Home
Cryptocurrency
Cryptocurrency News
Coldcard Whitehats Transfer Stolen 52.37 BTC to Recovery Trust

Coldcard Whitehats Transfer Stolen 52.37 BTC to Recovery Trust

The recovered Bitcoin came from multiple exploit clusters tracked by Galaxy Digital and was consolidated at block 967,948.

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 22 September 2026 19:13 IST

Coldcard Whitehats Transfer Stolen 52.37 BTC to Recovery Trust

Photo Credit: Unsplash/Julio Lopez

The Crypto Recovery Trust holds recovered digital assets while ownership claims are assessed

Click Here to Add Gadgets360 As A Trusted Source

Highlights

The recovery transaction included an OP_RETURN message
DART previously reported recovering more than 50 BTC
At least 15 hackers have been linked to the Coldcard flaw

The Whitehat hackers are working on moving 52.37 BTC, which were involved in the exploit related to the July Coldcard wallet, to a newly created address for the recovery trust. According to Galaxy Digital Research Head Alex Thorn, the Bitcoin originated from the Wave 2 cluster, as well as tracks referred to as AA, AU, and AX, with the consolidation noted on Bitcoin block 967,948. Thorn revealed that the quantity was 2.8 percent of the exploit funds being monitored by his team.

Recovered Bitcoin Undergoes Ownership Checks Before Distribution

The OP_RETURN transaction had a message referring to “claim:cryptorecoverytrust dot com,” according to Thorn. In addition, Galaxy Research has discovered that there was a similar transaction in the same block with 20 inputs and 480 outputs with transaction ID 38b524ccb8ca260ec705ab980982144857c477658fa39591870ee8cb09bcea47. This transaction ensures that a certain portion of the rescued Bitcoin is now held by the Crypto Recovery Trust, which is a Wyoming statutory trust established to hold digital assets recovered from compromised wallets while ownership claims are checked.

Crypto Scams Discussion

Explore More...

:snowflake:COLDCARD WHITE HAT MOVES FUNDS TO TRUST :waving_white_flag:

52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948

these white hatted funds represent 2.8% of the coldcard exploit pic.twitter.com/c5eYeQMxHQ
— Alex Thorn (@intangiblecoins) September 21, 2026

According to Crypto Recovery Trust, their job is to restore the digital assets to their rightful owners through the claims process. According to the website of the company, the legal entity is the “Recovered Digital Asset Statutory Trust of Wyoming,” and Agentic Trace LLC is the trustee.

Digital Asset Recovery Trust (DART) has previously revealed details of its recovery efforts relating to the Coldcard hack prior to the latest consolidation. DART indicated that it and independent Whitehat researchers had managed to recover in excess of 50 BTC from vulnerable addresses by August 17, preventing the funds from falling into the wrong hands.

X Partners With Coinbase, Kraken and Gemini to Launch Cashtag Trading

According to DART, the recovered Bitcoin went into the trust fund instead of being put into researchers' wallets or operational wallets. The process involves blockchain analysis, proof of ownership verification, and sanctions screening before releasing the assets. Money associated with conflicting claims, sanctions issues, or legal processes will be handled differently.

September 21 movement offers a more recent on-chain perspective into recovery operations. While Thorn was able to relate the stolen BTC of 52.37 to the previous exploit clusters, he described them as funds under Whitehat control. The 2.8 percent that Thorn computed is actually based on Galaxy's total tracked exploits.

The Coldcard attack started on July 30, after the attackers exploited the vulnerable Bitcoin wallet seeds generated by the faulty firmware. As described in the present incident report from Coinkite, due to a flaw in the firmware integration process, the seed generation function defaulted to MicroPython's Yasmarang pseudo-random software generator.

Bitcoin Climbs Above $85,000 as ETF Inflows Drive Recovery

As per another report by Thorn in August, at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.

Ripple CEO Says Crypto Sector Can Grow Beyond CLARITY Act

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Crypto Scams, Crypto Frauds, Coldcard wallet

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More