Key Takeaways
- • White hats recovered 52.37 BTC (approximately $4.5 million) from the Coldcard exploit and transferred the funds to a Wyoming-based Crypto Recovery Trust established to return assets to affected victims.
- • The recovered amount represents 2.8% of the total Coldcard exploit, with Galaxy Digital tracking total losses at 1,789.28 BTC ($154.1 million) stemming from a firmware vulnerability that degraded seed generation to a weak software pseudorandom number generator.
- • The exploit began July 31, 2026, when attackers exploited a legacy firmware bug in Coinkite's Coldcard hardware wallets, enabling them to guess investor seed phrases by bypassing the device's hardware true random number generator.
- • On-chain analyst Willy Woo estimates recovery probability at only 20-40%, cautioning that despite white hat intervention, the majority of stolen funds may remain unrecoverable and vulnerable to further movement by threat actors.
- • Coinkite acknowledged the firmware defect "silently went unnoticed" and stated that "its potential impact grew with every release," indicating a systemic quality control failure in a critical security component.
Summary
White hat security researchers have successfully recovered 52.37 bitcoins ($4.5 million) from compromised Coldcard hardware wallets and transferred them to a Wyoming Trust entity designed to facilitate victim restitution. According to Alex Thorn, Head of Firmwide Research at Galaxy Digital, the funds were moved to protect potential victims and are now held in an address controlled by the Crypto Recovery Trust. The recovered amount represents 2.8% of the total exploit loss, with Galaxy Digital's comprehensive tracking estimating total losses at 1,789.28 BTC worth $154.1 million at current prices.
The exploit originated on July 31, 2026, when threat actors began systematically draining bitcoin from users who employed Coinkite's widely-adopted Coldcard signing devices. The vulnerability stems from a firmware bug that caused the device's seed generation mechanism to fall back to a weak software-based pseudorandom number generator instead of leveraging the hardware's true random number generator. This degradation allowed attackers to mathematically reverse-engineer or guess investor seed phrases, effectively compromising the private keys securing these self-custody wallets. Coinkite subsequently confirmed that the bug "silently went unnoticed" and that "its potential impact grew with every release," indicating a cascading failure in the software development and release process.
Nick Bax of Ump Labs disclosed involvement in rescuing approximately 50 BTC that were "imminently going to be stolen" due to the entropy flaw. The recovered funds are being held in custody by the Wyoming trust with explicit instructions to return assets to their rightful owners. However, on-chain analyst Willy Woo has issued a cautionary assessment, estimating the probability of full fund recovery at only 20-40%, warning that threat actors continue active monitoring of recovered funds and that much of the stolen bitcoin may ultimately prove unrecoverable. Since the attack, affected investors have begun migrating cryptocurrency holdings to alternative storage solutions, including exchange custody, reflecting diminished confidence in the compromised hardware wallet platform.
The exploit originated on July 31, 2026, when threat actors began systematically draining bitcoin from users who employed Coinkite's widely-adopted Coldcard signing devices. The vulnerability stems from a firmware bug that caused the device's seed generation mechanism to fall back to a weak software-based pseudorandom number generator instead of leveraging the hardware's true random number generator. This degradation allowed attackers to mathematically reverse-engineer or guess investor seed phrases, effectively compromising the private keys securing these self-custody wallets. Coinkite subsequently confirmed that the bug "silently went unnoticed" and that "its potential impact grew with every release," indicating a cascading failure in the software development and release process.
Nick Bax of Ump Labs disclosed involvement in rescuing approximately 50 BTC that were "imminently going to be stolen" due to the entropy flaw. The recovered funds are being held in custody by the Wyoming trust with explicit instructions to return assets to their rightful owners. However, on-chain analyst Willy Woo has issued a cautionary assessment, estimating the probability of full fund recovery at only 20-40%, warning that threat actors continue active monitoring of recovered funds and that much of the stolen bitcoin may ultimately prove unrecoverable. Since the attack, affected investors have begun migrating cryptocurrency holdings to alternative storage solutions, including exchange custody, reflecting diminished confidence in the compromised hardware wallet platform.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.