White hats outrun Coldcard hackers in 52-Bitcoin evacuation

Written by Helen Partzstaff writerReviewed by Yohan Yunstaff editorWritten by Helen Partzstaff writerReviewed by Yohan Yunstaff editorWhite hats outrun Coldcard hackers in 52-Bitcoin evacuationLatest NewsPublishedSep 22, 2026<!–>

White hats secured about 40% of the Bitcoin moved in the Coldcard exploit’s second wave, transferring it to a Wyoming trust for victims.

–>

White hats have transferred Bitcoin they rescued from wallets exposed by a Coldcard vulnerability to a trust set up to return the funds to victims.

A total of 52.37 Bitcoin was moved to an address controlled by Wyoming-based Crypto Recovery Trust, Galaxy Digital head of research Alex Thorn said in an X post on Monday. About 40% of the Bitcoin associated with the second wave was swept by white hats to protect victims’ funds.

Thorn said 3.0134 BTC included in the transfer came from addresses Galaxy had not previously tracked. He said the funds were presumably also rescued from wallets affected by the Coldcard flaw, but that Galaxy could not confirm their origin.

Security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped rescue about 50 Bitcoin at the end of July because the funds were “imminently going to be stolen” due to the Coldcard entropy flaw.

Thorn cited a published total of 1,830 BTC across 9,162 addresses linked to the Coldcard vulnerability.

Potential victims can enter their wallet addresses on the Crypto Recovery Trust website to determine whether the trust controls their funds.

Thorn did not immediately respond to Cointelegraph’s request for comment.

Related: Coldcard third-wave attacker moves 45% of stolen Bitcoin

<!–>

Subscribe to daily byte-sized crypto news from Cointelegraph

[–> Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hackers
• Self Custody
• Hardware Wallet
• Security
• Coldcard
• Bitcoin

More on the subject

<!–>[–>1 hour agoEzra Reguerra<!–>[–>

<!–>[–>20 hours agoHelen Partz<!–>[–>

<!–>[–>23 hours agoWilliam Suberg

<!–>[–>1 hour agoEzra Reguerra<!–>[–>

<!–>[–>20 hours agoHelen Partz<!–>[–>

<!–>[–>23 hours agoWilliam Suberg