Whitehat operators move 52.37 BTC after Coldcard hack

Whitehat operators moved 52.37 BTC from victim wallets to an address linked to a newly formed recovery trust, according to Galaxy Digital Head of Research Alex Thorn. The transfer was part of the fallout from the Coldcard hardware wallet hack, which began on July 30 and involved multiple attack waves known as waves 1, 2 and 3. The attacks caused estimated losses of more than $100 million in bitcoin. Attackers exploited a weakness that caused some wallets to generate seeds using a weaker software-based random number source instead of the wallet's dedicated random number generator. This made some seeds vulnerable to reconstruction by hackers. Coinkite, the maker of Coldcard, has since patched the firmware, but funds exposed under the old seeds remain at risk despite the patch. Thorn said some coins moved from victim wallets were taken by whitehats, or ethical cybersecurity professionals, rather than malicious actors. The whitehats swept the funds to keep them safe until they could be returned. Victims can search their wallet addresses at cryptorecoverytrust.com to determine whether their funds were recovered.