Whitehats Move 52 Bitcoin From Coldcard Exploit to Recovery Trust
Whitehats have transferred approximately 52 bitcoin from wallets linked to the Coldcard hardware wallet exploit to a recovery trust, according to Galaxy Digital. The funds are now held at an address bearing an OP_RETURN message directing claimants to cryptorecoverytrust.com.
Written by CoinArticle’s AI Newsroom · from 3 cited sources. How we work
Story Updates
- Updated Sep 22, 2026, 07:02 PM: Galaxy Digital's Alex Thorn confirmed the recovered bitcoin total was valued at over $4.5 million, and detailed the whitehat rationale for moving funds into protected custody.
Recovery Funds Moved to Trust Address
Whitehats have transferred bitcoin recovered from the Coldcard exploit to a dedicated recovery trust address. Galaxy Digital confirmed the move involved 52 BTC, valued at over $4.5 million at current spot prices. The receiving address carries an OP_RETURN message reading "claim:cryptorecoverytrust dot com," signaling the next phase of the recovery process to affected users.
Claims Process Underway
The recovery trust will verify ownership claims from users whose funds were affected by the Coldcard exploit. Claimants are directed to the cryptorecoverytrust.com domain to initiate the verification process. The move marks a shift from active fund recovery on-chain to a custodial verification mechanism overseen by the whitehat group.
Whitehat Protection Rationale
Alex Thorn of Galaxy Digital stated that whitehats moved the funds to protect potential victims from further risk. By holding the assets in a dedicated trust rather than dispersed addresses, the recovery infrastructure centralizes custody and reduces the surface for additional security lapses during the redistribution phase.
Why It Matters
For Traders
The trust custody structure means recovered funds will not enter the market unpredictably; claimants should verify identity at cryptorecoverytrust.com to establish their stake.
For Investors
Institutional custody solutions like Coldcard remain security targets; this incident reinforces the need for tiered key management and insurance coverage for hardware wallet providers.
For Builders
Recovery trusts using OP_RETURN messaging and on-chain verification demonstrate a practical pattern for handling post-exploit asset redistribution at scale.
This article is for information only and is not financial advice. Read the full disclaimer.
