The Coldcard recovery continues: White Hats rescue 52.37 Bitcoin, but questions remain

The aftermath of the Coldcard exploit, which took place on the 30th of July, 2026, seems to be not ending.

According to Alex Thorn, Head of Firmwide Research at Galaxy, a group of white-hat researchers has once again moved 52.37 BTC from wallets affected by the Coldcard exploit into an address controlled by the Crypto Recovery Trust (CRT).

This transfer, which took place when Bitcoin [BTC] was at the 967,948 block, was part of the money that researchers think was recovered from weak wallets before the criminals could steal it.

How the flow of funds garnered Thorn’s attention

Of the 52.37 Bitcoin, approximately 30.18 BTC originated from Wave 2. Meanwhile, roughly 17.98 BTC came from a group of addresses referred to as Footprint AX.

At the same time, minimal amounts worth 1.19 BTC were routed from Footprints AA and AU. Lastly, an additional 3.0134 BTC also entered the same transaction from an unidentified source. Remarking on which, Alex Thorn noted,

Presumably they are also white-hat recovered coldcard funds — but we cannot confirm.

Is recovery round the corner?

Interestingly, in this entire process the blockchain transaction also included an OP_RETURN message containing “claim:cryptorecoverytrust.com,” directing affected users toward the recovery process.

For context, OP_RETURN allows a small amount of data to be permanently recorded alongside a Bitcoin transaction. So, the case in point appears to have been used as an on-chain message to affected victims.

Going forward, Thorn explicitly said that researchers do not know whether the other roughly 60% of Wave 2 was also moved by white hats.

However, roughly 40% of Wave 2 was moved into the recovery operation, while the status and identity of the operator behind the remaining funds remain uncertain.

Total movements so far

To date, and with multiple fund movements, Wave 1 accounts for approximately 1,082.57 BTC, which remains untouched, according to the Thorn.

Wave 2, on the other hand, now accounts for roughly 76.09 BTC, with part of it moved into the Crypto Recovery Trust and approximately 45.90 BTC still held.

Meanwhile, Wave 3 accounts for about 214.07 BTC, of which approximately 116.98 BTC remained held while another portion had moved elsewhere.

All in all, these waves, along with the additional tracked footprints, account for roughly 1,393 BTC (76.1% of the published total COLDCARD-exploited funds). 

Final Summary

• Approximately 30.18 BTC originated from Wave 2, while about 17.98 BTC came from Footprint AX.
• Researchers are still aloof about the other roughly 60% of Wave 2, which was also moved by white hats.