BitcoinNews on Nostr: COLDCARD THIEF RECEIVES $1 ON-CHAIN LAUNDERING PITCH The attacker’s largest ...
COLDCARD THIEF RECEIVES $1 ON-CHAIN LAUNDERING PITCH
The attacker’s largest consolidation address, holding 562 BTC, received a dust transaction containing an OP_RETURN message advertising laundering services for a 10% cut.
The sender spent 0.002347 BTC, sent just 1,590 sats to the attacker and returned the rest to a change address. The ad cost roughly $1.30.
The OP_Return message includes the Telegram handle of whoever sent the solicitation, which we will not publish.
There is also no proof the advertised account is authentic.
Most importantly, the stolen bitcoin still has not moved. This was someone approaching the attacker, not evidence the attacker is already laundering the funds.
Published at
2026-08-03 04:17:18 CESTEvent JSON
{
"id": "6c1564343f1479767f21f442a8d04bc34d7510dd7fe66d687bc725b90755be8c",
"pubkey": "2774d83c8f9789c583414292b1192c4345db7ff0d551ea32efa2958f4192f6e5",
"created_at": 1785723438,
"kind": 1,
"tags": [
[
"imeta",
"url https://image.nostr.build/4ffca1e6d3b8c38b7f22c43c2054a7122050ca3ffa757126c7ba55eb5b96eb98.jpg",
"blurhash e34.xVH*%JW*R6MAyma1R7tPJxQ:WEyCaPpbRUkVWEW.M3t%RkMzkn",
"dim 1410x612"
],
[
"r",
"https://image.nostr.build/4ffca1e6d3b8c38b7f22c43c2054a7122050ca3ffa757126c7ba55eb5b96eb98.jpg"
],
[
"client",
"Damus"
]
],
"content": "COLDCARD THIEF RECEIVES $1 ON-CHAIN LAUNDERING PITCH\n\nThe attacker’s largest consolidation address, holding 562 BTC, received a dust transaction containing an OP_RETURN message advertising laundering services for a 10% cut.\n\nThe sender spent 0.002347 BTC, sent just 1,590 sats to the attacker and returned the rest to a change address. The ad cost roughly $1.30.\n\nThe OP_Return message includes the Telegram handle of whoever sent the solicitation, which we will not publish. \n\nThere is also no proof the advertised account is authentic.\n\nMost importantly, the stolen bitcoin still has not moved. This was someone approaching the attacker, not evidence the attacker is already laundering the funds.\n\nhttps://image.nostr.build/4ffca1e6d3b8c38b7f22c43c2054a7122050ca3ffa757126c7ba55eb5b96eb98.jpg",
"sig": "be609cd5a053aa579fbf2ad18d4b8f2fdcc1c7d2a324f46c4840f7bc5dbee813cc151ada387d6895ccf6d44d5b77f152a74aa22adee330e566b0bfe2f93790e4"
}