Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust

White-hat operators have transferred 52.37 bitcoin tied to the July Coldcard hardware wallet exploit into an address associated with a newly established recovery trust, according to Alex Thorn, Head of Research at Galaxy Digital. The consolidated funds were moved from Wave 2 of tracked exploit outputs and three footprints labeled AA, AU and AX. The transaction includes an OP_RETURN note directing to cryptorecoverytrust.com and was confirmed in block 967,948.

The Coldcard breach began on July 30 and unfolded in multiple waves, with attackers exploiting a lapse that caused wallets to generate seeds using weaker software-based randomness instead of the device’s dedicated random number generator. That flaw allowed some seeds to be reconstructed by attackers, producing estimated losses exceeding $100 million. Coldcard maker Coinkite has since issued a firmware patch, but funds created from the vulnerable seeds remained at risk.

Thorn said the 52.37 BTC represents roughly 2.8% of all funds tracked from the exploit, and that about 40% of the Wave 2 funds have been identified as having been moved by whitehats rather than malicious actors. In the same transaction, an additional 3.0134 BTC with no prior tracking history also flowed into the recovery-trust address; Thorn described this as likely additional white-hat recovered Coldcard funds but noted it is unconfirmed.

The recovery trust has set up a searchable portal at cryptorecoverytrust.com where victims can enter wallet addresses to see whether their coins were among those swept and consolidated. The white-hat activity is presented as an effort to secure exposed funds until they can be returned to rightful owners, while the broader incident continues to underscore ongoing risks from the original seed-generation vulnerability.