White Hats Outpace Coldcard Hackers, Funnel 52.37 BTC Into Recovery Trust 🥶

White-hat actors have consolidated 52.37 BTC tied to the Coldcard hardware wallet exploit into an address controlled by Wyoming-based Crypto Recovery Trust, according to Galaxy Digital head of research Alex Thorn. In an X post on Monday, Thorn said the transfer drew funds from multiple attacker clusters associated with the Coldcard vulnerability, including a second-wave hop and addresses Galaxy had not previously tracked. He noted that 3.0134 BTC included in the transfer came from addresses Galaxy could not definitively link to the exploit.

The broader movement included a Sept. 21 transaction that moved 40.71 BTC, worth about $3.31 million, consolidating coins from 11 addresses across 20 inputs and 480 outputs into a single address. The transaction carried an OP_RETURN message reading "claims: cryptorecoverytrust.com." Galaxy attributed those coins to attackers it had tagged as "Footprint AA" and to a second-wave hop from the hack.

Thorn said the white-hatted funds represent approximately 2.8% of the total Coldcard exploit, which Galaxy has tracked at 1,830 BTC across 9,162 addresses. Security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped rescue about 50 BTC at the end of July because the funds were "imminently going to be stolen" due to the Coldcard entropy flaw.

The exploit stemmed from a March 2021 firmware build error on Coinkite's Coldcard devices that generated seed phrases with insufficient randomness, leaving private keys guessable. Because the flaw originated in how the seed was created, firmware updates could not remediate wallets already generated on compromised devices. At its peak, the theft grew to roughly $130 million across thousands of addresses, with Galaxy monitoring the sweeps in waves.

Potential victims can enter their wallet addresses on the Crypto Recovery Trust website to determine whether the trust controls their funds. Coinkite has previously urged exposed users to migrate to newly generated seeds and rolled out new security measures following the breach.