Crypto
52 Bitcoin Just Walked Out of a Hacker Wallet and Into a Waiting Room
The white hats left a note on the blockchain this time. On September 21, Alex Thorn, Head of Firmwide Research at Galaxy Research, disclosed that white hat operators had consolidated 52.37 BTC tied to the Coldcard entropy exploit into a fresh address linked to the Crypto Recovery Trust, a Wyoming based statutory trust built to safeguard compromised digital assets and return them to verified original owners. The consolidation landed in Bitcoin block 967,948, and the transaction carried an OP_RETURN message directing victims to the trust's claim site, cryptorecoverytrust dot com.
The coins came from Wave 2 of the exploit and three tracked victim clusters Galaxy labels as footprints AA, AU, and AX, and Thorn estimates the haul at 2.8 percent of the published Coldcard exploit total. Scale is the sobering context. Roughly 40 percent of Wave 2 activity is now classified as white hat, with 45.9 BTC of Wave 2 still exposed to illicit trading, while some 1,393 BTC, about 76 percent of the total loss, remains on chain. The rescue is real and the mountain is still tall.
The trail behind the recovery has its own heroes. Thorn noted the funds appear to be the coins that Nick Bax of the Security Alliance wrote about securing twelve days earlier. Bax said that at the end of July he had helped rescue roughly 50 BTC that were imminently going to be stolen through the Coldcard entropy flaw, and that the funds were placed with a Wyoming trust structured to return them to their rightful owners. Separately, the Digital Asset Recovery Trust said it and independent white hat researchers had recovered more than 50 BTC from vulnerable addresses by August 17.
The trust itself is an interesting piece of infrastructure. Its legal form is the Recovered Digital Asset Statutory Trust of Wyoming, with Agentic Trace LLC serving as trustee, and its stated job is to hold rescued assets while ownership claims are checked and then restore them through a claims process. An additional 3.0134 BTC sent to the same address may also be recovered funds, though that remains unconfirmed. A recovery trust solves the awkward middle chapter of every crypto heist, the stretch after the good guys grab the coins and before the rightful owners get them back, and turns that improvisation into infrastructure.
The hardware side carries its own lesson. Coldcard maker Coinkite says patched firmware fixes future seed generation, though it leaves previously weakened seeds as they are. The current recommended firmware is version 5.6.2 for Mk4 and Mk5 devices and 1.5.2Q for Q devices. Users who generated seeds on affected firmware should treat those wallets as compromised and migrate, because a patch protects tomorrow's keys rather than yesterday's.
Crypto's reputation was built in an era when stolen coins vanished into mixers and stayed gone. The emerging norm looks different, rapid on chain tracking, white hat interception, and neutral custody while claims get sorted. Every successful recovery trains the ecosystem for the next one, and the Coldcard consolidation, OP_RETURN note and all, is the clearest public demonstration yet of the pipeline working end to end.
Quick answers
What is this story about?
The white hats left a note on the blockchain this time. On September 21, Alex Thorn, Head of Firmwide Research at Galaxy Research, disclosed that white hat operators had consolidated 52.37 BTC tied to the Coldcard entropy exploit into a fresh address linked to the Crypto Recovery Trust, a Wyoming based statutory trust built to safeguard compromised digital assets and return them to verified original owners. The consolidation landed in Bitcoin block 967,948, and the transaction carried an OP_RETURN message directing victims to the trust's claim site, cryptorecoverytrust dot com.
Why does this story matter?
Crypto's reputation was built in an era when stolen coins vanished into mixers and stayed gone. The emerging norm looks different, rapid on chain tracking, white hat interception, and neutral custody while claims get sorted. Every successful recovery trains the ecosystem for the next one, and the Coldcard consolidation, OP_RETURN note and all, is the clearest public demonstration yet of the pipeline working end to end.
Sources
- Crypto Times on the Coldcard recovery
- crypto.news on the whitehat transfer
- Gadgets360 on the recovery trust
New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.