Coldcard hardware wallet owners can now publicly check whether white hats recovered Bitcoin from their accounts following a firmware vulnerability. Galaxy researcher Alex Thorn linked a September 21 Bitcoin transaction to roughly 52.37 BTC from Coldcard-related wallet clusters, directing owners to search their public addresses through the Crypto Recovery Trust portal.
The transaction, confirmed in block 967,948, represents 2.8% of the total exploit funds Galaxy has tracked. Thorn also identified an additional 3.0134 BTC from previously unknown addresses that may represent white-hat recoveries, though their Coldcard origin remains uncertain.
How the recovery verification process works
Finding a matching address is only the first step. DART, the digital-asset recovery firm managing the recovery process, conducts verification checks including chain of custody, proof of ownership, exchange records, and source-of-funds documentation. Sanctions, competing claims, or other legal restrictions can affect whether recovered funds are returned.
The Coldcard firmware flaw enabled certain older wallet seeds to be more easily reconstructed. DART warns that seeds created under affected firmware versions remain vulnerable even after updates, and recommends users follow the manufacturer's migration guidance.
Security precautions for claimants
Users checking eligibility should never submit seed phrases, private keys, PINs, or recovery codes through web forms. The initial address check requires only a public Bitcoin address, while ownership verification is handled separately as part of the claim process.
In August, DART reported that it and independent researchers had secured just over 50 BTC and placed the recovered funds with Crypto Recovery Trust. The September transaction provides the first public record of this recovery.
