White hat hackers move 52 BTC from Coldcard exploit to recovery trust

White-hat operators have transferred 52.37 BTC, worth roughly 2.8% of tracked exploit funds, to the Crypto Recovery Trust following a major Coldcard hardware wallet exploit. The incident, which began on July 30, 2026, and caused over $100 million in estimated losses, stemmed from a five-year-old firmware flaw that weakened seed-phrase entropy. While Coinkite has released patched firmware, users must generate entirely new seeds and migrate their funds to remain secure.

White-hat Bitcoin recovery operation

• ▪The 52.37 BTC transfer occurred around Bitcoin block 967,948 and represents approximately 2.8% of the total tracked exploit funds.
• ▪The white-hat researchers involved in the recovery operation organized by DART following the Coldcard exploit did not seek or request any bounty for their work
• ▪The Digital Asset Recovery Trust (DART) organized recovery efforts by identifying vulnerable address clusters tied to the Coldcard entropy flaw discovered in July 2026
• ▪White-hat operators transferred 52.37 BTC from wallets compromised in the July 2026 Coldcard exploit to a recovery address controlled by the Crypto Recovery Trust

Coldcard firmware seed-generation flaw

• ▪The Coldcard hardware wallet exploit began on July 30, 2026, after attackers exploited weakened wallet seeds created by a firmware integration defect
• ▪The Coldcard firmware build error that caused the July 2026 exploit originated in a March 2021 update, leaving some hardware wallets silently vulnerable for over five years
• ▪The Coldcard firmware defect linked to the July 2026 exploit caused the seed-generation path to resolve to MicroPython's Yasmarang software pseudorandom generator instead of the hardware random number generator

Crypto Recovery Trust claims process

• ▪The Crypto Recovery Trust claims process includes blockchain analysis, proof-of-ownership checks, and sanctions screening before assets are returned.
• ▪Affected Coldcard users can search their wallet addresses and submit ownership claims at cryptorecoverytrust.com to recover Bitcoin rescued from the Coldcard exploit that began July 30, 2026
• ▪The Crypto Recovery Trust is a Wyoming-based statutory entity advised by Steptoe LLP that holds recovered digital assets separately from operational funds.

Tracked exploit fund movements

• ▪During the initial wave of the Coldcard hardware wallet exploit that began July 30, 2026, attackers drained approximately 594 BTC from around 500 wallets within minutes
• ▪Galaxy Digital Head of Research Alex Thorn stated that the 52.37 BTC from the Coldcard exploit came from Galaxy Digital's tracked Wave 2 cluster and footprints labeled AA, AU, and AX
• ▪The Coldcard exploit that began July 30, 2026, resulted in estimated total losses surpassing $100 million, with attackers siphoning off an estimated 1,500+ BTC

Firmware patch recommendations

• ▪Coinkite stresses that installing patched Coldcard firmware does not secure existing wallets, as users must generate new seeds and migrate their funds
• ▪Coinkite released emergency firmware updates on July 31, 2026, to correct future seed generation for affected Coldcard Mk2, Mk3, Mk4, Mk5, and Q hardware wallet models
• ▪Coinkite's recommended standard firmware releases as of September 3, 2026, are version 5.6.2 for Mk4/Mk5 devices and version 1.5.2Q for Q devices.

Debatable claims

• ▪White-hat hackers are justified in preemptively sweeping vulnerable user crypto wallets
• ▪Coinkite should financially compensate victims of the Coldcard firmware exploit