COLDCARD white hats transfer 52 BTC to Crypto Recovery Trust for victim reimbursement

A group of white-hat security researchers has transferred 52.37 BTC recovered from wallets compromised in the COLDCARD hardware wallet exploit to a dedicated address managed by the Wyoming-based Crypto Recovery Trust. Executed around Bitcoin block 967,948, the consolidated transaction represents approximately 2.8% of the estimated 1,500+ BTC (worth over $100 million) drained during the security incident that began on July 30, 2026. The recovery operation was coordinated in part by the Digital Asset Recovery Trust (DART), which analyzed compromised address clusters linked to a critical entropy generation flaw. The vulnerability originated from a March 2021 firmware build error affecting COLDCARD's hardware random-number generator, which left seed phrases predictable and exposed for over five years before automated attacker scripts drained hundreds of bitcoins in minutes. The recovered funds are currently held in segregated custody advised by Steptoe LLP to prevent commingling, with an on-chain OP_RETURN message directing affected users to cryptorecoverytrust.com to initiate ownership verification and restitution claims.