White-Hat Rescue: $4.5 Million in Rescued Bitcoin Transferred to Victim Trust Following Coldcard Exploit

White-hat security experts working in coalition have effectively gathered and stopped 52.37 BTC, worth almost $4.5 million, from Coldcard hardware-wallet breach compromised crypto addresses. Around block 967,948 on September 22, 2026, the single sweeping transaction safely deposited the funds into a dedicated address run by the Wyoming-registered Crypto Recovery Trust. The researchers included an OP_RETURN message straight on-chain directing users to claim:cryptorecoverytrust dot com to help damaged victims toward recovery.

The intervention arises from a terrible exploit first started in July 2026, meant at a long-standing entropy and seed-reconstruction problem in certain Coldcard firmware versions. The vulnerability let bad actors forecast private keys offline and automatically drain money without physical access, therefore producing total projected losses of over $100 million across recorded stolen balances of around 1,870 BTC. White-hat operators have frontrun transfers and effectively sweep about 40% of the addresses targeted during the "Wave 2" of the exploit.

Market experts at Galaxy Digital predict that the 52.37 BTC will help to return around 2.8% of the entire tracked exploit funds back into safe, legitimate custody. These assets will be held by the Wyoming statutory trust, which will keep them completely distinct from operating funds while trying to confirm original user ownership and coordinate official victim claims. Wallet owners who were impacted can check the claims site to see if their addresses were among those the ethical hacking team recovered.