Белые хакеры перевели 52,37 Bitcoin в траст для восстановления Coldcard

CoinPulseHq · 2026-09-23T09:40:29.000Z

Исследователи с «белой шляпой» перевели еще 52,37 Bitcoin из кошельков, скомпрометированных эксплойтом Coldcard, на адрес, контролируемый Crypto Recovery Trust (CRT), заявил руководитель направления Galaxy head of firmwide research Алекс Торн, сообщает Ambcrypto. Перевод был выполнен, когда Bitcoin находился на блоке 967,948. Эти средства являются частью денег, которые исследователи считают украденными из слабых кошельков до того, как атакующие начали действовать. Ambcrypto сообщила, что около 30,18 BTC из общей суммы поступили из Wave 2, а примерно 17,98 BTC были получены с адресного кластера, отслеживаемого как Footprint AX. Cointelegraph отдельно сообщила, что «белые хакеры» зачистили примерно 40% Bitcoin, связанных со второй волной эксплойта, переместив их в доверительный фонд, базирующийся в Вайоминге, который был создан для возврата средств жертвам.

White-hat researchers moved another 52.37 Bitcoin out of wallets compromised by the Coldcard exploit and into an address controlled by the Crypto Recovery Trust (CRT), Galaxy head of firmwide research Alex Thorn said, according to Ambcrypto. The transfer was executed when Bitcoin was at block 967,948.
The funds are part of the money researchers believe was pulled from weak wallets ahead of the attackers. Ambcrypto reported that about 30.18 BTC of the total came from Wave 2, while roughly 17.98 BTC originated from an address cluster tracked as Footprint AX. Cointelegraph separately reported that white hats swept about 40% of the Bitcoin tied to the exploit's second wave, moving it to a Wyoming-based trust set up to return funds to victims.
The exploit itself took place on July 30, 2026, and the recovery effort has since proceeded in waves rather than a single sweep.
Key facts
• 52.37 BTC was transferred to a Crypto Recovery Trust address, including 30.18 BTC from Wave 2 and 17.98 BTC from Footprint AX.
• The transfer included 3.0134 BTC from addresses Galaxy had not previously tracked; Thorn said these were presumably recovered Coldcard funds but could not be confirmed.
• Of the 52.37 BTC, 1.19 BTC was routed from Footprints AA and AU and 3.0134 BTC entered from an unidentified source.
• Wave 1 accounts for about 1,082.57 BTC and remains untouched, while Wave 3 accounts for roughly 214.07 BTC, of which about 116.98 BTC is still held.
• Galaxy cites a published total of 1,830 BTC across 9,162 addresses linked to the vulnerability, with about 1,393 BTC (76.1%) tracked so far.
An on-chain message to victims
The transaction carried an OP_RETURN message reading "claim:cryptorecoverytrust.com," a mechanism that permanently records a small amount of data alongside a Bitcoin transaction. In this case it appears to have been used as an on-chain pointer directing affected users toward the recovery process.
Cointelegraph reported that potential victims can enter their wallet addresses on the Crypto Recovery Trust website to check whether the trust controls their funds. Ambcrypto did not describe that lookup step; the difference reflects how each outlet covered Thorn's disclosures.
The head of research at Galaxy Digital credited white hats with roughly 40% of Wave 2 moving into the recovery operation, and said researchers do not know whether the remaining approximately 60% of Wave 2 was also moved by white hats. Galaxy could not confirm the origin of the 3.0134 BTC that came from addresses it had not previously tracked.
Why it matters
The Coldcard case matters because it concerns self-custody hardware wallets, a category marketed on the premise that the owner alone controls the keys. The numbers make the scale concrete: Wave 1's roughly 1,082.57 BTC is untouched, Wave 2 now stands at about 76.09 BTC with roughly 45.90 BTC still held, and Wave 3's approximately 214.07 BTC is partly held and partly moved. Together with the tracked footprints, that totals roughly 1,393 BTC, or 76.1% of the published 1,830 BTC linked to the vulnerability across 9,162 addresses.
For holders of affected wallets, the practical change is that a recovery route now exists through the trust rather than a direct transaction with the researchers. Cointelegraph reported that on Sept. 9, security researcher and SEAL 911 incident responder Nick Bax said he helped rescue about 50 Bitcoin at the end of July because the funds were "imminently going to be stolen" due to the Coldcard entropy flaw. The trust is Wyoming-based, according to Cointelegraph; Ambcrypto refers to the same entity as the Crypto Recovery Trust without specifying its location.
What to watch
The open question is the movement of the remaining roughly 60% of Wave 2 that Thorn said researchers cannot attribute to white hats. Any further transfers involving Wave 1's 1,082.57 BTC or the approximately 45.90 BTC still held from Wave 2 would show whether the recovery effort is continuing or stalling. Cointelegraph reported that Thorn did not immediately respond to its request for comment.
This article is not financial advice, and cryptocurrency markets are volatile and uncertain.
Originally published on CoinPulseHQ: https://coinpulsehq.com/white-hats-52-bitcoin-coldcard-recovery-trust/