White-hat researchers have transferred 52.37 BTC, recovered from wallets affected by the COLDCARD exploit, into the Wyoming-based Crypto Recovery Trust. This transaction, recorded at block 967,948, accounts for approximately 2.8% of the total funds stolen during the incident.
The exploit, which began on July 30, 2026, resulted in the theft of over 1,500 BTC, with total losses exceeding $100 million. Attackers utilized automated scripts to target wallets generated with faulty entropy, draining 594 BTC within minutes.
The Digital Asset Recovery Trust (DART) organized the recovery effort by identifying vulnerable address clusters. To notify victims, researchers included an OP_RETURN message in the transaction, directing users to the official trust website to file claims.
The Crypto Recovery Trust is a statutory entity advised by the law firm Steptoe LLP. It maintains a strict separation of assets to ensure a clear chain of custody. Researchers involved in the recovery did not request any bounties for their actions.
The vulnerability originated from a firmware build error in specific COLDCARD models, which compromised the hardware random-number generator used for seed phrase creation. The flaw, introduced in a March 2021 update, left devices exposed for over five years.
