Bitcoin · White House · Decrypt
White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'
Compiled by KHAO Editorial — aggregated from 2 sources. See llms.txt for citation guidance.
✓ KHAO Verified
Some of the Bitcoin stolen in the sprawling Coldcard hardware wallet exploit is being routed toward a recovery effort, with white-hat actors moving funds into what they've labeled a trust for returning the coins.
Key facts
- According to Galaxy Research's blockchain monitoring, 40.71 BTC, worth about $3.31 million, was moved on Sept. 21 in a single transaction that consolidated coins tied to the exploit
- 52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948
- The transfer, spanning 11 addresses across 20 inputs and 480 outputs, carried an OP_RETURN message, a small note embedded in a Bitcoin transaction, reading "claims: cryptorecoverytrust.com
- In a related post, Galaxy's head of research Alex Thorn said a broader sweep pulled 52.37 BTC, drawn from several attacker clusters, into a fresh address flagged for the same Crypto Recovery Trust
Summary
White-hat actors moved 40.71 BTC (~$3.31 million) tied to the Coldcard exploit on Sept. 21 in a transaction carrying a “crypto recovery trust” message. Galaxy's Alex Thorn said a broader sweep pulled 52.37 BTC from several attacker clusters into a fresh address flagged for the same trust—roughly 2.8% of the total exploit. The exploit, which peaked around $130 million, stemmed from a March 2021 Coldcard firmware flaw that made seed phrases guessable. According to Galaxy Research's blockchain monitoring, 40.71 BTC, worth about $3.31 million, was moved on Sept. 21 in a single transaction that consolidated coins tied to the exploit.