White-Hat Researchers Direct 52.37 Bitcoin From Coldcard Exploit to Recovery Trust

Security researchers have moved 52.37 Bitcoin linked to the Coldcard hardware wallet exploit into a dedicated address labeled for the Crypto Recovery Trust. According to Galaxy Research monitoring and head of research Alex Thorn, an initial transaction on September 21 transferred 40.71 BTC worth approximately $3.31 million across 11 addresses, before a broader sweep gathered the full amount into a fresh address in block 967,948.

The consolidating transactions carried an OP_RETURN data message directing users to cryptorecoverytrust.com. Galaxy Research noted that the retrieved coins were drawn from multiple attacker clusters, including groups labeled as Footprints AA, AU, and AX, as well as a second-wave hop from the incident.

Thorn stated that the recovered funds represent about 2.8% of the total assets taken in the exploit, with the remainder staying largely dormant across attacker-controlled wallets. The security incident, which reached an estimated $130 million, originated from a March 2021 firmware flaw in Coinkite's Coldcard devices that produced predictable seed phrases, leaving generated wallets vulnerable to unauthorized access.