The Special Communication Method in the Blockchain World: On-Chain Messaging

In recent years, on-chain messaging has been frequently used as a unique communication tool in the blockchain world during various security incidents. For example, a security team recently communicated with attackers through on-chain messages in multiple rounds, ultimately successfully facilitating the return of all stolen funds amounting to 8.44 million dollars. In an anonymous environment, on-chain messaging has become an effective tool for establishing initial dialogue, laying the foundation for subsequent fund recovery.

The Bitcoin network also supports on-chain messaging, which is implemented slightly differently than Ethereum. The core tool for on-chain messaging in Bitcoin is the OP_RETURN instruction. This instruction allows users to embed 80 bytes of custom data in a transaction, which will not be used by nodes for transaction validation and will not affect the status of UTXO, purely for the purpose of recording information, and will be fully recorded on the Blockchain.

How to Use OP_RETURN for On-Chain Messaging

Step 1: Encode the message content

First, the text information to be sent needs to be converted to hexadecimal (HEX) format. The OP_RETURN instruction on the Bitcoin Blockchain only accepts HEX format data.

For example, if you want to leave a message: "This is a test.", the converted HEX will be: This is a test.

You can use online format conversion tools or complete this operation through Python scripts. Note that the message content must be less than 160 hexadecimal characters, which is 80 bytes. If it exceeds the length, it is recommended to simplify the information or send multiple messages.

Step 2: Construct a transaction with OP_RETURN

Next, you need to use a Bitcoin wallet or tool that supports custom transactions to create a transaction containing an OP_RETURN output. Taking a certain wallet as an example, enter the BTC wallet transfer interface and open "Advanced mode". In the "OP_RETURN" input box, enter the hexadecimal information. Click "Next" to complete the transaction information confirmation, and input the transaction password to successfully send the transaction with the OP_RETURN information. Please ensure that "Input Amount = Output Amount + Miner Fee".

Step 3: Broadcast Transaction

Broadcast the signed transaction through the Bitcoin network. Since OP_RETURN transactions do not actually transfer funds, a miner fee must be included for processing. Wait for the miners to package it into a Block; once the transaction is confirmed, the message will be permanently stored on the Bitcoin Blockchain.

Step 4: Check the message content

After completing the transaction, you will receive a TXID, which can be viewed through a block explorer. The explorer usually decodes the OP_RETURN hexadecimal data back to ASCII automatically.

Applications of OP_RETURN

In security incidents, certain attackers will leave messages on-chain using OP_RETURN, proactively expressing their intention to return funds to the project party, or the project party and security team will also use this method to communicate with the attackers, attempting to establish contact.

In addition to being used in negotiation scenarios, OP_RETURN is also used for "marking" operations. For example, it was reported that on the eve of the outbreak of the Russia-Ukraine war in 2022, an unidentified Bitcoin user left on-chain messages using OP_RETURN, marking nearly 1000 addresses suspected of being linked to a certain country's security department. These messages were written in Russian and directly pointed out that these addresses might be involved in cyberattacks or espionage activities.

The user did not simply leave a message while posting these warnings, but instead burned a large amount of Bitcoin. Due to the characteristics of the OP_RETURN output, any Bitcoin sent to such transactions will be burned and cannot be used. According to statistics, this user has burned Bitcoin worth over $300,000 in this series of operations.

Summary

On-chain messaging, especially in the Bitcoin network's OP_RETURN, provides an anonymous, public, and immutable way of communication, widely used in the early stages of fund recovery for contact and information transmission. However, it is important to note that on-chain messages may also be used by attackers to guide victims to malicious links or execute risky actions (such as entering private keys for decryption), so it is essential to remain vigilant and avoid viewing or processing suspicious information on untrusted devices.

In the event of a security incident, it is recommended to contact a professional security team for assistance in analysis as soon as possible to improve the success rate of fund recovery. At the same time, users and project parties should continuously strengthen their awareness of security protection to avoid becoming targets of attacks.