Coldcard Capers: White Hats Swoop In, Sweep 52 BTC Into Recovery Trust 🧊

White-hat operators have consolidated 52.37 BTC linked to the Coldcard hardware wallet exploit into a single address associated with the newly formed Crypto Recovery Trust, according to Galaxy Digital head of research Alex Thorn. The transfer, confirmed in block 967,948 on Sept. 21, carried an OP_RETURN message reading "claims: cryptorecoverytrust.com" and spanned 11 addresses across 20 inputs and 480 outputs, with Galaxy attributing the consolidated coins to attacker clusters it has tagged "Footprint AA" and a second-wave hop from the hack. The white-hatted funds represent roughly 2.8% of the total tracked Coldcard exploit, and approximately 40% of the Bitcoin tied to the second wave has now been identified as whitehat activity. Thorn noted that an additional 3.0134 BTC with no prior tracking history also flowed into the Crypto Recovery Trust address, which he said is presumably also rescued from Coldcard-affected wallets, though he stressed Galaxy could not confirm the funds' origin.

The Crypto Recovery Trust is a Wyoming-based entity set up to return the funds to victims, and potential claimants can enter their wallet addresses on the trust's website, cryptorecoverytrust.com, to determine whether the trust controls their funds. Security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped rescue about 50 Bitcoin at the end of July because the funds were "imminently going to be stolen" due to the Coldcard entropy flaw. Galaxy has cited a published total of 1,830 BTC across 9,162 addresses linked to the Coldcard vulnerability.

The Coldcard exploit stemmed from a March 2021 firmware build error on Coinkite's devices that generated seed phrases with insufficient randomness, leaving private keys guessable. Because the flaw was baked into how the seed was created, updating the firmware cannot fix a wallet already generated on a compromised device. The exploit began on July 30, with multiple waves in subsequent days producing estimated losses of more than $100 million in $BTC, which traded at $84,468.42. Coinkite has since patched the firmware and urged exposed users to migrate to newly generated seeds. A related third-wave attacker has moved 45% of stolen Bitcoin, underscoring that, even as white hats consolidate recoveries, portions of the Coldcard haul remain in adversarial hands.