White-hat hackers secured 52.37 BTC during the Coldcard wallet exploit before malicious attackers could take the coins. Galaxy Digital researcher Alex Thorn said the bitcoin came from Wave 2 and the AA, AU and AX footprints, and was consolidated in block 967,948 at an address controlled by Crypto Recovery Trust. An OP_RETURN message pointed to the recovery organization. The recovered amount represents 2.8% of the exploited funds and is worth more than $4.4 million at the article’s stated valuation.
Thorn said about 40% of Wave 2 appears to have been swept by white hats, while the status of the remaining 60% is still unclear. The exploit affected more than 8,600 addresses and roughly 1,779 BTC after a Coldcard firmware flaw weakened seed generation. Crypto Recovery Trust must now establish ownership using evidence such as device forensics, exchange records and prior wallet data before returning the recovered bitcoin.
https://news.bitcoin.com/crypto-news/white-hats-beat-coldcard-attackers-rescuing-millions-bitcoin/
oxhak / Ox HaK
npub1sx…dz7z7
2026-09-22 22:35:28 UTC
Author Public Key
npub1sxexewvzysc3affq4yzzh7w8e3udyujap2vlj7t6lkdg5dvhp24q4dz7z7Seen on
wss://relay.damus.ioPublished at
2026-09-22 22:35:28 UTCEvent JSON
{
"id": "86361cee0503a6ff300236b73c6ae89bc5bd79457d79d94708079e271ae3bb51",
"pubkey": "81b26cb98224311ea520a9042bf9c7cc78d2725d0a99f9797afd9a8a35970aaa",
"created_at": 1790116528,
"kind": 1,
"tags": [],
"content": "White-hat hackers secured 52.37 BTC during the Coldcard wallet exploit before malicious attackers could take the coins. Galaxy Digital researcher Alex Thorn said the bitcoin came from Wave 2 and the AA, AU and AX footprints, and was consolidated in block 967,948 at an address controlled by Crypto Recovery Trust. An OP_RETURN message pointed to the recovery organization. The recovered amount represents 2.8% of the exploited funds and is worth more than $4.4 million at the article’s stated valuation.\n\nThorn said about 40% of Wave 2 appears to have been swept by white hats, while the status of the remaining 60% is still unclear. The exploit affected more than 8,600 addresses and roughly 1,779 BTC after a Coldcard firmware flaw weakened seed generation. Crypto Recovery Trust must now establish ownership using evidence such as device forensics, exchange records and prior wallet data before returning the recovered bitcoin.\n\nhttps://news.bitcoin.com/crypto-news/white-hats-beat-coldcard-attackers-rescuing-millions-bitcoin/",
"sig": "5aae03c91946acf8476e889e427e3021f1167c9e980dce6656531e0ff5c85d222eb79b26b3f9f0441260749bba3156b1471c326f935985245ea51eea6b3f2978"
}