White-hat researchers have moved 52.37 Bitcoin tied to the Coldcard wallet exploit into a recovery trust. The transfer marks a new step in efforts to secure funds before attackers can claim them. The transaction was confirmed in Bitcoin block 967,948.
The recovery comes as investigators continue tracking funds linked to the July Coldcard incident. The exploit affected wallets whose seed generation relied on weaker randomness. That weakness allowed attackers to reconstruct certain wallet seeds and drain exposed balances.
The latest transfer combines funds from Wave 2 and address clusters identified as Footprints AA, AU and AX. The 52.37 BTC represents about 2.8% of the tracked funds connected to the exploit.
Tracking the Recovered Bitcoin
The receiving address included an OP_RETURN message directing affected users toward the recovery trust. The structure aims to keep recovered assets separate while ownership claims undergo verification.
Researchers have also identified additional activity around the same recovery address. Another 3.0134 BTC moved into the address without a prior tracking history. Analysts have described those coins as potentially connected to the Coldcard recovery effort, but their origin remains unconfirmed.
About 40% of the tracked Wave 2 funds have now been identified as white-hat activity. That distinction matters because researchers moved these coins to protect them rather than to steal them.
Questions Over Distribution Remain
The recovery does not automatically mean affected users will receive their Bitcoin immediately. The trust must establish which addresses qualify and determine how recovered funds should be distributed.
The incident also highlights the continuing risk for wallets created with vulnerable seed-generation processes. A firmware update can address the underlying software flaw, but it cannot retroactively change a seed that was already generated with weak randomness.
The latest 52.37 BTC recovery therefore provides a concrete pool of funds for potential restitution, while questions around verification, ownership and final distribution remain central to the recovery process.
