White-Hat Hackers Move $3.3M in Stolen Coldcard Bitcoin Into Recovery Trust

White-hat actors moved 40.71 BTC, worth about $3.31 million, tied to the Coldcard hardware wallet exploit into an entity labeled the Crypto Recovery Trust, according to Galaxy Research's blockchain monitoring. The Sept. 21 transaction consolidated coins across 11 addresses, 20 inputs and 480 outputs, carrying an OP_RETURN message reading "claims: cryptorecoverytrust.com." Galaxy head of research Alex Thorn said a broader sweep pulled 52.37 BTC from several attacker clusters into a new address flagged for the same trust. The white-hatted funds represent roughly 2.8% of the total exploit. The Coldcard breach stemmed from a March 2021 firmware error on Coinkite devices that generated seed phrases with insufficient randomness, making private keys guessable. The theft peaked at roughly $130 million. Details on how the trust would operate or process claims were not disclosed. Coinkite has urged affected users to migrate to new seeds.