A group of whitehats linked to Coldcard, the hardware Bitcoin wallet manufacturer, reportedly moved 52.37 BTC from wallets connected to an earlier exploit into a dedicated recovery trust. The move signals an attempt to secure affected funds and return them through a controlled process rather than leaving them exposed to further risk.
Whitehats are security researchers who act to protect or recover funds rather than steal them. In this case, the reported action involves sweeping Bitcoin out of wallets flagged as exploit-linked and placing them under trust custody. That custody arrangement is designed to hold the funds until they can be distributed back to rightful owners through a defined process. For related coverage, see Bitwise CEO Says BSOL AUM Hits a Record High.
This follows a period of serious concern around Coldcard devices. Coldcard previously warned Mk3 users to move their funds after an investigation into a 594 BTC drain from affected wallets raised questions about whether specific hardware versions had exposed private keys.
What the 52.37 BTC Transfer Involves
The reported transfer moves 52.37 BTC from wallets identified as exploit-linked into a recovery trust. According to unconfirmed reports, the whitehats initiated this sweep to prevent any remaining attacker access to those wallets while a formal return process is established.
The distinction between leaving funds in exploit-linked wallets and moving them to a trust matters significantly. Exploit-linked wallets may still be accessible to the original attacker, meaning any delay creates ongoing theft risk. A recovery trust cuts off that access and creates a single, controlled point for the return process.
Earlier in this same exploit series, 20.5 BTC from a Coldcard-linked theft was moved through THORChain to Ethereum, suggesting that not all funds from related incidents have been secured. The 52.37 BTC now reportedly in a recovery trust represents a separate, recovered portion.
Why a Recovery Trust, and What Comes Next
A recovery trust is a custody arrangement that holds disputed or recovered funds until they can be returned to verified owners. It is not an immediate refund mechanism. The process of identifying affected wallets, confirming ownership, and distributing funds typically takes time and requires documentation from claimants.
The total amount involved in the broader exploit series appears to be larger than the 52.37 BTC now reportedly in recovery. How the trust will distribute funds, and on what timeline, has not been publicly detailed as of publication.
Coldcard released firmware 5.6.1 and urged affected users to move their Bitcoin as a protective step. If you hold Bitcoin on a Coldcard device and have not yet migrated funds to a wallet generated on updated firmware, that action remains the most direct protective measure available regardless of the recovery trust process.
Key Details Still Awaiting Verification
Several specifics remain unconfirmed at the time of publication. These include the exact wallet addresses involved, the on-chain transaction hash and block timestamp for the transfer, and the full legal or operational structure of the recovery trust. Readers who want to track the on-chain activity can use Mempool.space to search Bitcoin addresses and transactions as further details emerge.
Independent verification of the 52.37 BTC figure is also pending. For ongoing coverage and additional search context around this story, a search for the reported transaction details may surface primary on-chain sources as they become public.
Affected Coldcard users should check whether their specific wallets fall within the recovery scope. The broader exploit series has involved multiple wallet drains under active investigation, and the recovery trust represents one part of an ongoing remediation effort, not a final resolution.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Claims in this article are based on unconfirmed reports and should be independently verified before acting on them.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
