White-Hat Hackers Redirect Bitcoin from Coldcard Exploit to Recovery Trust

Funds Redirected to Recovery Trust

White-hat hackers have successfully transferred 40.71 BTC, valued at approximately $3.31 million, linked to a major exploit of Coldcard hardware wallets. This transaction, marked as a "crypto recovery trust," took place on September 21.

Additional Recoveries Identified

Galaxy Research's Alex Thorn reported that an extra 52.37 BTC was moved from various attacker groups into a newly created address associated with the recovery initiative. This amount represents about 2.8% of the total Bitcoin stolen during the Coldcard exploit.

Background of the Exploit

The exploit stemmed from a firmware vulnerability in Coldcard devices that emerged in March 2021, which allowed attackers to guess seed phrases due to insufficient randomness in their generation. The exploit has led to the theft of around $130 million worth of Bitcoin across numerous addresses. Much of this stolen Bitcoin had remained dormant in the attackers' wallets, raising concerns over whether it would be moved again.

Significance of the Recovery Trust

The transaction involved multiple addresses and was characterized by an OP_RETURN message linking to "cryptorecoverytrust.com," suggesting efforts to facilitate the return of stolen funds, although specifics about the recovery process remain vague. Coinkite, the manufacturer of Coldcard devices, has advised affected users to create new seeds and has implemented enhanced security measures since the incident.