White Hats Move $4.5M in Bitcoin From Coldcard Exploit to Recovery Trust

Coldcard recovery trust — White hat hackers have moved over 52 bitcoins, worth more than $4.5 million, from vulnerable Coldcard hardware wallets to a dedicated recovery trust, according to Galaxy Digital’s Alex Thorn.

Thorn stated on X that the funds were taken by white hats to protect potential victims and are now held in an address controlled by the Crypto Recovery Trust, a Wyoming entity created to facilitate the return of funds. The moved assets represent 2.8% of the total funds lost in the Coldcard exploit.

The exploit stemmed from a firmware bug in Coinkite’s Coldcard devices that caused seed generation to fall back to a weak software-based pseudorandom number generator instead of a secure hardware random number generator. This flaw allowed attackers to guess seed phrases. Galaxy Digital tracked the attacks, which began on July 31, and estimated total losses at 1,789.28 bitcoins, or approximately $154.1 million.

Nick Bax of Ump Labs confirmed his involvement in recovering the funds, stating the rescued bitcoin was “imminently going to be stolen.” Following the disclosure, Coinkite urged users to update their device firmware or move funds to other storage solutions.