TLDR
- White hats rescued 52.37 BTC worth more than $4.5 million from the Coldcard exploit.
- Crypto Recovery Trust now holds the rescued Bitcoin for verified victims to reclaim.
- Galaxy Digital tracked 1,789.28 BTC, worth about $154.1 million, lost in the attacks.
- Coinkite linked the exploit to weak seed generation caused by a firmware flaw.
- Coldcard advised users to update their firmware or move funds from vulnerable devices.
The Coldcard hack has entered a recovery phase after white-hat researchers secured 52.37 Bitcoin in a Wyoming trust. Galaxy Digital researcher Alex Thorn said the funds exceed $4.5 million. Crypto Recovery Trust now controls the address and plans to return claims.
COLDCARD WHITE HAT MOVES FUNDS TO TRUST
52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN “claim:cryptorecoverytrust dot com” in block 967,948
these white hatted funds represent 2.8% of the coldcard exploit pic.twitter.com/c5eYeQMxHQ
— Alex Thorn (@intangiblecoins) September 21, 2026
Coldcard Hack Funds Enter Recovery Trust
Thorn said the rescued Bitcoin represents about 2.8% of funds connected to the exploit. Nick Bax of Ump Labs confirmed he helped protect about 50 BTC. He said thieves were close to taking the funds.
The transfer gives affected Coldcard users a route to recover losses. Another security case saw an MEV bot stop an Ethereum wallet exploit before an attacker could drain $7.8 million. KelpDAO froze the destination address for 24 hours.
Firmware Bug Exposed Wallet Seeds
The attacks began on July 31 and targeted Bitcoin held through Coinkite’s Coldcard hardware wallets. CoinKite traced the weakness to a firmware bug affecting seed generation. The flaw forced some devices to rely on a software random generator.
Attackers could use predictable seed data to identify wallet credentials and access funds. Galaxy Digital tracked 1,789.28 BTC lost during the attacks. That amount equals about $154.1 million at Bitcoin prices.
Users Shift Bitcoin After Attacks
CoinKite urged users to update affected software or transfer funds away from vulnerable devices. Some users moved Bitcoin to other storage services, including exchanges. The company said the bug remained unnoticed as more product releases carried the faulty code.
Crypto firms have faced other security cases this month. A Revolut customer data breach exposed information from 680 customers after fraudulent requests bypassed verification checks. The company reported the incident to regulators during a security review.
Trust Starts Victim Recovery Process
Crypto Recovery Trust now holds the rescued assets while it verifies ownership claims from affected users. The Wyoming structure provides a legal process for safeguarding funds during recovery. White hats can use that process while investigators continue tracing stolen Bitcoin.
Security threats also continue across the wider crypto market. A North Korean crypto theft campaign used fake job offers to compromise more than 30,000 devices. Researchers linked the operation to theft from over 7,000 cryptocurrency wallets.
Investigators continue reviewing the Coldcard hack and tracing addresses tied to stolen funds. CoinKite has urged affected users to follow security guidance. The recovery trust may return rescued Bitcoin after it confirms rightful ownership.
The post White Hats Rescue $4.5M Bitcoin From Coldcard Exploit appeared first on Blockonomi.
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.