White Hats Rescue $1.5M in Bitcoin from Coldcard Exploit

The aftermath of the Coldcard exploit in July 2026 continues to unfold. According to Alex Thorn, Head of Firmwide Research at Galaxy, a group of white-hat researchers has moved 52.37 BTC from wallets affected by the Coldcard exploit into an address controlled by the Crypto Recovery Trust (CRT). This transfer was part of the money that researchers think was recovered from weak wallets before the criminals could steal it.

Of the 52.37 Bitcoin, approximately 30.18 BTC originated from Wave 2, while roughly 17.98 BTC came from a group of addresses referred to as Footprint AX. Minimal amounts worth 1.19 BTC were routed from Footprints AA and AU, and an additional 3.0134 BTC also entered the same transaction from an unidentified source.

Interestingly, the blockchain transaction included an OP_RETURN message containing 'claim:cryptorecoverytrust.com,' directing affected users toward the recovery process. Thorn noted that researchers do not know whether the other roughly 60% of Wave 2 was also moved by white hats.