White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'

Galaxy Research says white-hat actors consolidated coins tied to the exploit into a fresh address tagged for a "Crypto Recovery Trust," though the funds represent just 2.8% of the total haul.

Sep 22, 2026 Sep 22, 2026

Some of the Bitcoin stolen in the sprawling Coldcard hardware wallet exploit is being routed toward a recovery effort, with white-hat actors moving funds into what they've labeled a trust for returning the coins.

According to Galaxy Research's blockchain monitoring , 40.71 BTC, worth $3.31 million, was moved on Sept. 21 in a single transaction that consolidated coins tied to the exploit.

Myriad: How high will Bitcoin go? Click to make your prediction.

The transfer, spanning 11 addresses across 20 inputs and 480 outputs, carried an OP_RETURN message, a small note embedded in a Bitcoin transaction, reading "claims: cryptorecoverytrust.com." Galaxy attributed the coins to attackers it had tagged as "Footprint AA" and a second-wave hop from the hack.

In a related post, Galaxy's head of research Alex Thorn said a broader sweep pulled 52.37 BTC, drawn from several attacker clusters, into a fresh address flagged for the same Crypto Recovery Trust.

He noted the white-hatted funds represent roughly 2.8% of the total Coldcard exploit, a fraction of the haul that has otherwise remained largely dormant in attacker wallets.

The movement marks a notable turn in one of the year's largest self-custody disasters. The Coldcard exploit stemmed from a March 2021 firmware build error on Coinkite's Coldcard devices that generated seed phrases with far too little randomness, leaving private keys guessable. Because the flaw was baked into how the seed was created, updating the firmware couldn't fix a wallet already generated on a compromised device.

At its peak, the theft grew to roughly $130 million across thousands of addresses, with Galaxy tracking the sweeps as they unfolded in waves. Much of the stolen Bitcoin had sat untouched in attacker addresses for weeks, prompting speculation whether any of it would ever move.

The appearance of a recovery-trust label suggests at least some parties are attempting to shepherd funds back to victims, though the specifics of how the Crypto Recovery Trust would operate, and how owners might claim their coins, weren't detailed in the on-chain messages.

Coinkite has previously urged exposed users to migrate to newly generated seeds and rolled out new security measures in the wake of the breach.

Get crypto news straight to your inbox--

UN Security Council Will Get Advice on AI Risks From Tech Giants Building It

The UN Security Council will spend Wednesday afternoon listening to the people who build the technology it's most worried . OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, AI safety researcher Yoshua Bengio, and Hugging Face CEO Clément Delangue are all scheduled to brief the 15-member council—the UN body with the power to authorize sanctions and military action—on the risks posed by artificial intelligence. Myriad: How low will Nvidia stock go? Click to make your prediction. DeepSeek is...

$161 Million in Decade-Old Bitcoin Has Moved in Just Two Weeks

The steady procession of long-dormant Bitcoin wallets springing back to life is showing no sign of slowing, with four more ancient stashes moving a combined $161 million over the past two weeks. According to Galaxy Research's blockchain monitoring, the awakened wallets moved 1,971.03 BTC in all between Sept. 6 and Sept. 22. The largest, holding 1,260.78 BTC worth $100.63 million, had sat untouched since July 2016, more than 10 years, potentially delivering a gain of roughly 12,122% on a co...

CME Expands Crypto Futures Lineup With Bitcoin Cash and Uniswap

CME Group is adding Bitcoin Cash and Uniswap to its regulated futures lineup. The exchange said Tuesday it plans to launch BCH and UNI contracts on October 19, pending regulatory review. Traders get a choice between standard-sized contracts and smaller micro versions. Bitcoin Cash futures will represent 250 BCH, with micro contracts covering 25 BCH. Uniswap futures will cover 10,000 UNI, and its own micro contracts will trade at 1,000 UNI. Myriad: How high will Bitcoin go? Click to make your pre...

This website or its third-party tools use cookies. By clicking the accept button, you agree to the use of cookies.