White Hats Move 52 BTC from Coldcard Exploit to Crypto Recovery Trust
A group of white-hat operators has moved 52.37 Bitcoin tied to the July Coldcard hardware wallet exploit into an address associated with the Crypto Recovery Trust, according to Galaxy Digital head of research Alex Thorn.
The transfer carried an OP_RETURN message reading 'claim:cryptorecoverytrust dot com' and was recorded in Bitcoin block 967,948, Thorn said. The amount represented 2.8% of the total tracked exploit funds.
Thorn described the 52.37 BTC as part of a sweep of Wave 2 cluster funds. Additionally, he noted that 3.0134 BTC included in the transfer came from addresses Galaxy had not previously tracked, with the origin of those coins remaining unconfirmed.
The Coldcard problem was caused by a firmware seed-generation failure, where a defect routed seed generation to MicroPython's Yasmarang software pseudorandom generator instead of the device's hardware random number generator. This vulnerability allowed attackers to reconstruct wallet seeds offline due to reduced randomness.