Whitehats move 52 BTC from Coldcard theft to recovery trust

White-hat researchers have moved 52 BTC from the Coldcard hack to an address carrying an OP_RETURN message reading "claim:cryptorecoverytrust dot com," according to Galaxy Digital — a sign an effort is underway to return at least part of the stolen funds to victims.

Recovery work comes alongside the attacker's continued liquidation of the wider haul. The broader incident centered on a roughly $114 million theft from Coldcard wallets, with the hacker draining the 11 largest vaults tied to the third attack wave and moving about $7.7 million (roughly 45% of that wave's bitcoin) to new addresses. Coldcard shipped new firmware after a security review prompted by the thefts, though it warned that updating a compromised wallet still does not make it safe.