White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'

In brief

• White-hat actors moved 40.71 BTC (~$3.31 million) tied to the Coldcard exploit on Sept. 21 in a transaction carrying a “crypto recovery trust” message.
• Galaxy's Alex Thorn said a broader sweep pulled 52.37 BTC from several attacker clusters into a fresh address flagged for the same trust—roughly 2.8% of the total exploit.
• The exploit, which peaked around $130 million, stemmed from a March 2021 Coldcard firmware flaw that made seed phrases guessable.

Some of the Bitcoin stolen in the sprawling Coldcard hardware wallet exploit is being routed toward a recovery effort, with white-hat actors moving funds into what they've labeled a trust for returning the coins.

According to Galaxy Research's blockchain monitoring, 40.71 BTC, worth about $3.31 million, was moved on Sept. 21 in a single transaction that consolidated coins tied to the exploit.

The transfer, spanning 11 addresses across 20 inputs and 480 outputs, carried an OP_RETURN message, a small note embedded in a Bitcoin transaction, reading "claims: cryptorecoverytrust.com." Galaxy attributed the coins to attackers it had tagged as "Footprint AA" and a second-wave hop from the hack.

In a related post, Galaxy's head of research Alex Thorn said a broader sweep pulled 52.37 BTC, drawn from several attacker clusters, into a fresh address flagged for the same Crypto Recovery Trust.