White Hat Hackers Move 52 Bitcoin Into Recovery Trust After Coldcard Exploit

Ethical security researchers have moved more than 52 bitcoin into a newly established recovery trust, part of an ongoing effort to safeguard funds affected by a major hardware wallet exploit earlier this year.

Background on the Coldcard Exploit

The vulnerability, first identified in late July, allowed attackers to exploit a flaw causing certain wallets to generate seed phrases using a weaker random number source instead of the device’s dedicated security mechanism, making some funds vulnerable to reconstruction. The exploit unfolded across multiple waves of attacks and resulted in estimated losses exceeding $100 million in bitcoin. The manufacturer has since released a firmware patch, though funds already exposed under compromised seeds remain at risk regardless of the fix.

White-Hat Recovery Effort Continues

According to research from Galaxy, some of the funds moved out of affected wallets were not taken by malicious actors but instead swept by ethical security researchers working to protect the coins until they can be returned to their rightful owners. The latest transaction consolidated funds from a specific wave of tracked exploit activity, moving them into an address tied to the recovery initiative.

Researchers estimate this batch represents a small percentage of the total tracked funds, with a significant portion of that particular wave now believed to be linked to white-hat recovery efforts rather than theft. An additional untracked amount was also included in the same transaction, though its origin remains unconfirmed. Affected users can check whether their funds were among those recovered by searching their wallet addresses on the recovery trust’s website.