White-hat rescuers move 52.37 BTC to Crypto Recovery Trust

White-hat researchers transferred 52.37 BTC rescued from wallets affected by a Coldcard entropy flaw to the Wyoming-based Crypto Recovery Trust to return funds to victims.

The funds were swept from vulnerable addresses into an address controlled by the trust to secure them while owners are identified.

Alex Thorn, head of research at Galaxy Digital, wrote on X that the 52.37 BTC was moved to the Crypto Recovery Trust on Monday. He added that white hats had swept about 40% of the Bitcoin linked to a second wave of activity tied to the Coldcard issue. Thorn noted that 3.0134 BTC in the transfer came from addresses Galaxy had not previously tracked; those coins are presumed rescued from affected Coldcard wallets but their origin could not be independently confirmed.

Security researcher and SEAL 911 incident responder Nick Bax wrote on Sept. 9 that he helped rescue about 50 BTC at the end of July because the funds were “imminently going to be stolen” due to the Coldcard entropy flaw. Other researchers and ethical hackers have also moved funds they judged to be at immediate risk.

Thorn cited a published tally that links 1,830 BTC across 9,162 addresses to the Coldcard vulnerability. The Crypto Recovery Trust, based in Wyoming, is accepting inquiries from potential victims; owners can enter their wallet addresses on the trust’s website to see whether the trust currently controls funds that belong to them.

The Coldcard issue involves an entropy flaw in some hardware wallets that left private keys or seed material exposed, enabling attackers to derive keys and move funds. After the vulnerability became public, both malicious actors and white-hat rescuers began sweeping affected addresses to consolidate at-risk coins into controlled addresses and allow owners to be identified and balances restored.