- Trending
- Comments
- Latest
White-hat hackers moved 52.37 BTC, worth over $4.4 million, from wallets exposed by the Coldcard firmware exploit into an address controlled by Crypto Recovery Trust, a Wyoming entity set up to return rescued funds to victims, according to blockchain analysis by Galaxy Digital’s Alex Thorn.
The development follows the discovery that certain Coldcard wallet seeds could be reconstructed offline, exposing bitcoin held at vulnerable addresses. As attackers moved to exploit the weakness, security researchers and white-hat operators also began sweeping exposed funds in an effort to prevent further losses.
Thorn identified the 52.37 BTC movement while examining transactions associated with the Coldcard exploit. He said the bitcoin came from several groups of transactions associated with Wave 2 and was consolidated into a new address at block 967,948.
“COLDCARD WHITE HAT MOVES FUNDS TO TRUST,” Thorn wrote Tuesday, describing the transaction in an X post.
According to his analysis, the recovered bitcoin came from “Wave 2, Footprints AA, AU, AX.” The transaction also contained an OP_RETURN message directing observers to “claim:cryptorecoverytrust dot com,” providing an onchain indication of where the funds had been transferred.
Thorn calculated that the 52.37 BTC represented approximately 2.8% of the funds connected to the Coldcard exploit. His findings also altered the understanding of what happened to a significant portion of Wave 2 funds.
“We now know that ~40% of Wave 2 was actually white hats sweeping coins to protect victim funds,” Thorn explained.
He added that those coins “have now apparently been delivered to an address controlled by Crypto Recovery Trust,” a Wyoming trust established to help legitimate white hats return recovered assets to affected victims.
The 52.37 BTC may not represent the entire amount rescued by white-hat operators. Thorn also identified another 3.0134 BTC entering the Crypto Recovery Trust address during the same transaction.
However, the researcher stopped short of definitively linking those coins to the Coldcard exploit.
“We have not seen these coins before,” Thorn wrote, describing them as “presumably” additional Coldcard funds recovered by white hats while acknowledging that their origin had not yet been confirmed.
The uncertainty reflects the broader challenge facing investigators attempting to reconstruct the flow of funds following the Coldcard exploit. Thorn’s accounting of Waves 1, 2 and 3, alongside funds held by the recovery trust, covers 1,393 BTC, equivalent to 76.1% of the published total associated with the incident.
Wave 1 remains untouched at 1,082.57 BTC, while 116.98 BTC from Wave 3 also remains untouched. Another 97.09 BTC was reportedly coinjoined or moved through Thorchain to Ethereum before attackers used Tornado Cash to mix the ether.
By comparison, Footprints AX, AA and AU are now regarded as entirely white-hatted, according to Thorn’s analysis.
Despite the recovery, substantial questions remain over the rest of Wave 2. Thorn said investigators cannot yet determine whether the remaining 60% was taken by malicious attackers or another group of white hats.
“We do not know if the other 60% of funds taken in Wave 2 are also white hats,” Thorn wrote.
He said the remaining funds appear to have been handled by “a different operator (or operators)” from the group whose recovered bitcoin was transferred to Crypto Recovery Trust.
The distinction is important because blockchain movements alone may not immediately establish whether a transaction was intended to steal bitcoin or protect it from another attacker. Thorn has also spoken with individual victims represented across both portions of Wave 2, helping researchers connect the transactions with the broader incident.
The findings therefore provide additional clarity around part of the Coldcard exploit, while leaving the status and operators behind other funds unresolved.
Securing the bitcoin is only one part of the recovery process. Crypto Recovery Trust must also determine which individuals can establish legitimate ownership of the recovered assets.
That presents a particular challenge because both legitimate wallet owners and attackers may possess credentials associated with an affected wallet. When an X user asked Thorn how ownership could be established, he suggested combining several forms of evidence rather than relying on a single test.
“Could do it a few ways,” Thorn replied, adding that “several creates a preponderance.”
Among the evidence he identified were device forensics showing who originally created a seed, exchange know-your-customer records connecting withdrawals to addresses that were later drained, extended public keys previously supplied by victims, and an early FBI report.
Crypto Recovery Trust also provides a mechanism for victims to search their addresses and determine whether their bitcoin may be included among the funds recovered by white hats.
The underlying Coldcard exploit involved a firmware weakness that affected seed generation on certain Coldcard hardware wallets. According to the supplied investigation, the vulnerability ultimately affected more than 8,600 addresses and approximately 1,779 BTC.
The latest findings add an important layer to that incident: while attackers attempted to take advantage of vulnerable wallets, white-hat operators were simultaneously racing to secure exposed funds. At least 52.37 BTC now appears to be under the control of a recovery trust, although ownership verification and the fate of the remaining funds are still being worked out.
For victims of the Coldcard exploit, the recovery effort could therefore become an important step toward determining which bitcoin can ultimately be returned and to whom.
Copyright © 2025 - The Bit Gazette.
