# 52.37 Bitcoin Linked to Coldcard Exploit Moved Into Recovery Trust, Portal Opens Claims Check

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/23497
Published: 2026-09-24T01:16:35.000Z
Updated: 2026-09-24T01:16:35.000Z

White-hat researchers moved 52.37 Bitcoin (BTC) linked to the Coldcard wallet exploit into a recovery trust, giving affected users a public way to check whether their funds were rescued.

The Sept. 21 transfer was confirmed in Bitcoin block 967,948 and included the on-chain message “claim:cryptorecoverytrust dot com.” The funds came from Coldcard-related address clusters identified as Wave 2 and footprints AA, AU and AX.

Users can search public Bitcoin addresses through the Crypto Recovery Trust portal. A matching address does not guarantee repayment. Claimants must establish ownership, while the process includes chain-of-custody documentation, source-of-funds review, sanctions screening and checks for competing claims.

DART had secured just over 50 BTC by Aug. 17 and placed the funds in the trust, making the latest transaction a formal custody step for an earlier rescue rather than necessarily a separate recovery. The transfer represented 2.8% of Galaxy’s tracked Coldcard exploit funds.

Another 3.0134 BTC entered the same address, but its connection to the Coldcard exploit is unconfirmed. The incident involved firmware that generated some wallet seeds with weaker-than-intended randomness. Updating firmware does not repair an existing affected seed.