White Hats Move 52.37 BTC to Coldcard Victim Trust

White hat security researchers have transferred 52.37 Bitcoin, worth nearly $4.5 million, linked to the Coldcard hardware wallet exploit into an address controlled by the Wyoming-registered Crypto Recovery Trust, according to Galaxy Digital head of research Alex Thorn. The single transaction was confirmed in Bitcoin block 967,948 on September 22, 2026, and carried an OP_RETURN message directing users to claimcryptorecoverytrust.com to file ownership claims. Thorn said the funds came from the tracked Wave 2 cluster along with footprints labeled AA, AU and AX, and that the amount represents 2.8 percent of the exploit funds his team was tracking. He said roughly 40 percent of Wave 2 has been identified as white hat activity. Thorn also said 3.0134 BTC included in the transfer came from addresses Galaxy had not previously tracked, and that while the funds were presumably rescued from wallets affected by the Coldcard flaw, the firm could not confirm their origin.