White hats move 52.37 BTC from Coldcard hack into Wyoming recovery trust
White-hat operators moved 52.37 BTC, about 2.8% of the bitcoin stolen in the Coldcard wallet exploit, into an address controlled by Crypto Recovery Trust, a Wyoming trust set up to return funds to victims.
Alex Thorn, Galaxy Digital’s head of research, identified the sweep in a post on X. He said the coins, drawn from Wave 2 of the attack and attacker clusters tagged Footprints AA, AU and AX, were consolidated into a fresh address in block 967,948 on September 21, with an embedded OP_RETURN note reading “claim:cryptorecoverytrust.com”. Thorn said the 52.37 BTC, roughly $4.5 million at September 21 prices, represents 2.8% of the total Coldcard exploit.
Galaxy Research’s own monitoring posted the core transaction that morning: 40.71 BTC, about $3.31 million, moved in a single 20-input, 480-output batch across 11 addresses. That transaction is a subset of the broader sweep, not a second recovery. Thorn said an extra 3.0134 BTC with no prior tracking history also landed in the trust address in the same transaction, and he stressed that whether those coins are recovered Coldcard funds remains unconfirmed.
Victims can check whether their funds were among those recovered by visiting cryptorecoverytrust.com and searching their wallet addresses. The trust itself has issued no statement; the Wyoming holding rests on Thorn’s on-chain analysis and on Nick Bax of Ump Labs, who wrote on X that he took part in rescuing about 50 BTC at the end of July. “The funds are currently held by a Wyoming trust, which will ensure that funds are returned to their rightful owners,” Bax said. Whether his ~50 BTC is part of the same 52.37 BTC is not confirmed.
The exploit began in late July 2026 and unfolded in waves. It stemmed from a firmware bug confirmed by Coldcard maker Coinkite, which let seed phrases be generated with too little randomness, leaving private keys guessable. Loss totals remain disputed: figures attributed to Galaxy put the haul at 1,789.28 BTC, about $154.1 million as of September 22, while other estimates range from roughly $130 million at peak to over $100 million. Thorn said roughly 40% of Wave 2 has now been identified as white-hat activity, while the rest of the stolen bitcoin has otherwise sat largely dormant in attacker wallets.
Coinkite patched the firmware after the breach and urged exposed users to move funds off affected wallets and migrate to newly generated seeds, since updating could not fix a wallet already created on a compromised device. The claims site is not operated or vetted by any company statement, so victims checking it should treat it as the trust’s own channel.
