Coldcard Whitehats Transfer Stolen 52.37 BTC to Recovery Trust

The Whitehat hackers are working on moving 52.37 BTC, which were involved in the exploit related to the July Coldcard wallet, to a newly created address for the recovery trust. According to Galaxy Digital Research Head Alex Thorn, the Bitcoin originated from the Wave 2 cluster, as well as tracks referred to as AA, AU, and AX, with the consolidation noted on Bitcoin block 967,948. Thorn revealed that the quantity was 2.8 percent of the exploit funds being monitored by his team.

Recovered Bitcoin Undergoes Ownership Checks Before Distribution

The OP_RETURN transaction had a message referring to “claim:cryptorecoverytrust dot com,” according to Thorn. In addition, Galaxy Research has discovered that there was a similar transaction in the same block with 20 inputs and 480 outputs with transaction ID 38b524ccb8ca260ec705ab980982144857c477658fa39591870ee8cb09bcea47. This transaction ensures that a certain portion of the rescued Bitcoin is now held by the Crypto Recovery Trust, which is a Wyoming statutory trust established to hold digital assets recovered from compromised wallets while ownership claims are checked.  

According to Crypto Recovery Trust, their job is to restore the digital assets to their rightful owners through the claims process. According to the website of the company, the legal entity is the “Recovered Digital Asset Statutory Trust of Wyoming,” and Agentic Trace LLC is the trustee.

Digital Asset Recovery Trust (DART) has previously revealed details of its recovery efforts relating to the Coldcard hack prior to the latest consolidation. DART indicated that it and independent Whitehat researchers had managed to recover in excess of 50 BTC from vulnerable addresses by August 17, preventing the funds from falling into the wrong hands.

According to DART, the recovered Bitcoin went into the trust fund instead of being put into researchers' wallets or operational wallets. The process involves blockchain analysis, proof of ownership verification, and sanctions screening before releasing the assets. Money associated with conflicting claims, sanctions issues, or legal processes will be handled differently.

September 21 movement offers a more recent on-chain perspective into recovery operations. While Thorn was able to relate the stolen BTC of 52.37 to the previous exploit clusters, he described them as funds under Whitehat control. The 2.8 percent that Thorn computed is actually based on Galaxy's total tracked exploits.

The Coldcard attack started on July 30, after the attackers exploited the vulnerable Bitcoin wallet seeds generated by the faulty firmware. As described in the present incident report from Coinkite, due to a flaw in the firmware integration process, the seed generation function defaulted to MicroPython's Yasmarang pseudo-random software generator.

As per another report by Thorn in August, at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.