Bitcoin holders who lost funds in the July Coldcard firmware exploit have a new avenue for recovery. On September 21, ethical hackers consolidated 52.37 BTC, worth roughly $4.5 million, into a fresh address carrying an OP_RETURN message pointing to cryptorecoverytrust.com. The transfer was confirmed in block 967,948.
The move was flagged by Alex Thorn, head of research at Galaxy, who wrote on social media: "COLDCARD WHITE HAT MOVES FUNDS TO TRUST 52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN 'claim:cryptorecoverytrust dot com' in block 967,948 these white hatted funds represent 2.8% of the coldcard exploit." His remarks were cited by CoinDesk on September 22.
How the theft unfolded
The original breach struck on July 30, when attackers drained 594 BTC from roughly 500 addresses in just 25 minutes. Coinkite, the maker of Coldcard, traced the root cause to a firmware flaw that generated seeds from a predictable software randomness source instead of the device's dedicated security chip, leaving keys vulnerable to brute-force guessing. Coinkite has since said that a firmware update alone does not remedy wallets already affected; Mk2 and Mk3 devices set up before the fix need an entirely new seed.
Subsequent waves widened the damage. Galaxy Research puts the total stolen across all waves at around 1,830 BTC. Notably, the firm estimates that about 40% of the funds taken in the second wave were actually seized by security researchers rather than thieves, racing to secure exposed coins before malicious actors could. As of the end of August, 87% of the stolen bitcoins remained in the attackers' addresses.
The composition of the recovered funds
The 52.37 BTC moved into the trust breaks down as 30.19 BTC from the second wave, 17.98 BTC tied to an address group internally labelled "AX," small amounts from two further groups, and about 3 BTC of unaccounted origin.
A Wyoming structure for returning coins
The funds now sit with the Recovered Digital Asset Statutory Trust of Wyoming, a Wyoming statutory trust operating as the Crypto Recovery Trust, with Agentic Trace LLC serving as trustee. Lawyers from the national security practice of Steptoe are advising the structure. The rescues were coordinated by DART, a digital asset recovery specialist group, which said on August 17 it had secured "un peu plus de 50 BTC" at that point.
To claim funds, the trust says holders need only sign a unique message using keys that never leave their home setup — no seed phrase, private key or PIN is required. Claimants are checked against sanctions lists before any bitcoin is returned, and the trust states it charges no fees for the process.
