Galaxy

TRUST

Shift

Rescue

Bitcoin

<h2 id="tldr">TLDR</h2>
<ul>
 <li>White hats rescued 52.37 BTC worth more than $4.5 million from the Coldcard exploit.</li>
 <li>Crypto Recovery Trust now holds the rescued Bitcoin for verified victims to reclaim.</li>
 <li>Galaxy Digital tracked 1,789.28 BTC, worth about $154.1 million, lost in the attacks.</li>
 <li>Coinkite linked the exploit to weak seed generation caused by a firmware flaw.</li>
 <li>Coldcard advised users to update their firmware or move funds from vulnerable devices.</li>
</ul>
<p>The Coldcard hack has entered a recovery phase after white-hat researchers secured 52.37 Bitcoin in a Wyoming trust. Galaxy Digital researcher Alex Thorn said the funds exceed $4.5 million. Crypto Recovery Trust now controls the address and plans to return claims.</p>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/2744.png" alt="❄" style="height: 1em; max-height: 1em;">COLDCARD WHITE HAT MOVES FUNDS TO TRUST <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f3f3.png" alt="🏳" style="height: 1em; max-height: 1em;"></p>
  <p>52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948</p>
  <p>these white hatted funds represent 2.8% of the coldcard exploit <a href="https://t.co/c5eYeQMxHQ" rel="noopener noreferrer nofollow">pic.twitter.com/c5eYeQMxHQ</a></p>
  <p>— Alex Thorn (@intangiblecoins) <a href="https://x.com/intangiblecoins/status/2102114798833946783?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 21, 2026</a></p>
 </blockquote>
</div>
<h2 id="coldcard-hack-funds-enter-recovery-trust">Coldcard Hack Funds Enter Recovery Trust</h2>
<p>Thorn said the rescued Bitcoin represents about 2.8% of funds connected to the exploit. <a href="https://x.com/bax1337/status/2097715822600900839?s=20" rel="noopener noreferrer nofollow">Nick Bax of Ump Labs confirmed</a> he helped protect about 50 BTC. He said thieves were close to taking the funds.</p>
<p>The transfer gives affected Coldcard users a route to recover losses. Another security case saw an<a href="https://blockonomi.com/mev-bot-yoink-stops-7-8m-ethereum-rseth-exploit-in-its-tracks/" rel="noopener noreferrer nofollow"> MEV bot stop an Ethereum wallet exploit</a> before an attacker could drain $7.8 million. KelpDAO froze the destination address for 24 hours.</p>
<h2 id="firmware-bug-exposed-wallet-seeds">Firmware Bug Exposed Wallet Seeds</h2>
<p>The attacks began on July 31 and targeted Bitcoin held through Coinkite’s Coldcard hardware wallets. CoinKite traced the weakness to a firmware bug affecting seed generation. The flaw forced some devices to rely on a software random generator.</p>
<p>Attackers could use predictable seed data to identify wallet credentials and access funds. Galaxy Digital tracked 1,789.28 BTC lost during the attacks. That amount equals about $154.1 million at Bitcoin prices.</p>
<h2 id="users-shift-bitcoin-after-attacks">Users Shift Bitcoin After Attacks</h2>
<p>CoinKite urged users to update affected software or transfer funds away from vulnerable devices. Some users moved Bitcoin to other storage services, including exchanges. The company said the bug remained unnoticed as more product releases carried the faulty code.</p>
<p>Crypto firms have faced other security cases this month. A<a href="https://blockonomi.com/revolut-confirms-data-breach-affecting-680-customers/" rel="noopener noreferrer nofollow"> Revolut customer data breach</a> exposed information from 680 customers after fraudulent requests bypassed verification checks. The company reported the incident to regulators during a security review.</p>
<h2 id="trust-starts-victim-recovery-process">Trust Starts Victim Recovery Process</h2>
<p>Crypto Recovery Trust now holds the rescued assets while it verifies ownership claims from affected users. The Wyoming structure provides a legal process for safeguarding funds during recovery. White hats can use that process while investigators continue tracing stolen Bitcoin.</p>
<p>Security threats also continue across the wider crypto market. A<a href="https://blockonomi.com/north-korean-hackers-exploit-fake-job-listings-to-steal-10-7m-in-cryptocurrency/" rel="noopener noreferrer nofollow"> North Korean crypto theft campaign</a> used fake job offers to compromise more than 30,000 devices. Researchers linked the operation to theft from over 7,000 cryptocurrency wallets.</p>
<p>Investigators continue reviewing the Coldcard hack and tracing addresses tied to stolen funds. CoinKite has urged affected users to follow security guidance. The recovery trust may return rescued Bitcoin after it confirms rightful ownership.</p>
<p>The post <a href="https://blockonomi.com/white-hats-rescue-4-5m-bitcoin-from-coldcard-exploit/" rel="noopener noreferrer nofollow">White Hats Rescue $4.5M Bitcoin From Coldcard Exploit</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

White Hats Rescue $4.5M Bitcoin From Coldcard Exploit

Table of Contents

Blockonomi

Other articles published on Sep 22, 2026

Join our free newsletter for daily crypto updates!