White‑hat hackers move 52 BTC from Coldcard exploit to recovery trust

White‑hat operators have transferred 52.37 BTC that were tied to the July Coldcard hardware‑wallet exploit into an address associated with a newly created recovery trust, according to Galaxy Digital’s research lead Alex Thorn.

Background of the Coldcard breach

The Coldcard hack began on July 30 and involved multiple attack waves that exploited weak software‑based randomness in seed generation. The flaw allowed attackers to reconstruct wallet seeds, leading to estimated losses exceeding $100 million in Bitcoin.

White‑hat intervention

In block 967,948, the recovered funds were sent to an address that includes an OP_RETURN message reading “claim:cryptorecoverytrust dot com.” The transaction consolidates coins from Wave 2 of the exploit, identified by footprints labeled AA, AU and AX, and adds an additional 3.0134 BTC of untracked origin, which researchers suspect also stems from white‑hat activity.

Thorn estimates the 52.37 BTC represents about 2.8 % of the total tracked exploit funds, and roughly 40 % of Wave 2 has now been linked to white‑hat activity.

How victims can verify recovery

Individuals can visit cryptorecoverytrust.com and search their wallet addresses to see if their funds were among those recovered.

Technical response

Coldcard manufacturer Coinkite has released a firmware patch to address the randomness flaw, though funds compromised under the previous firmware remain at risk.