White hats have moved bitcoin from the hacked Coldcard signing devices to a trust for would-be victims to reclaim, Galaxy Digital’s Alex Thorn has said.
Writing on X on Monday, Thorn said that the funds were taken by white hats to protect potential victims. They are now apparently sitting in an address controlled by Crypto Recovery Trust, a Wyoming Trust created to help white hats return funds to victims.
A total of 52.37 of the bitcoins — worth over $4.5 million at today’s prices — were moved. Thorn added that the funds represented 2.8% of the coldcard exploit.
Criminals started taking bitcoin stored using Coinkite’s popular Coldcard hardware wallet on July 31.
Canadian company Coinkite said that a firmware bug in Coldcard devices caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.
Galaxy Digital tracked the movement of funds and said 1,789.28 bitcoins were lost in the attacks. That’s $154.1 million in bitcoin at today’s prices.
Earlier this month, Nick Bax of universal market protocol Ump Labs said that he was involved in helping recover the funds.
“Finally able to say that at the end of July, I was involved in the rescue of ~50 BTC which were “imminently going to be stolen due to the COLDCARD entropy flaw,” Bax wrote on X.
He added: “The funds are currently held by a Wyoming trust, which will ensure that funds are returned to their rightful owners.”
Since the attack, cautious investors have been moving their coins to other storage solutions — including exchanges.
Coinkite said in a statement that the bug in its software “silently went unnoticed” and “its potential impact grew with every release” of its products.
Days after the first hack, the company urged investors to update their software or move their funds off the popular hardware wallet.