White hats recover 52 Bitcoin from Coldcard exploit as owners check claims

White hats recovered roughly 52.37 Bitcoin from Coldcard-related clusters. Galaxy researcher Alex Thorn linked a Sept. 21 Bitcoin transaction to a Crypto Recovery Trust claims reference. The transaction was confirmed in block 967,948, according to Mempool's status record. Thorn said the amount represented 2.8% of the exploit funds Galaxy tracked. Thorn also flagged 3.0134 Bitcoin entering the destination from addresses Galaxy had not previously tracked. He considered those coins possible additional white-hat recoveries, but their Coldcard origin remains uncertain. DART said in an Aug. 17 report that it and independent researchers had secured just over 50 Bitcoin according to its internal ledger. DART said it placed the rescued Bitcoin with Crypto Recovery Trust. Owners can search public Bitcoin addresses at the trust's site. A match can begin an ownership claim. The trust process checks recovery records, chain of custody, and proof of ownership. The process can include source-of-funds and exchange records. Sanctions, competing claims, or other restrictions can affect any return. The Coldcard entropy flaw made some older wallet seeds easier to reconstruct. DART says an existing seed created under affected firmware remains exposed after a firmware update. DART says owners with exposed funds should follow the manufacturer's migration guidance. DART warns users not to send seeds, private keys, PINs, or recovery codes through a web form. The initial address check requires a public address. Proving ownership is a separate step.