On September 21, 2026, Galaxy Digital Head of Research Alex Thorn reported that white-hat operators moved 52.37 BTC tied to the Coldcard exploit into a newly created address linked to the Crypto Recovery Trust. The transaction was confirmed in Bitcoin block 967,948, and the recovered funds were consolidated under a structure intended to support victim claims and eventual restitution.
According to Thorn, the 52.37 BTC comprised coins from Wave 2, with tracked footprints labeled AA, AU, and AX, and represented approximately 2.8% of total Coldcard exploit funds identified in his analysis. He added that roughly 40% of Wave 2 activity has now been classified as white-hat, while an additional 3.0134 BTC sent to the same address may also be recovered funds, though that remains unconfirmed.
The transfer included an OP_RETURN message directing affected users to cryptorecoverytrust.com to check potential claims. The next step is verification and eventual distribution to rightful owners through the recovery trust. Meanwhile, Thorn’s tracking work continues to distinguish white-hat recoveries from funds still controlled by malicious actors.
Coldcard is a Bitcoin-only hardware wallet built by Coinkite and widely used by self-custody practitioners. The reported involvement of white-hat researchers suggests the recovery required specialized expertise, though specific operational details, including the recovery technique and timeline, have not been fully disclosed by primary sources. The incident underscores that seed phrase backup integrity remains a critical factor in long-term Bitcoin custody.
