White-hat actors move Coldcard exploit Bitcoin into recovery trust

White-hat actors are moving Bitcoin stolen in the Coldcard hardware wallet exploit into addresses labeled for a Crypto Recovery Trust. According to Galaxy Research's blockchain monitoring, 40.71 BTC, worth about $3.31 million, moved on Sept. 21 in a single transaction that consolidated coins tied to the exploit. The transfer spanned 11 addresses, 20 inputs and 480 outputs. It included an OP_RETURN note reading "claims: cryptorecoverytrust.com." Galaxy attributed the coins to attackers it had tagged as "Footprint AA" and to a second-wave hop from the hack. In a related post, Galaxy head of research Alex Thorn said a broader sweep moved 52.37 BTC from several attacker clusters into a fresh address flagged for the same Crypto Recovery Trust. Thorn said the white-hat funds represented roughly 2.8% of the total Coldcard exploit, while most of the stolen Bitcoin had remained largely dormant in attacker wallets. The exploit stemmed from a March 2021 Coldcard firmware flaw on Coinkite devices that generated seed phrases with too little randomness, leaving private keys guessable. Updating the firmware could not fix wallets that had already been generated on compromised devices. The theft reached roughly $130 million across thousands of addresses, and Galaxy tracked the movement in waves. The recovery-trust label suggests that some parties are attempting to return funds to victims, but the on-chain messages did not detail how the trust would operate or how owners could claim their coins. Coinkite previously urged exposed users to migrate to newly generated seeds and introduced new security measures after the breach.