Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust
Summary
Whitehat operators moved 52.37 BTC from wallets affected by the Coldcard exploit to an address linked to a newly formed recovery trust. The funds were consolidated from tracked Wave 2 exploit addresses and confirmed in block 967,948. Galaxy Digital’s Alex Thorn said the transfer equals 2.8% of tracked exploit funds, with about 40% of Wave 2 identified as whitehat activity. Another 3.0134 BTC entered the address, but its link to the exploit is unconfirmed. The July attack exploited a weaker software-based source of randomness in wallet seed generation, exposing funds to recovery by attackers. Coldcard has patched its firmware, but wallets generated with the vulnerable method may remain at risk.
