Whitehats Move 52 BTC From Coldcard Hack to Recovery Trust
On-chain sweep transfers 52 BTC to recovery trust
Ethical cybersecurity professionals moved 52.37 BTC linked to the July Coldcard hardware wallet exploit into an address associated with a newly formed recovery trust. Galaxy Digital Head of Research Alex Thorn reported that the transaction was confirmed in Bitcoin block 967,948. The transaction payload included an OP_RETURN message reading "claim:cryptorecoverytrust dot com."
The moved funds were consolidated from Wave 2 of tracked exploit flows alongside three specific footprints labeled AA, AU, and AX. Thorn noted that the 52.37 BTC represents 2.8% of total tracked exploit funds. Within Wave 2, roughly 40% of the activity has now been identified as white-hat sweeps.
Transaction structure and unconfirmed inflows
The transaction in block 967,948 also contained an additional 3.0134 BTC that had no prior tracking history. Thorn stated that this extra volume presumably represents additional white-hat-recovered Coldcard assets, though he emphasized that this origin remains unconfirmed.
The swept funds were consolidated into a destination address linked to cryptorecoverytrust.com. Victims affected by the wallet breach can visit the portal and search their addresses to verify if cybersecurity teams recovered their funds.
Vulnerability mechanics and total losses
The Coldcard hardware wallet compromise began on July 30, followed by subsequent attack batches designated as waves 1, 2, and 3. Estimated total losses from the exploit exceed $100 million in bitcoin. Reporting cited alongside the analysis noted that the cold-wallet attack spread to 4,500 addresses as tracked losses approached $89 million.
The underlying security weakness involved software-based randomness generation. Attackers exploited a flaw that caused affected wallets to generate seed phrases using a weaker software random number source instead of relying on the hardware wallet's dedicated random number generator. That flaw allowed attackers to reconstruct affected wallet seeds.
Firmware remediation and unmitigated risk
Coinkite, the manufacturer of Coldcard, has since patched the firmware. However, funds already exposed under old seeds remain at risk regardless of the patch.
Ethical hackers swept the funds specifically to keep them safe until they could be returned. Victims can search their wallet addresses at cryptorecoverytrust.com to determine whether the whitehats recovered their funds.