White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility

Coldcard owners can publicly check whether white hats recovered coins from their wallets. Galaxy researcher Alex Thorn linked a Sept. 21 Bitcoin transaction carrying a Crypto Recovery Trust claims reference to roughly 52.37 BTC from Coldcard-related clusters.

He directed owners to search their public Bitcoin addresses at the trust’s site. A match can begin an ownership claim, with any return subject to verification. The check calls for a public address, never a seed phrase or private key.

Mempool’s status record confirmed the transaction in block 967,948. In his Sept. 21 tracing report, Thorn said the amount represented 2.8% of the exploit funds Galaxy tracked.

Thorn also flagged 3.0134 BTC entering the destination from addresses Galaxy had not previously tracked. He considered them possible additional white-hat recoveries, but their Coldcard origin remains uncertain.

In an Aug. 17 report, digital-asset recovery firm DART said it and independent researchers had secured just over 50 BTC, according to its internal ledger, and placed the rescued Bitcoin with Crypto Recovery Trust.

The Sept. 21 transaction gives owners a public trail for a recovery DART had described a month earlier.

What happens after a Bitcoin address match?

DART says its trust process checks recovery records, chain of custody, and proof of ownership, including source-of-funds and exchange records. Sanctions, competing claims, or other restrictions can affect any return.

The Coldcard entropy flaw made some older wallet seeds easier to reconstruct. DART says an existing seed created under affected firmware remains exposed after a firmware update, and owners with exposed funds should follow the manufacturer’s migration guidance.

DART also warns against sending seeds, private keys, PINs, or recovery codes through a web form. The initial address check Thorn described needs a public address, while proving ownership is a separate step.