Key Takeaways
- • White-hat actors consolidated 40.71 BTC (~$3.31 million) on September 21, 2026, into a recovery trust address, representing approximately 2.8% of the total Coldcard exploit haul, according to Galaxy Research blockchain monitoring.
- • A broader recovery sweep moved 52.37 BTC from multiple attacker clusters into a fresh Crypto Recovery Trust address flagged in Wyoming, with an embedded OP_RETURN message directing victims to cryptorecoverytrust.com for claims processing.
- • The Coldcard exploit originated from a March 2021 firmware vulnerability on Coinkite devices that generated seed phrases with insufficient randomness, making private keys guessable; the flaw could not be remedied through firmware updates on already-compromised wallets.
- • The total theft peaked at approximately $130 million across thousands of addresses, with roughly 1,816 BTC remaining dormant in attacker wallets as of the latest tracking by Galaxy Digital.
- • The movement of stolen funds into a recovery trust marks a significant development in one of 2026's largest self-custody security failures, with white-hat intervention suggesting a coordinated effort to return a material portion of victim assets.
Summary
The Coldcard hardware wallet exploit has entered a recovery phase, with white-hat actors moving a meaningful portion of stolen Bitcoin into a dedicated trust structure designed to facilitate victim restitution. According to Galaxy Research's blockchain analysis, white-hat actors consolidated 40.71 BTC (valued at approximately $3.31 million) on September 21, 2026, in a single transaction spanning 11 addresses, 20 inputs, and 480 outputs. The transaction included an embedded OP_RETURN message directing claimants to cryptorecoverytrust.com, explicitly labeling the recovery effort as a trust.
Alex Thorn, Galaxy Research's head of research, reported that a broader consolidation pulled 52.37 BTC from several attacker clusters into a fresh address similarly tagged for the Crypto Recovery Trust. These white-hat recoveries represent roughly 2.8% of the total exploit, leaving the vast majority of stolen funds—approximately 1,816 BTC—remaining stationary in attacker wallets. The dormancy of most stolen coins had prompted questions about whether attackers intended to liquidate assets or whether technical or legal considerations were preventing movement.
The Coldcard vulnerability traces to a March 2021 firmware build error on Coinkite devices that generated seed phrases with critically insufficient randomness, rendering private keys mathematically guessable by sophisticated attackers. Because the entropy flaw was embedded in the seed generation algorithm itself, firmware updates could not remediate wallets already created on compromised devices—only protect future generations. The exploit unfolded in waves throughout 2026, with Galaxy tracking successive sweeps as attackers moved and consolidated stolen Bitcoin.
The recovery trust structure represents a notable coordination effort among security researchers and white-hat actors to return victim assets. The presence of an explicit claims portal and the consolidation of funds into dedicated recovery addresses suggest an organized mechanism for victims to verify their holdings and initiate recovery procedures, distinguishing this outcome from cases where stolen digital assets remain permanently inaccessible or liquidated by malicious actors.
Alex Thorn, Galaxy Research's head of research, reported that a broader consolidation pulled 52.37 BTC from several attacker clusters into a fresh address similarly tagged for the Crypto Recovery Trust. These white-hat recoveries represent roughly 2.8% of the total exploit, leaving the vast majority of stolen funds—approximately 1,816 BTC—remaining stationary in attacker wallets. The dormancy of most stolen coins had prompted questions about whether attackers intended to liquidate assets or whether technical or legal considerations were preventing movement.
The Coldcard vulnerability traces to a March 2021 firmware build error on Coinkite devices that generated seed phrases with critically insufficient randomness, rendering private keys mathematically guessable by sophisticated attackers. Because the entropy flaw was embedded in the seed generation algorithm itself, firmware updates could not remediate wallets already created on compromised devices—only protect future generations. The exploit unfolded in waves throughout 2026, with Galaxy tracking successive sweeps as attackers moved and consolidated stolen Bitcoin.
The recovery trust structure represents a notable coordination effort among security researchers and white-hat actors to return victim assets. The presence of an explicit claims portal and the consolidation of funds into dedicated recovery addresses suggest an organized mechanism for victims to verify their holdings and initiate recovery procedures, distinguishing this outcome from cases where stolen digital assets remain permanently inaccessible or liquidated by malicious actors.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.