White Hats Move $4.5M Bitcoin to Recovery Trust After Coldcard Exploit

White Hats Intercept Funds Mid-Exploit

White hat hackers have moved 52.37 bitcoin, worth over $4.5 million at current prices, from compromised Coldcard signing devices to a Wyoming trust set up to return funds to victims. Galaxy Digital's Alex Thorn confirmed the transfer on X Monday, noting the funds represent 2.8% of the total coldcard exploit. The Crypto Recovery Trust now holds these coins pending their return to rightful owners.

The Entropy Flaw That Enabled the Attack

The exploit stems from a firmware bug in Coinkite's Coldcard hardware wallets. When the device's hardware true random number generator failed during seed generation, the system silently fell back to a weak software pseudorandom number generator. This allowed attackers to essentially guess investor seedphrases and drain their funds. Criminals began exploiting the vulnerability on July 31, and the bug reportedly "grew with every release" of Coinkite's products.

Recovery Efforts and Total Losses

Galaxy Digital tracked the full scope of the attack, reporting 1,789.28 bitcoin lost — approximately $154.1 million at today's prices. Nick Bax of Ump Labs announced his involvement in rescuing roughly 50 BTC that were "imminently going to be stolen" due to the entropy flaw. Bax confirmed the funds are currently held by the Wyoming trust, which will ensure they are returned to their rightful owners. The recovery effort highlights the ongoing race between white hats and attackers in the cryptocurrency space.

Coinkite Responds to the Breach

Coinkite stated the bug "silently went unnoticed" and that "its potential impact grew with every release" of its products. In the days following the initial hack, the company urged investors to either update their software or move their funds entirely off Coldcard devices. Cautious investors have since shifted coins to alternative storage solutions, including exchanges, as confidence in the hardware wallet took a hit. The incident underscores the critical importance of hardware security in self-custody.

Source: Bitcoin Magazine