Security researchers transferred 52.37 BTC, which were previously extracted from wallets associated with the Coldcard vulnerability. This was reported by Alex Thorn, head of research at Galaxy Digital. The funds were sent to the address of the Crypto Recovery Trust, created to store and subsequently return assets to affected users. According to Thorn, the second wave of the rescue operation covered about 40% of the bitcoins associated with the relevant addresses. The transfer also included 3.0134 BTC from wallets that Galaxy had not previously tracked. Their connection to the Coldcard vulnerability has not yet been confirmed, although researchers suggest that these coins may have been evacuated using the same scheme.
The issue is related to a vulnerability affecting entropy generation in Coldcard hardware wallets. Incident response specialist and SEAL 911 participant Nick Bax previously reported that at the end of July, he helped move about 50 BTC from addresses threatened by theft. According to published data, potentially vulnerable addresses could number 9,162 with a combined balance of about 1,830 BTC. This significantly expands the scope of the incident beyond the already discovered cases of fund movement. At the same time, the transfer of assets by white hackers should be distinguished from the actions of malicious actors: the goal of the rescue operation was to temporarily remove potentially vulnerable coins from threat and preserve the possibility of their further return to owners.
The Crypto Recovery Trust, registered in Wyoming, is used to coordinate the return of funds. Potential victims can check through the trust's infrastructure whether it controls bitcoins associated with their addresses. This approach allows separating the emergency asset transfer stage from the subsequent procedure of identifying owners and restoring access to funds. At the time of the described events, the exact origin of some of the transferred coins remained unconfirmed. Thus, Galaxy's data reflects already discovered movements but does not provide grounds to believe that all 1,830 BTC from potentially affected addresses were stolen or are under the control of malicious actors. The scale of the threat and the status of individual wallets require verification by specific addresses.
Related articles
