White hats move 52.37 bitcoin from Coldcard exploit wallets into Wyoming recovery trust
White-hat hackers moved 52.37 BTC tied to July's Coldcard hardware wallet exploit into a Wyoming-based Crypto Recovery Trust address, Galaxy Digital said.
Why it matters
The transfer moves a small share, about 2.8% of tracked exploit funds, into a formal claims structure for Coldcard hack victims, but most of the funds attackers took remain unrecovered.
Where the sources disagree
Total losses from the Coldcard exploit
more than $100 million (CoinDesk, Crypto.News)
CoinDesk, Crypto.News
1,789.28 BTC, or $154.1 million at current prices (Bitcoin Magazine)
Bitcoin Magazine
peaked around $130 million; separately cites 1,830 BTC across 9,162 addresses (Decrypt, Cointelegraph)
Decrypt, Cointelegraph
Outlets give different total loss figures for the exploit.
Origin/date of Coldcard firmware flaw
stemmed from a March 2021 Coldcard firmware flaw
Decrypt
exploit began July 30/31 with no 2021 origin mentioned
CoinDesk, Bitcoin Magazine, Decrypt
Decrypt says the exploit stemmed from a March 2021 firmware flaw, while other outlets describe the exploit as beginning in July with no reference to a 2021 origin date.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$100 million
CoinDesk
$154.1 million
Bitcoin Magazine
CoinDesk reports $100 million, Bitcoin Magazine reports $154.1 million (35% apart).
amount taken (exploit)
$100 million
CoinDesk
$130 million
Decrypt
CoinDesk reports $100 million, Decrypt reports $130 million (23% apart).
amount taken
$154.1 million
Bitcoin Magazine
$130 million
Decrypt
Bitcoin Magazine reports $154.1 million, Decrypt reports $130 million (16% apart).
Key facts
White-hat operators moved 52.37 BTC linked to the Coldcard exploit into an address associated with the Crypto Recovery Trust.
52.37 BTCReported by CoinDesk
Galaxy Digital's Alex Thorn said the 52.37 BTC represented 2.8% of the exploit funds his team was tracking.
2.8 %Reported by Crypto.News
The Coldcard exploit stemmed from a firmware flaw causing wallets to generate seeds using weak software-based randomness instead of the dedicated hardware random number generator.
Reported by CoinDesk
Coinkite patched the firmware, but wallets already exposed under old seeds remain at risk.
Reported by CoinDesk
A separate transaction on Sept. 21 moved 40.71 BTC (about $3.31 million) tied to the exploit, consolidating coins across 11 addresses, 20 inputs and 480 outputs.
40.71 BTCReported by Decrypt
Security researcher Nick Bax said he helped rescue about 50 BTC at the end of July because the funds were imminently going to be stolen due to the Coldcard entropy flaw.
50 BTCReported by Cointelegraph
Total estimated losses from the Coldcard exploit are reported differently across outlets, ranging from over $100 million to $154.1 million or a peak around $130 million.
Disputed figureReported by CoinDesk
About 40% of the Bitcoin associated with the exploit's second wave was swept by white hats to protect victims' funds.
40 %Reported by Cointelegraph
What happened
Galaxy Digital's Alex Thorn reported that white-hat operators moved 52.37 BTC linked to July's Coldcard hardware wallet exploit into an address tied to a newly formed Crypto Recovery Trust, a Wyoming statutory trust meant to return funds to victims. The transaction carried an OP_RETURN message reading 'claim:cryptorecoverytrust dot com,' and Crypto.News reported it was consolidated in Bitcoin block 967,948 with 20 inputs and 480 outputs. Sources differ on the scale of related activity: Decrypt described a separate Sept. 21 transaction of 40.71 BTC (about $3.31 million) that fed into the broader 52.37 BTC sweep, while Thorn said 3.0134 BTC of the total came from previously untracked addresses of unconfirmed origin. Estimates of total losses from the exploit also vary — CoinDesk and Crypto.News cite over $100 million, Bitcoin Magazine cites 1,789.28 BTC ($154.1 million), and Decrypt says the exploit peaked around $130 million. Coinkite, Coldcard's maker, has patched the firmware flaw that let attackers reconstruct wallet seeds from weak software-based randomness, though wallets exposed under old seeds remain at risk. Security researcher Nick Bax said he helped rescue about 50 BTC in late July because funds were imminently at risk of theft.
How the story developed
- Update
White hats consolidate 40.71 BTC into a single transaction
A transaction on Sept. 21 moved 40.71 BTC tied to the exploit, carrying an OP_RETURN message referencing the recovery trust.
- First report
First report by CoinDesk
Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust
- Update
Coldcard hardware wallet exploit begins
Attackers began exploiting a firmware flaw causing weak seed generation, with multiple attack waves starting around July 30-31.
- Update
Galaxy Digital reports 52.37 BTC swept into Crypto Recovery Trust
Alex Thorn announced on X that white hats moved 52.37 BTC from several attacker clusters into an address tied to the Wyoming-based Crypto Recovery Trust.
- Independent corroboration
Independently corroborated by Crypto.News
Coldcard whitehats move 52.37 BTC to recovery trust
- Update
Nick Bax rescues about 50 BTC from at-risk wallets
Security researcher Nick Bax said he helped rescue roughly 50 BTC in late July that were imminently at risk of theft due to the entropy flaw.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 22 Sept 2026, 06:27 UTC: CoinDesk — 1 independent source, 1 reports
- 22 Sept 2026, 06:29 UTC: Bitcoin Insider — 2 independent sources, 2 reports
- 22 Sept 2026, 07:52 UTC: Crypto.News — 3 independent sources, 3 reports
- 22 Sept 2026, 09:06 UTC: Cointelegraph — 4 independent sources, 4 reports
- 22 Sept 2026, 17:20 UTC: Bitcoin Magazine — 5 independent sources, 5 reports
- 22 Sept 2026, 19:31 UTC: Decrypt — 6 independent sources, 6 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| CoinDesk Crypto media | Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust | Original | |
| Cointelegraph Crypto media | White hats outrun Coldcard hackers in 52-Bitcoin evacuation | Independent | |
| Decrypt Crypto media | White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust' | Independent | |
| Bitcoin Magazine Crypto media | White Hats Move Over $4.5 in Bitcoins From Coldcard to Recovery Trust | Independent | |
| Crypto.News Crypto media | Coldcard whitehats move 52.37 BTC to recovery trust | Independent | |
| Bitcoin Insider Aggregator | White Hats Move 52 BTC Tied to Coldcard Hack Into Recovery Trust | Syndicated |
Related events
Is MARA preparing another Bitcoin sale after moving 1,000 BTC?
Galaxy Digital Adds $100 Million of sUSDS to Treasury and Accepts It as Loan Collateral
Galaxy Digital put $100 million of Sky Protocol's sUSDS into its corporate treasury and approved it as collateral for institutional loans while clients keep earning the Sky Savings Rate.
White hats move 52.37 BTC from Coldcard wallets to Crypto Recovery Trust
White hats moved 52.37 BTC from Coldcard-related wallets to Crypto Recovery Trust; 3.0134 BTC in the transfer has an uncertain Coldcard origin.
MARA Holdings moves 996 BTC to Galaxy Digital without confirming a sale
MARA Holdings moved 996 BTC worth about $81.13 million to Galaxy Digital, and the transfer on its own does not confirm a sale.
Bitcoin Holds Above $80,000 as Novogratz, Jackson and Fidelity's Timmer Target $100,000
Novogratz, Jackson and Fidelity's Jurrien Timmer each say Bitcoin can reach $100,000 by year-end while it trades in the $80,000s, citing charts, liquidity and portfolio diversification.
