Users are sending micro-transactions to the 18,270 BTC stolen from Binance to exploit the transparent nature of the blockchain, using transaction memos to communicate directly with the hacker. Since the initial theft in early 2026, the attacker's 19 wallets have remained stagnant, seeing no major outflows; instead, they have become a public billboard for 'dust' transactions worth less than a dollar. These messages frequently include 'help me bro' requests for charity, offers from illicit mixers to help move the funds, and advertisements for upcoming DeFi launches.
The hacker currently holds roughly $1.5 billion worth of Bitcoin across these specific addresses, making this one of the largest dormant hauls of the year. The lack of movement suggests the attacker is struggling to bypass modern 2026 AML/KYC hurdles at major off-ramps or is waiting for a period of lower network surveillance. In the meantime, the public's interaction with these wallets highlights a bizarre social phenomenon where the anonymity of the thief is met with the extreme transparency of the ledger.
From a regulatory standpoint, US authorities including the DOJ and Treasury have warned that interacting with sanctioned or known criminal wallets—even for the purpose of sending messages—can lead to the sender's own address being flagged as 'tainted.' This could result in everyday users being blocked from compliant US exchanges. The activity serves as a stark reminder to the crypto community that every interaction on the Bitcoin network is permanent and traceable by forensic firms.
For the broader market, the continued dormancy of these 18,270 BTC prevents a potential liquidity shock. However, the ongoing visibility of the stolen funds maintains a level of fear and uncertainty regarding exchange security. Investors should watch for any movement out of these 19 addresses, as any attempt to liquidate such a large volume would likely trigger immediate volatility in the BTC/USD pair.