White-hat hackers have begun moving Bitcoin stolen during the Coldcard hardware wallet exploit into a recovery trust. According to Galaxy Research, 40.71 BTC, valued at approximately $3.31 million, was consolidated into a single transaction on September 21. This transfer included an OP_RETURN message directing users to a recovery website.
Alex Thorn, head of research at Galaxy, reported that a broader sweep successfully recovered an additional 52.37 BTC from multiple attacker clusters. These funds were moved to a new address associated with the same recovery initiative. The total amount of recovered assets represents roughly 2.8% of the total funds stolen in the Coldcard breach.
The exploit originated from a firmware error in Coinkite devices dating back to March 2021, which resulted in insufficient randomness for seed phrase generation. This flaw allowed private keys to be guessed, affecting wallets created on compromised devices. At the peak of the incident, the total value of stolen assets reached approximately $130 million.
While the movement of these funds suggests an effort to return assets to victims, details regarding the operation of the Crypto Recovery Trust remain limited. Coinkite has previously advised affected users to migrate to new seeds and has implemented additional security measures following the incident.
