{"id":13642,"date":"2026-09-24T02:00:56","date_gmt":"2026-09-24T02:00:56","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13642"},"modified":"2026-09-24T02:00:56","modified_gmt":"2026-09-24T02:00:56","slug":"white-hats-recover-52-bitcoin-from-coldcard-exploit-and-a-new-public-portal-lets-victims-check-eligibility","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13642","title":{"rendered":"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>Coldcard owners can publicly check whether white hats recovered coins from their wallets. Galaxy researcher Alex Thorn linked a Sept. 21 Bitcoin transaction carrying a Crypto Recovery Trust claims reference to roughly 52.37 BTC from Coldcard-related clusters.<\/p>\n<p>He directed owners to search their public Bitcoin addresses at the trust&#8217;s site. A match can begin an ownership claim, with any return subject to verification. The check calls for a public address, never a seed phrase or private key.<\/p>\n<p><span style=\"color: #333333;\">Mempool&#8217;s\u00a0<\/span>status record<span style=\"color: #333333;\"> confirmed the transaction in block 967,948<\/span>. In his Sept. 21 tracing report, Thorn said the amount represented 2.8% of the exploit funds Galaxy tracked.<\/p>\n<p>Thorn also flagged 3.0134 BTC entering the destination from addresses Galaxy had not previously tracked. He considered them possible additional white-hat recoveries, but their Coldcard origin remains uncertain.<\/p>\n<p>In an Aug. 17 report, digital-asset recovery firm DART said it and independent researchers had secured just over 50 BTC, according to its internal ledger, and placed the rescued Bitcoin with Crypto Recovery Trust.<\/p>\n<p>The Sept. 21 transaction gives owners a public trail for a recovery DART had described a month earlier.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">A flaw in Coldcard seed generation lets attackers recreate private keys from the press of a button<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>What happens after a Bitcoin address match?<\/h2>\n<p>DART says its trust process checks recovery records, chain of custody, and proof of ownership, including source-of-funds and exchange records. Sanctions, competing claims, or other restrictions can affect any return.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining The Catalyst\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Catalyst <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">What\u2019s moving crypto. Why it matters.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Get CryptoSlate\u2019s essential stories and what to watch next.<\/p>\n<p>  <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"16\" fill=\"currentColor\" viewbox=\"0 0 16 16\" aria-hidden=\"true\" focusable=\"false\"> <path d=\"M15 3.604H1v1.891h14v-1.89ZM1 7.208V16l7-3.926L15 16V7.208zM15 0H1v1.89h14z\"\/> <\/svg> <span>Published on Substack<\/span> <\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Seven days a week. Unsubscribe anytime.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<div class=\"cs-inline-newsletter__success\" role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" tabindex=\"-1\"> <span class=\"cs-inline-newsletter__success-icon\" aria-hidden=\"true\"\/><\/p>\n<div>\n<h3 class=\"cs-inline-newsletter__success-title\">Check your inbox.<\/h3>\n<p class=\"cs-inline-newsletter__success-copy\">Your signup request was sent. If confirmation is required, follow the email from Substack.<\/p>\n<p class=\"cs-inline-newsletter__success-hint\">Look in spam or promotions if you don\u2019t see it.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<figure id=\"attachment_565372\" aria-describedby=\"caption-attachment-565372\" style=\"width: 720px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"shoggoth-infographic shoggoth-infographic-portrait wp-image-565372\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f.png\" alt=\"Coldcard Bitcoin recovery timeline: DART disclosed just over 50 BTC secured in August; a September transaction was confirmed in block 967,948; Alex Thorn traced about 52.37 BTC and flagged 3.0134 BTC as previously untracked; an owner address match leads to verification, not established payout.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-768x960.png 768w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload shoggoth-infographic shoggoth-infographic-portrait wp-image-565372\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f.png\" alt=\"Coldcard Bitcoin recovery timeline: DART disclosed just over 50 BTC secured in August; a September transaction was confirmed in block 967,948; Alex Thorn traced about 52.37 BTC and flagged 3.0134 BTC as previously untracked; an owner address match leads to verification, not established payout.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-6b7fb0c8-2201-4531-becb-d82da512f15f-768x960.png 768w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><figcaption id=\"caption-attachment-565372\" class=\"wp-caption-text\">A public Bitcoin trace linked 52.37 BTC to Coldcard\u2019s recovery disclosure, but ownership verification and victim payouts remain unresolved.<\/figcaption><\/figure>\n<p>The Coldcard entropy flaw made some older wallet seeds easier to reconstruct. DART says an existing seed created under affected firmware remains exposed after a firmware update, and owners with exposed funds should follow the manufacturer&#8217;s migration guidance.<\/p>\n<p>DART also warns against sending seeds, private keys, PINs, or recovery codes through a web form. The initial address check Thorn described needs a public address, while proving ownership is a separate step.<\/p>\n<\/div>\n<p>Crime,Featured,Hacks,Wallets,Bitcoin,BTC,ColdcardBitcoin,BTC,Coldcard#White #hats #recover #Bitcoin #Coldcard #exploit #public #portal #lets #victims #check #eligibility1790215256<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coldcard owners can publicly check whether white hats recovered coins from their wallets. Galaxy researcher Alex Thorn linked a Sept. 21 Bitcoin transaction carrying a Crypto Recovery Trust claims reference to roughly 52.37 BTC from Coldcard-related clusters. He directed owners to search their public Bitcoin addresses at the trust&#8217;s site. A match can begin an<\/p>\n","protected":false},"author":1,"featured_media":13643,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,285,727,5845,7092,664,7090,5077,7091,1279,1979,4371,1463],"class_list":["post-13642","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-btc","tag-check","tag-coldcard","tag-eligibility","tag-exploit","tag-hats","tag-lets","tag-portal","tag-public","tag-recover","tag-victims","tag-white"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=13642\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility\" \/>\n<meta property=\"og:description\" content=\"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=13642\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-24T02:00:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=13642\",\"name\":\"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp\",\"datePublished\":\"2026-09-24T02:00:56+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=13642\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13642#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility - Crypto News: Latest Cryptocurrency News and Analysis","description":"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=13642","og_locale":"en_US","og_type":"article","og_title":"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility","og_description":"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.","og_url":"https:\/\/cryptonews.uk.com\/?p=13642","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-24T02:00:56+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=13642","url":"https:\/\/cryptonews.uk.com\/?p=13642","name":"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp","datePublished":"2026-09-24T02:00:56+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Coldcard owners can check their Bitcoin addresses against 52.37 BTC in traced recovery funds and begin the process of reclaiming their coins.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=13642#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=13642"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=13642#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-whitehat-rescue.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=13642#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"White hats recover 52 Bitcoin from Coldcard exploit, and a new public portal lets victims check eligibility"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13642"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13642\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/13643"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}