preferred on
Points of Focus
- White hats moved 52.37 BTC tied to the Coldcard exploit into a recovery trust.
- Alex Thorn said the funds represent about 2.8% of tracked exploit funds.
- Galaxy confirmed at least 1,778.84 BTC worth $112.7 million had been stolen by Aug. 14.
White-hat operators moved 52.37 Bitcoin (BTC) linked to July’s Coldcard wallet exploit into a recovery trust, placing part of the rescued Bitcoin into a formal claims process for verified owners.
Galaxy Digital head of research Alex Thorn said the coins came from Wave 2 and three tracked footprints labeled AA, AU, and AX.
The transfer was consolidated in Bitcoin block 967,948 and included an “OP_RETURN” message directing affected users to Crypto Recovery Trust. Thorn said the 52.37 BTC represents about 2.8% of tracked exploit funds, while roughly 40% of Wave 2 has now been identified as white-hat activity.
❄️COLDCARD WHITE HAT MOVES FUNDS TO TRUST 🏳️
52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948
these white hatted funds represent 2.8% of the coldcard exploit pic.twitter.com/c5eYeQMxHQ
— Alex Thorn (@intangiblecoins) September 21, 2026
Recovery trust creates a path for victim claims
The transaction moves the recovery effort from securing vulnerable coins toward verifying who can lawfully reclaim them. The trust is registered as a Wyoming statutory trust, with Agentic Trace LLC serving as trustee.
Digital Asset Recovery Technologies said in an August report that rescued assets are segregated from researcher and operating funds. Its process includes chain-of-custody checks, ownership diligence, exchange-record review, and sanctions screening before assets can be returned.
Thorn also identified another 3.0134 BTC entering the trust address in the same transaction without prior tracking history. He said the coins were likely additional Coldcard funds recovered by white hats, though their origin remains unconfirmed.
52 BTC remains a small share of Coldcard losses
The recovery covers only a fraction of the broader incident. Galaxy reported on Aug. 14 that it had confirmed 1,778.84 BTC worth $112.7 million stolen from more than 8,600 addresses. Including lower-confidence clusters and a suspected fourth wave would raise the estimate to 2,417.35 BTC, then worth about $153 million.
Coinkite’s technical disclosure says Coldcard devices themselves weren’t remotely compromised. A firmware build error dating to the March 2021 libNgU migration caused some wallet seeds to draw randomness from MicroPython’s Yasmarang software generator instead of the intended hardware source. On affected Mk2 and Mk3 devices, Coinkite estimated the effective search space at roughly 40 bits rather than the intended 128 bits.
That weakness allowed attackers to regenerate vulnerable private keys offline and sweep funds without accessing the physical device. Coinkite has patched seed generation, but seeds created under affected firmware still require migration unless users added sufficient independent entropy when creating them.
Galaxy said 1,531 BTC of the confirmed stolen amount remained unmoved in attacker-controlled addresses as of Aug. 14.
The 52.37 BTC transferred to the recovery trust this week represents about 2.8% of tracked exploit funds.
Share
Most read articles
