Recovery Efforts Underway After COLDCARD Exploit as 52 BTC Transferred to Trust

A group of white-hat researchers has successfully transferred 52.37 Bitcoin (BTC) to the Crypto Recovery Trust, a statutory entity based in Wyoming, USA, aimed at reimbursing victims of the recent COLDCARD exploit. This transfer represents approximately 2.8% of the estimated 1,500 BTC stolen during the attack, which resulted in total losses exceeding $100 million.

The exploit, which began on July 30, 2026, involved attackers draining around 594 BTC from compromised wallets in a matter of minutes, indicating the use of automated tools to exploit a firmware flaw in certain COLDCARD hardware wallet models. This vulnerability stemmed from a defect in the hardware random-number generator, allowing attackers to reconstruct compromised seed phrases without sophisticated hacking methods.

The recovery operation was organized by the Digital Asset Recovery Trust (DART), which identified vulnerable wallet addresses and moved recoverable funds to prevent further losses. The transaction included an OP_RETURN message directing affected users to the Crypto Recovery Trust's website to file claims. DART had already secured over 50 BTC by late July 2026, which is now held separately within the trust to ensure a clear chain of custody for eventual disbursement to verified victims.

Coinkite, the company behind COLDCARD, has acknowledged the firmware issue and released emergency updates. The flaw, which originated from a March 2021 update, left some wallets vulnerable for over five years before the exploit occurred. The white-hat researchers involved in the recovery efforts did not seek bounties, emphasizing their commitment to assisting victims of the attack.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News