- People sent desperate messages to the Lazarus hackers’ wallets after the $6.3 billion Binance hack.
- The notes ask the cybercriminals for money, lunch funds, and trading capital.
- The trend shows that anyone can attach messages to public crypto wallets.
A massive hack at Binance has led to a strange side effect on the blockchain. After the Lazarus Group allegedly drained $6.3 billion from the exchange, people started sending messages to the hackers’ wallets. Many of these messages are pleas for money, written by strangers asking the cybercriminals for a share of the stolen funds.
A crypto user named XBToshi shared a link to a page showing these on-chain messages. The page displays a ‘digital soup kitchen’ where people write sob stories to a sanctioned North Korean hacking unit. The post says beggars even pay gas fees just to ask the group for lunch money or trading capital.
The Scope of the Binance Hack
The background to this strange behavior is a record-breaking cyber theft. Binance, the biggest crypto exchange worldwide, announced on Thursday the theft of about $6.3 billion of its digital assets. This makes it the biggest crypto heist ever, far surpassing the $1.5 billion Bybit hack in 2025.
TRM Labs investigators and others have linked the hacking act to a North Korean organization called TraderTraitor, which is part of the Lazarus Group. This organization is known for its long history of hijacking crypto exchanges to help fund military innovations in North Korea.
Binance said the attack started with a compromised engineer’s laptop. However, the company later found additional breach points. The exchange has promised to cover all losses and has frozen around $3 billion of the stolen assets.
The magnitude of the theft is important to average consumers. A theft of this magnitude can undermine faith in centralized exchanges. This also raises new questions about the level of protection major platforms use for their personnel’s computers and passwords. One weak device can open a door to billions in customer funds.
Why People are Begging Hackers for Money
The on-chain messages reveal a strange side of people in the cryptocurrency realm. As soon as the wallets of the hackers were public, random users started attaching notes to their small transactions to those addresses. Moreover, these notes are visible to anyone who looks at the blockchain.
There are many nice messages requesting help from the hackers. People state that they are facing financial hardships and ask the hackers to share some of their stolen billions with them. Some try to disguise their requests for money as a cry for airdrop or trading capital.
Such conduct reveals an odd fact about public blockchains. All transactions are available to everyone, and it is possible to communicate with any wallet. Hackers can choose not to answer, but the messages keep pouring in nonetheless. The website operated by XBToshi brings these details together into one combined flow, transforming a crime into a pageant.
Some observers find irony in this trend. Others feel pity. The bottom line is that the feed demonstrates that ordinary people behave as if criminal wallets are a public mailbox. The sending cost is insignificant, hence obtaining the result takes little effort.
The Technical Context Behind the Messages
The messages appear on a site called opreturn.xyz. The name refers to ‘OP_RETURN,’ a feature in blockchain transactions that lets people attach small amounts of data to a transfer. Criminals and researchers alike use this feature to leave notes on the chain.
In this case, the tool has become a channel for ordinary people to reach out to the Lazarus Group. The humor in the post from XBToshi comes from the absurdity of the situation. A state-backed hacking unit accused of stealing billions is now receiving requests for ‘lunch money’ from strangers.
The texts show a complete confusion regarding the working of these hacks. The stolen money is not standing idle in a bank account expecting a sharing pattern. Exchanges and stablecoin issuers have transferred & frozen the funds, or the criminals had laundered them. Tether and Circle have frozen investments worth tens of billions. There are no opportunities for hackers to wire money to any people who might ask for it.
There is also an aspect of privacy. Every sent message gets recorded on a blockchain. If someone sends a message, their wallet remains linked to it. Eventually, this leads to creating a public trail that experts can analyze.
Digital evidence can also play a role in wider cybercrime investigations, including the case of a Paris man accused of hacking police and courts in a €1 million scam.
This odd behavior is not a serious security threat. It does, however, show how public and accessible blockchain data can be. Anyone can watch the wallets of the hackers. Anyone can send a message. Moreover, it reflects a blur in the line between a criminal investigation and a public forum.
For Binance users, the main concern remains the safety of their funds. The exchange says user funds are safe and that it will cover all losses. Also, the company has suspended withdrawals temporarily, but it aims to restore them soon.
