White-Hat Hackers Redirect Bitcoin From a Coldcard Exploit Into 'Recovery Trust'

White-hat actors moved 40.71 BTC, worth about $3.31 million, on Sept. 21, 2026, in a transaction tied to the Coldcard hardware wallet exploit and labeled for a Crypto Recovery Trust. The move, reported by Galaxy Research, suggests that part of the Bitcoin stolen during one of the year's largest self-custody failures may be routed toward an effort to return coins to victims.

A tagged transaction consolidates stolen Coldcard coins

Galaxy Research's blockchain monitoring identified the 40.71 BTC transfer as a single transaction that consolidated coins connected to the Coldcard theft. The transaction spanned 11 addresses, used 20 inputs and generated 480 outputs. It also carried an OP_RETURN message, a small note embedded in a Bitcoin transaction, reading "claims: cryptorecoverytrust.com."

Galaxy attributed the coins to attackers it had tagged as "Footprint AA" and to a second-wave hop from the hack. That attribution matters because the Coldcard theft did not move in a single clean sweep. It unfolded in waves across many addresses, making it difficult to trace every coin. The OP_RETURN label gives observers a way to identify at least some of the funds being moved under a recovery claim.

A broader sweep pulls 52.37 BTC into the same trust

In a related post, Alex Thorn, head of research at Galaxy, said a broader sweep pulled 52.37 BTC from several attacker clusters into a fresh address flagged for the same Crypto Recovery Trust. The address included an OP_RETURN message reading "claim:cryptorecoverytrust dot com" and appeared in block 967,948, according to a post dated Sept. 21, 2026.

Thorn said the consolidated coins came from Wave 2, Footprints AA, AU and AX. He noted that the white-hat funds represent roughly 2.8% of the total Coldcard exploit. That percentage underscores how small this recovery movement is compared with the full theft, which peaked around $130 million across thousands of addresses. Much of the stolen Bitcoin had remained largely dormant in attacker wallets for weeks, prompting speculation about whether any of it would ever move.

Why the Coldcard exploit was hard to fix

The exploit stemmed from a March 2021 firmware build error on Coinkite's Coldcard devices. The error generated seed phrases with far too little randomness, leaving private keys guessable. Because the weakness was baked into how the seed was created, a firmware update could not fix a wallet that had already been generated on a compromised device.

This is why the incident became a self-custody disaster rather than a routine software bug. A hardware wallet is meant to keep signing keys offline, and a seed phrase is the master backup that allows a user to rebuild control over funds. If the seed phrase is predictable, the key material behind Bitcoin holdings can be exposed without the user needing to make an unsafe transaction.

What the recovery trust label does not yet prove

The appearance of a recovery-trust label suggests that at least some parties are attempting to shepherd funds back to victims. However, the specifics of how the Crypto Recovery Trust would operate, and how owners might claim their coins, were not detailed in the on-chain messages. That leaves unresolved questions about verification, eligibility and distribution.

Coinkite has previously urged exposed users to migrate to newly generated seeds and rolled out new security measures after the breach. For readers, the Sept. 21 movement is most useful as a traceability signal: it shows that some Coldcard-linked coins are being consolidated under a recovery label, while the larger stolen amount remains a test of whether on-chain claims can translate into practical restitution.