52.37 Bitcoin Linked to Coldcard Exploit Moved Into Recovery Trust, Portal Opens Claims Check
The funds were consolidated into a Crypto Recovery Trust address after an earlier rescue effort. Users must verify ownership before any repayment.
White-hat researchers moved 52.37 Bitcoin (BTC) linked to the Coldcard wallet exploit into a recovery trust, giving affected users a public way to check whether their funds were rescued.
The Sept. 21 transfer was confirmed in Bitcoin block 967,948 and included the on-chain message “claim:cryptorecoverytrust dot com.” The funds came from Coldcard-related address clusters identified as Wave 2 and footprints AA, AU and AX.
Users can search public Bitcoin addresses through the Crypto Recovery Trust portal. A matching address does not guarantee repayment. Claimants must establish ownership, while the process includes chain-of-custody documentation, source-of-funds review, sanctions screening and checks for competing claims.
DART had secured just over 50 BTC by Aug. 17 and placed the funds in the trust, making the latest transaction a formal custody step for an earlier rescue rather than necessarily a separate recovery. The transfer represented 2.8% of Galaxy’s tracked Coldcard exploit funds.
Another 3.0134 BTC entered the same address, but its connection to the Coldcard exploit is unconfirmed. The incident involved firmware that generated some wallet seeds with weaker-than-intended randomness. Updating firmware does not repair an existing affected seed.
