White Hat hacker transfers 52 photos from the Coldcard robbery to a relief trust

White Hat hackers transfer 52.37 bitcoins to Rehabilitation Trust addresses as Coldcard attacks continue to ferment

According to Alex Thorn, director of research at Galaxy Digital, a group of white hat hackers had transferred 52.37 bitcoins to a newly created retrieval trust-related address as part of the July Coldcard hardware wallet exploit.

The attack began in late July and cost more than $100 million.

The Coldcard hardware wallet attack began on July 30 and was followed by a series of attacks in the following days (first, second and third waves) that caused an estimated loss of more than $100 million worth of bitcoin.

The attackers exploited a flaw in the process of generating wallet adjectives: some wallets did not use a dedicated random number generator that came with the device, but instead used weaker software sources of random numbers, which resulted in these adjectives being recalculated by hackers.

Manufacturers have fixed the firmware, but old risks remain

Coldcard's manufacturer Coinkite has since released a firmware patch to fix the issue. However, funds protected by old passwords that were exposed during the breach are still at risk regardless of whether they have been patched or not and users will need to transfer assets into newly generated security passwords.

Some of the money that was diverted came from good people.

According to Thorn, some of the bitcoins that leaked from victims' wallets did not fall into the hands of malicious attackers but were diverted by white hat hackers - cybersecurity practitioners who use hacking techniques to discover and fix security vulnerabilities.

The purpose of the scam is clear: to keep assets in custody until conditions are ripe and then return them to the real victims. This transfer of 52.37 bitcoins to a rehabilitation trust address is just the latest development in this type of recovery operation.

Warning signsNote: This article is for public information only and does not constitute any investment recommendation. The storage of crypto assets involves technical risks, please verify the device firmware information through official channels and properly store notes.