White Hats Return 52.37 BTC to Victims of COLDCARD Exploit
Researchers moved 52.37 BTC to the Crypto Recovery Trust, covering 2.8% of the over $100 million drained from vulnerable wallets.
Key points
- White-hat researchers moved 52.37 BTC to the Crypto Recovery Trust for victim reimbursement.
- The COLDCARD exploit drained over 1,500 BTC, resulting in losses exceeding $100 million.
- A firmware error from 2021 compromised the hardware random-number generator for five years.
White-hat researchers transferred 52.37 BTC to a recovery address for victims. This action covers roughly 2.8% of the total funds lost in the COLDCARD exploit.
The transfer occurred around block 967,948 on the Bitcoin blockchain. It was organized by the Digital Asset Recovery Trust to secure assets before malicious actors could sweep them.
Attackers Drained Over 1,500 BTC
Attackers siphoned an estimated 1,500 BTC from compromised hardware wallets. Total losses surpassed $100 million during the initial phase of the breach.
The exploit began on July 30, 2026, with 594 BTC drained within minutes. Automated scripts likely scanned the blockchain for addresses generated with faulty entropy.
Trust Structure Protects Recovered Funds
The Crypto Recovery Trust is a Wyoming-based statutory entity. It is advised by Steptoe LLP, a major international law firm.
Recovered funds are held separately to prevent commingling with operational costs. This structure establishes a clear chain of custody for eventual disbursement to rightful owners.
Firmware Flaw Persisted for Five Years
The vulnerability originated in a firmware build error from March 2021. It compromised the hardware random-number generator responsible for seed phrase entropy.
Coinkite acknowledged the issue and released emergency firmware updates. The flaw allowed attackers to reconstruct seed phrases offline without network access.
