Key facts
- White-hat actors moved 40.71 BTC (~$3.31 million) on Sept. 21, embedding a "claims: cryptorecoverytrust.com" message.
- A broader sweep consolidated 52.37 BTC from attacker clusters into an address flagged for the same trust.
- The Coldcard exploit originated from a March 2021 firmware flaw that made seed phrases guessable.
- The exploit peaked at roughly $130 million across thousands of addresses.
White-hat hackers have moved Bitcoin tied to the Coldcard exploit into a recovery trust, signaling an effort to return stolen funds to victims. On September 21, 40.71 BTC, valued at approximately $3.31 million, was transferred in a transaction containing the message "claims: cryptorecoverytrust.com."
Galaxy Research's blockchain monitoring indicated that these coins were attributed to attackers tagged as "Footprint AA" and a subsequent hop from the hack. In a related development, Alex Thorn, Galaxy's head of research, reported that a larger sweep consolidated 52.37 BTC from multiple attacker clusters into an address designated for the same Crypto Recovery Trust. These white-hatted funds represent about 2.8% of the total amount stolen in the exploit.
The Coldcard exploit, which peaked at around $130 million, originated from a firmware error in March 2021 that generated seed phrases with insufficient randomness, making private keys guessable. Coinkite has advised affected users to migrate to new seeds and implement new security measures.