduced another security concern involving cryptocurrency swapping services.

The website promoted through the Bitcoin transaction was designed to resemble a THORChain swapping platform. This is particularly noteworthy because THORChain is a cross-chain protocol that the attacker had already used to transfer stolen cryptocurrency between blockchain networks.

The report also noted that THORChain suspended trading across 10 of its 13 supported chains over the weekend.

Although the message encouraged the attacker to use the website, its appearance in an on-chain transaction does not establish that the platform is legitimate or officially connected to THORChain.

Attackers and opportunistic third parties can exploit major security incidents to promote questionable services, encourage risky transactions or direct unsuspecting users towards potentially harmful websites.

Another participant used the opportunity to advertise a personal cryptocurrency project. A self-described Turkish crypto influencer sent a message promoting his $NST token, suggesting that donations would support the development of its ecosystem.

Another transaction carried the message: “Happy Hacklloween Satoshis for treats PLS.” These developments demonstrate the variety of activity surrounding the stolen funds, ranging from personal appeals to cryptocurrency marketing.

Stolen Solana tokens continue moving into Bitcoin

While individuals continued sending messages to the Binance hacker, the more significant development for cryptocurrency investors involved the movement of the stolen assets.

According to CoinDesk, the attacker began converting 970,522 stolen Solana (SOL) tokens, valued at approximately $96 million, into Bitcoin on Sunday.

The conversion was reportedly carried out through Relay, a cross-chain bridge that enables cryptocurrency transfers between different blockchain networks.

This development is particularly important because the movement of stolen assets can complicate efforts to trace and potentially recover them.

Moving funds across different blockchain networks introduces additional transaction paths for investigators and blockchain monitoring companies to examine. It also creates challenges for exchanges and other cryptocurrency service providers attempting to identify and restrict suspicious funds.

The situation is worth monitoring because substantial movements of previously stolen cryptocurrency can attract market attention, particularly when large amounts are being converted into another digital asset.

However, the reported conversion does not automatically indicate that the attacker has sold the Bitcoin or transferred it to a cryptocurrency exchange.

The Binance hacker also appears to have ignored the unsolicited messages, with no reported response despite repeated attempts to establish contact.

The approximately 18,270 BTC held across the 19 wallets therefore remains a significant part of the ongoing security incident.

Conclusion

The unusual Bitcoin transactions directed at the Binance hacker have added an unexpected dimension to an already significant cryptocurrency theft.

While anonymous users continue sending pleas, promotional messages and swapping recommendations, the attacker appears focused on moving the stolen assets rather than responding.

The more important development remains the movement of approximately $96 million in stolen SOL into Bitcoin through Relay. The situation reinforces the importance of blockchain monitoring, cross-chain security and stronger safeguards across cryptocurrency infrastructure.

As the investigation and movement of funds continue, investors should remain cautious about unofficial recovery offers, suspicious swapping websites and unsolicited messages claiming to provide access to stolen cryptocurrency.