Main attacker consolidation addresses from the July-August 2026 Coldcard firmware RNG exploit. These became the most active public OP_RETURN message boards, filled with begging, laundry ads, threats, haikus, philosophical notes and prompt injections.

High-balance early (mostly 2010-2011) addresses that have received systematic OP_RETURN legal notices, ownership claims, phishing links and 'abandoned property' messages (including the 2025 Salomon Brothers-style campaigns).

The Genesis block address. A long-running cultural phenomenon where people send symbolic tributes, memorials, and messages to Satoshi.

Addresses publicly labeled via OP_RETURN in early 2022 as belonging to Russian intelligence agencies (GRU / SVR / FSB). Classic geopolitical on-chain marking campaign.

Addresses and vanity addresses associated with permanent cultural tributes, memorials, religious messages, and early digital graffiti on Bitcoin.

Addresses from past major incidents that have been used for public on-chain negotiation, bounty offers, threats, or responses between victims, projects, and attackers.

Addresses from the September 2026 Liquid Network incident, in which self-described whitehats used an L-BTC inflation bug and a valid SideSwap peg-out authorization to withdraw ~3,996 BTC (about 95% of federation reserves) in block 965,783. The hackers, Blockstream security and the usual crowd of lawyers, launderers and wallet ads are all talking through OP_RETURN.