Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust

According to Galaxy Digital, the good guys have moved 52 BTC to an address carrying an OP_RETURN message reading "claim:cryptorecoverytrust dot com."

White-hat hackers moved 52.37 Bitcoin linked to the July Coldcard wallet exploit into an address associated with a newly formed recovery trust.

The exploit, which caused more than $100 million in estimated losses, used weak software-based randomness to generate wallet seeds that attackers could reconstruct.

Victims can their wallet addresses at cryptorecoverytrust.com to determine whether the ethical hackers recovered their funds.

“Whitehat operators” have moved 52.37 BTC to an address linked to a newly formed recovery trust, as part of the ongoing fallout from July's Coldcard hardware wallet exploit, according to Galaxy Digital's Head of Research Alex Thorn.

The Coldcard crypto hardware wallet hack began on July 30, with multiple batches (waves 1, 2, and 3) of attacks in subsequent days resulting in estimated losses of over $100 million in bitcoin BTC $86,202.96 .

Attackers exploited this, causing wallets to generate seeds using a weaker software-based random number source instead of the wallet’s dedicated random number generator. That made some seeds vulnerable to reconstruction by hackers.

Coinkite, the maker of Coldcard, has since patched the firmware, though funds already exposed under the old seeds remain at risk regardless of the patch.

According to Thorn, some of the coins moved out of victim wallets weren't taken by malicious actors but by whitehats, or ethical cybersecurity professionals who use hacking skills to find and fix security weaknesses.

These so-called good guys swept the funds specifically to keep them safe until they could be returned.

1 European central banks push to expand stablecoin yield ban to crypto lending and staking 35 minutes ago

2 Bitcoin, ether perpetual volumes on Kalshi are dominated by an unusual, repetitive trade, data shows 2 hours ago

3 Why Payward-backed Reap is betting on non-USD stablecoins for 24/7 cross-border FX settlement 3 hours ago

4 A $3.2 million 'bitcoin butterfly' option trade bets on $95,000 by the end of October 3 hours ago

5 Binance buys $100 million Circle stake in five-year USDC promotion deal 4 hours ago

6 Bitcoin recovers from Asian-session lows as falling oil price supports risk appetite 4 hours ago

7 Live updates: Bitcoin trades near $86,000 as U.S. stocks post small gains 4 hours ago

8 Binance probed by U.S. federal prosecutors for sanctions violations: Bloomberg 5 hours ago

9 Animoca Brands delays IPO plans, suspends merger talks with Currenc 5 hours ago

10 Spot bitcoin ETFs attracted nearly $1 billion on Monday, the 9th largest inflow ever 7 hours ago

The Definitive Stablecoin Landscape Series: Asia Pacific

The Definitive Stablecoin Landscape Series: Asia Pacific

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

Bitcoin, ether perpetual volumes on Kalshi are dominated by an unusual, repetitive trade, data shows

Bitcoin recovers from Asian-session lows as falling oil price supports risk appetite

Live updates: Bitcoin trades near $86,000 as U.S. stocks post small gains

European central banks push to expand stablecoin yield ban to crypto lending and staking

Bitcoin, ether perpetual volumes on Kalshi are dominated by an unusual, repetitive trade, data shows

Why Payward-backed Reap is betting on non-USD stablecoins for 24/7 cross-border FX settlement