White Hats Move Over $4.5 Million in Bitcoin From Compromised Coldcard Wallets to Recovery Trust
White hats safeguard bitcoin from compromised hardware wallets
White hats have moved 52.37 bitcoin — worth over $4.5 million — from compromised Coldcard hardware wallets into a recovery trust established to return funds to victims. Galaxy Digital's Alex Thorn disclosed the transfer on X on Monday.
The funds were taken by white hats to protect potential victims and are now held in an address controlled by Crypto Recovery Trust, a Wyoming trust created to help white hats return stolen funds to their rightful owners.
Key numbers from the coldcard exploit
- 52.37 bitcoin were moved to the recovery trust, representing 2.8% of the total coldcard exploit.
- 1,789.28 bitcoin were lost overall in the attacks, worth approximately $154.1 million at current prices.
- The attacks began on July 31.
How the coldcard vulnerability worked
Canadian company Coinkite produces the Coldcard hardware wallet. The company said a firmware bug caused seed generation to fall back to a weak software pseudorandom number generator instead of the hardware true random number generator. This allowed hackers to essentially guess investors' seedphrases — the secret phrases used to access and recover bitcoin stored in a wallet.
Coinkite acknowledged that the bug "silently went unnoticed" and that its potential impact grew with every product release. Days after the first hack, the company urged investors to update their software or move their funds to other storage solutions.
Recovery efforts and who helped
Nick Bax of Ump Labs, a universal market protocol, said he was involved in helping recover some of the stolen funds. He wrote on X in early September that he helped rescue approximately 50 bitcoin that were "imminently going to be stolen due to the COLDCARD entropy flaw." He confirmed the funds are currently held by the Wyoming trust.
What is confirmed
- White hats moved 52.37 bitcoin (over $4.5 million) from Coldcard wallets to Crypto Recovery Trust.
- A total of 1,789.28 bitcoin ($154.1 million) were lost in the coldcard exploits.
- Coinkite confirmed a firmware bug caused weak seed generation.
- The attacks began July 31.
- Nick Bax helped recover approximately 50 bitcoin.
- The funds are held in a Wyoming trust.
What is still unclear
The exact timeline for when victims will be able to reclaim their funds from the recovery trust is not specified. It is also unclear how many of the affected victims have come forward or what the full process for fund distribution will be.
Why this matters
The coldcard exploit exposed a significant vulnerability in one of the most widely used hardware wallets. Since the attack, cautious investors have been moving their coins to other storage solutions, including exchanges. The incident highlights the risks of hardware wallet firmware bugs and the role white hats play in recovering stolen cryptocurrency.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Critics say DHS financial surveillance of Americans is unconstitutional
Polish prosecutors charge fifth suspect in Zondacrypto collapse
Bitcoin price crosses 200-day moving average for first time since November 2025
