White hats move 52.37 BTC from Coldcard hack to recovery trust

Galaxy Digital’s Alex Thorn said on X on Monday that white hats moved 52.37 bitcoin from hacked Coldcard signing devices to protect potential victims. The bitcoin, worth over $4.5 million at today’s prices, is apparently held at an address controlled by Crypto Recovery Trust. The Wyoming trust was created to help white hats return funds to victims. Thorn said the moved bitcoin represented 2.8% of the Coldcard exploit. Criminals began taking bitcoin stored with Coinkite’s Coldcard hardware wallet on July 31. Coinkite said a firmware bug caused seed generation to fall back to a weak software pseudorandom number generator instead of the hardware true random number generator. The company said this allowed hackers to essentially guess investors’ seed phrases. Galaxy Digital tracked the movement of the funds and said 1,789.28 bitcoin were lost in the attacks. That amount was worth $154.1 million at today’s prices. Earlier this month, Nick Bax of universal market protocol Ump Labs said he was involved in helping recover the funds. Bax said he had been involved at the end of July in rescuing about 50 bitcoin that were imminently going to be stolen because of the Coldcard entropy flaw. He said the funds were being held by a Wyoming trust that would ensure they were returned to their rightful owners. Since the attack, cautious investors have been moving their coins to other storage solutions, including exchanges. Coinkite said the software bug silently went unnoticed and that its potential impact grew with every product release. Days after the first hack, the company urged investors to update their software or move their funds off the Coldcard hardware wallet.