Main attacker consolidation addresses from the July-August 2026 Coldcard firmware RNG exploit. These became the most active public OP_RETURN message boards, filled with begging, laundry ads, threats, haikus, philosophical notes and prompt injections.

High-balance early (mostly 2010-2011) addresses that have received systematic OP_RETURN legal notices, ownership claims, phishing links and 'abandoned property' messages (including the 2025 Salomon Brothers-style campaigns).

The Genesis block address. A long-running cultural phenomenon where people send symbolic tributes, memorials, and messages to Satoshi.

Addresses publicly labeled via OP_RETURN in early 2022 as belonging to Russian intelligence agencies (GRU / SVR / FSB). Classic geopolitical on-chain marking campaign.

Addresses and vanity addresses associated with permanent cultural tributes, memorials, religious messages, and early digital graffiti on Bitcoin.

Addresses from past major incidents that have been used for public on-chain negotiation, bounty offers, threats, or responses between victims, projects, and attackers.

Addresses from the September 2026 Liquid Network incident, in which self-described whitehats used an L-BTC inflation bug and a valid SideSwap peg-out authorization to withdraw ~3,996 BTC (about 95% of federation reserves) in block 965,783. The hackers, Blockstream security and the usual crowd of lawyers, launderers and wallet ads are all talking through OP_RETURN.

Largest unspent Bitcoin parcels attributed to the attacker in the 24 September 2026 Bitget hot-wallet breach. Bitget says about $387.5 million left its hot and warm wallets across Ethereum, XRP, TRON, Zcash and other chains, and much of what moved was swapped into BTC. These eight addresses are the biggest balances on Bitget's public stolen-funds tracker (trace.bgblockchain.xyz) as of 28 September 2026: about 190 BTC, mostly a single receipt each.

On 29 October 2026 Binance hot wallets were drained across several chains; on 31 October the FBI attributed the theft of more than $6 billion to North Korea's "TraderTraitor" hackers. This board mixes two chains. On Ethereum, people write to the attacker by sending transactions whose input data is plain text, to the four exploiter wallets they actually address (checked on 30 October 2026; Etherscan labels them "Binance Hot Wallet Exploiter"). On Bitcoin, they etch OP_RETURN messages to the 19 BTC addresses in the FBI's alert and to one bc1p receiver of the hack: victims' pleas, begging, praise, insults, laundering offers. Bitcoin messages are archived from 29 October onward.