A group of white hat hackers has secured 52.37 BTC from the Coldcard exploit before malicious attackers could access the funds, according to analysis by Alex Thorn, Head of Firmwide Research at Galaxy Digital. The bitcoin has been consolidated into an address controlled by Crypto Recovery Trust, a Wyoming trust established to facilitate the return of recovered assets to legitimate victims.
The Coldcard exploit began in late July when attackers discovered that some Coldcard wallet seeds could be reconstructed offline. This vulnerability affected more than 8,600 addresses and approximately 1,779 BTC in total. As attackers began draining vulnerable wallets, a separate group of white hat hackers apparently raced to reach the exposed funds first.
Thorn identified the white hat activity through an on-chain transaction that included an OP_RETURN message reading "claim:cryptorecoverytrust dot com," leaving a clear marker of the recovered bitcoin's destination. According to Thorn's analysis, the 52.37 BTC represents 2.8% of the total Coldcard exploited funds.
Wave 2 Recovery Efforts
The white hat intervention significantly changes the accounting of one major transaction group being tracked by researchers. Thorn determined that approximately 40% of Wave 2 funds were actually swept by white hats protecting victim assets. These coins have now been delivered to the Crypto Recovery Trust address.
An additional 3.0134 BTC also entered the Crypto Recovery Trust address in the same transaction, though Thorn noted his team has not yet confirmed whether these coins originate from the Coldcard exploit.
Tracking the Remaining Funds
Thorn's accounting of Waves 1, 2, and 3 covers 1,393 BTC, representing 76.1% of the published Coldcard exploited total. Wave 1 remains largely untouched at 1,082.57 BTC. Wave 3 has 116.98 BTC untouched, while 97.09 BTC was routed through coinjoins, Thorchain, and Ethereum before being mixed with Tornado Cash. Footprints AX, AA and AU are now considered fully white-hatted.
The fate of the remaining 60% of Wave 2 funds remains unclear. Thorn stated that researchers do not yet know whether these funds were taken by malicious attackers or by another group of white hats operating separately from the group that moved bitcoin to the recovery trust.
Ownership Verification Challenges
Recovering the funds presents a verification challenge: determining rightful ownership when both victims and attackers may possess credentials capable of accessing the wallet. Thorn suggested that multiple forms of evidence could be combined to establish ownership, including device forensics showing seed creation, exchange know-your-customer records documenting withdrawals to subsequently drained addresses, victim-provided extended public keys, and FBI reports.
Crypto Recovery Trust allows Coldcard victims to search their addresses to determine whether their bitcoin may be among the rescued funds.
