← Editorial Bitcoin

Security Researchers Secure $4.5 Million in Bitcoin Linked to Coldcard Wallet Breach

White-hat actors have moved 52.37 Bitcoin stolen in the Coldcard exploit into a Wyoming-based trust designed to return funds to affected device owners.

· +3

White-hat security researchers have recovered 52.37 Bitcoin, valued at more than $4.5 million, tied to the exploit of Coinkite's Coldcard hardware wallets. The retrieved assets were transferred to an address managed by the Crypto Recovery Trust in Wyoming, creating a mechanism for verified victims to seek the return of their funds.

Galaxy Digital researcher Alex Thorn stated that the rescued coins account for roughly 2.8% of the total funds compromised in the incident. Nick Bax of Ump Labs confirmed his involvement in securing about 50 BTC, noting that unauthorized actors were close to draining those specific holdings. Overall, Galaxy Digital tracked losses of 1,789.28 BTC during the attacks, representing approximately $154.1 million.

Coinkite attributed the vulnerability, which began surfacing on July 31, to a firmware bug that forced certain devices to rely on a software-based random number generator, resulting in predictable seed phrases. The hardware manufacturer urged affected users to update their software or transfer assets away from vulnerable wallets, while multiple product releases had unknowingly carried the faulty code.

How this piece reads Neutral tone +3
Site call on Bitcoin Sell score -25.6

These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.

More on Bitcoin All pieces →

Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.