White Hats Out-Sweep Coldcard Hacker, Dump 52 $BTC Into Recovery Vault 🧤

White-hat responders have transferred Bitcoin they rescued from wallets exposed by a Coldcard vulnerability into a trust established to return the funds to their rightful owners. A total of 52.37 BTC was moved to an address controlled by Wyoming-based Crypto Recovery Trust, according to an X post Monday from Alex Thorn, head of research at Galaxy Digital.

Roughly 40% of the Bitcoin associated with a second wave of exposure was swept by white hats to safeguard victims' funds, Thorn said. He noted that 3.0134 BTC included in the transfer came from addresses Galaxy had not previously tracked, funds the firm presumes were also rescued from wallets affected by the Coldcard flaw, though Galaxy could not independently confirm their origin.

Security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped rescue about 50 Bitcoin at the end of July because the funds were "imminently going to be stolen" due to the Coldcard entropy flaw. Thorn cited a published total of 1,830 BTC across 9,162 addresses linked to the Coldcard vulnerability.

Potential victims can enter their wallet addresses on the Crypto Recovery Trust website to determine whether the trust controls their funds. Thorn did not immediately respond to a request for comment, and Galaxy Digital, Bax and Crypto Recovery Trust have not publicly commented beyond the cited statements.