Updated Nov 2, 2026, 12:28 a.m. EST. Published Nov 2, 2026, 12:18 a.m. EST.
2 min read
Summary
- Random individuals are transmitting micro-transactions containing attached text to 19 addresses holding 18,270 stolen bitcoins, submitting requests for cash, token advertisements, and unsolicited guidance to the Binance exploiter.
- One particular sender shelled out roughly $46 plus transaction fees to broadcast “Help me bro” across every wallet three distinct times, though zero replies have been received.
- The perpetrator, whom the FBI connects to North Korea, started converting 970,522 pilfered SOL tokens valued near $96 million into bitcoin using Relay on Sunday.
“Help me bro.”
An individual has delivered that exact text to the Binance hacker on three separate occasions since Friday, targeting all 19 addresses holding the 18,270 pilfered BTC. While the cryptocurrency has remained static since Thursday, the target addresses continue receiving microscopic deposits worth under one dollar, each featuring a personal note from an outsider.
Bitcoin protocol permits users to attach brief messages to transfers utilizing an output function called OP_RETURN, which permanently inscribes up to 80 bytes onto the distributed ledger.
According to an analysis by CoinDesk, the originator of the “help me bro” plea transferred 1,000 satoshis (approx. 78 cents at current valuations) to each destination on Friday at 11:43 UTC, repeated the action at 16:03 UTC, and subsequently sent 1,111 satoshis each early Sunday.
The initial pair of broadcast waves originated from a single wallet, with the remaining balance from the first transfer funding the subsequent one. Altogether, the participant expended around $46 worth of bitcoin alongside network fees to transmit a three-word appeal toward a malicious actor identified by federal authorities as a North Korean operative.
Other participants pursued alternative approaches.
On two separate occasions Friday, transactions hit the assailant’s addresses bearing the inscription “Use https://swap.thorchain.ai and swap your funds, never return it to CZ” — once hitting the 437 BTC address and once inside a broader variation that instructed the hacker to reject any white-hat settlements, directed at the address that previously consolidated all 18,270 BTC.
The hyperlink directs users toward a portal styled after a THORChain exchange interface. THORChain, the cross-chain liquidity network previously leveraged by the infiltrator to shift stolen capital, suspended operations across 10 of its 13 supported networks throughout the weekend.
Meanwhile, opportunistic promoters seized the opportunity to advertise their respective ventures. A self-identified Turkish digital asset influencer embedded a pitch for his custom cryptocurrency, requesting that “any donations you send will go toward developing the $NST token ecosystem.”
Early Saturday morning, another participant wrote, “Happy Hacklloween Satoshis for treats PLS.”
Despite these extensive appeals, none of the notes have triggered a reply, while the perpetrator’s cryptocurrency stockpile continues to expand. On Sunday, the attacker initiated the conversion of 970,522 stolen SOL tokens, valued near $96 million, into bitcoin via the Relay bridge.
Originally published at https://www.coindesk.com/tech/2026/11/02/strangers-are-begging-the-binance-hacker-for-bitcoin-one-help-me-bro-at-a-time.
