Galaxy Digital Head of Research Alex Thorn said on September 21 that white-hat operators moved 52.37 BTC tied to the Coldcard exploit into a newly created address linked to the Crypto Recovery Trust. The transaction was confirmed in Bitcoin block 967,948, with the recovered funds consolidated under a structure intended to support victim claims and restitution.
❄️COLDCARD WHITE HAT MOVES FUNDS TO TRUST 🏳️
52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948
these white hatted funds represent 2.8% of the coldcard exploit pic.twitter.com/c5eYeQMxHQ
— Alex Thorn (@intangiblecoins) September 21, 2026
Thorn said the 52.37 BTC came from Wave 2 and tracked footprints labeled AA, AU and AX, representing about 2.8% of total Coldcard exploit funds identified in his analysis. He added that roughly 40% of Wave 2 activity has now been classified as white-hat, while an additional 3.0134 BTC sent to the same address may also be recovered funds, though that remains unconfirmed.
The transfer included an OP_RETURN message directing affected users to cryptorecoverytrust.com to check potential claims. The next step is verification and eventual distribution to rightful owners through the recovery trust, while Thorn’s tracking work continues to distinguish white-hat recoveries from funds controlled by malicious actors.
Source: Alex Thorn.
Disclaimer: Crypto Economy Flash News are based on verified public and official sources. Their purpose is to provide fast, factual updates about relevant events in the crypto and blockchain ecosystem.
This information does not constitute financial advice or investment recommendation. Readers are encouraged to verify all details through official project channels before making any related decisions.
