White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'
White-hat actors have moved part of the Bitcoin stolen in the Coldcard hardware wallet exploit into a recovery effort labeled the Crypto Recovery Trust. Galaxy Research tracked 40.71 BTC, worth about $3.31 million, consolidated on Sept. 21 from 11 addresses tied to the hack and marked with an OP_RETURN message pointing to “cryptorecoverytrust.com.” In a broader sweep, 52.37 BTC from several attacker clusters was sent to a fresh address with the same recovery label. That amount is about 2.8% of the total Coldcard theft. The exploit came from a March 2021 Coldcard firmware error that generated weak seed phrases, making private keys guessable and leaving affected wallets permanently vulnerable. The theft ultimately reached about $130 million across thousands of addresses, and much of the stolen BTC had remained dormant until now.
