White hats move 52.37 BTC from Coldcard wallets to Crypto Recovery Trust
White hats moved 52.37 BTC from Coldcard-related wallets to Crypto Recovery Trust; 3.0134 BTC in the transfer has an uncertain Coldcard origin.
Why it matters
Owners can use Crypto Recovery Trust's public-address search to check whether recovered coins are linked to them, but any return still requires ownership verification. The three accounts describe no wider market, regulatory or company response.
Key facts
Alex Thorn linked 52.37 BTC in Coldcard-related clusters to white-hat recoveries held by Crypto Recovery Trust.
52.37 BTCReported by BTC-ECHO
Alex Thorn said white hats secured about 40% of the bitcoin moved in Coldcard's second attack wave.
40 %Reported by BTC-ECHO
Alex Thorn flagged 3.0134 BTC entering Crypto Recovery Trust from addresses Galaxy had not tracked and said its Coldcard origin remained uncertain.
3.013 BTCReported by BTC-ECHO
DART said in an Aug. 17 report that it and independent researchers had secured just over 50 BTC, according to its internal ledger, and placed the bitcoin with Crypto Recovery Trust.
50 BTCReported by CryptoSlate
BTC-ECHO reported that a random-number generation error made private keys created on affected Coldcard devices easier to calculate than intended.
Reported by BTC-ECHO
CryptoSlate said the trust's eligibility check accepts a public address, requires ownership verification after a match, and excludes seed phrases and private keys.
Reported by CryptoSlate
Block 967,948 contained a transaction that Mempool's status record marked as confirmed.
Reported by CryptoSlate
What happened
Galaxy Digital researcher Alex Thorn linked a 52.37 BTC transfer from Coldcard-related wallets to white-hat recoveries held by Crypto Recovery Trust. BTC-ECHO reported that Thorn estimated white hats secured about 40% of the bitcoin moved in Coldcard's second attack wave. CryptoSlate said DART's Aug. 17 report had already counted just over 50 BTC, so the later trust trace should not be treated as a second rescue. Thorn flagged 3.0134 BTC entering the trust from addresses Galaxy had not tracked; he considered them possible additional recoveries, but their Coldcard origin remained uncertain. Owners can search public addresses through the trust, but CryptoSlate said a match still requires ownership verification and no seed phrase or private key should be submitted.
How the story developed
- First report
First report by BTC-ECHO
Coldcard-Lücke: White Hats bringen 52 Bitcoin vor Angreifern in Sicherheit
- Update
BTC-ECHO reports the trust transfer
BTC-ECHO reported a 52.37 BTC transfer from Coldcard-affected wallets to Crypto Recovery Trust.
- Official statement
Official statement from Bitcoin.com News
White Hats Beat Coldcard Attackers, Rescuing Millions of Dollars in Bitcoin
- Update
CryptoSlate adds the victim claim portal
CryptoSlate added a public-address claim check and said the trust trace should not be counted as a second rescue.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 22 Sept 2026, 13:08 UTC: BTC-ECHO — 1 independent source, 1 reports
- 22 Sept 2026, 21:41 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
- 24 Sept 2026, 01:10 UTC: CryptoSlate — 3 independent sources, 3 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | White Hats Beat Coldcard Attackers, Rescuing Millions of Dollars in Bitcoin | Independent | |
| BTC-ECHO Crypto media | Coldcard-Lücke: White Hats bringen 52 Bitcoin vor Angreifern in Sicherheit | Original | |
| CryptoSlate Crypto media | White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility | Independent |
Related events
White hats move 52.37 bitcoin from Coldcard exploit wallets into Wyoming recovery trust
White-hat hackers moved 52.37 BTC tied to July's Coldcard hardware wallet exploit into a Wyoming-based Crypto Recovery Trust address, Galaxy Digital said.
Galaxy Digital Adds $100 Million of sUSDS to Treasury and Accepts It as Loan Collateral
Galaxy Digital put $100 million of Sky Protocol's sUSDS into its corporate treasury and approved it as collateral for institutional loans while clients keep earning the Sky Savings Rate.
MARA Holdings moves 996 BTC to Galaxy Digital without confirming a sale
MARA Holdings moved 996 BTC worth about $81.13 million to Galaxy Digital, and the transfer on its own does not confirm a sale.
Is MARA preparing another Bitcoin sale after moving 1,000 BTC?
Bitcoin Holds Above $80,000 as Novogratz, Jackson and Fidelity's Timmer Target $100,000
Novogratz, Jackson and Fidelity's Jurrien Timmer each say Bitcoin can reach $100,000 by year-end while it trades in the $80,000s, citing charts, liquidity and portfolio diversification.
