{"id":78525,"date":"2026-09-22T22:06:43","date_gmt":"2026-09-22T22:06:43","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/white-hats-beat-coldcard-attackers-rescuing-millions-of-dollars-in-bitcoin-bitcoin-news\/"},"modified":"2026-09-22T22:06:43","modified_gmt":"2026-09-22T22:06:43","slug":"white-hats-beat-coldcard-attackers-rescuing-millions-of-dollars-in-bitcoin-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/white-hats-beat-coldcard-attackers-rescuing-millions-of-dollars-in-bitcoin-bitcoin-news\/","title":{"rendered":"White Hats Beat Coldcard Attackers, Rescuing Millions of Dollars in Bitcoin \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">White hats beat Coldcard attackers to 52.37 BTC and moved the funds into a recovery trust.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Thorn says 40% of funds from Coldcard\u2019s Wave 2 were swept by white hats protecting victim funds.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Crypto Recovery Trust now faces the task of returning 52.37 BTC to rightful owners.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p>The Coldcard exploit looked like <a href=\"https:\/\/news.bitcoin.com\/security\/coldcard-hack-116-million-fourth-wave\/\">a straightforward disaster<\/a> when bitcoin began disappearing from vulnerable wallets this summer. Attackers had discovered that some Coldcard seeds could be reconstructed offline, and the race was suddenly on to reach exposed coins. But Thorn\u2019s investigation has uncovered a fascinating wrinkle in that story.<\/p>\n<p>Some of the people sweeping those wallets weren\u2019t thieves at all. They were white hat hackers trying to beat the thieves to the money, and at least 52.37 BTC appears to have survived that race.<\/p>\n<h2>Thorn Spots 52.37 BTC Heading to a Trust<\/h2>\n<p>\u201cCOLDCARD WHITE HAT MOVES FUNDS TO TRUST,\u201d <a href=\"https:\/\/x.com\/intangiblecoins\/status\/2102114798833946783?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Thorn wrote Tuesday<\/a>, before laying out what he had spotted onchain. According to the Galaxy researcher, \u201c52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX\u201d were consolidated into a new address in block 967,948.<\/p>\n<p>The transaction even <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board\/\">carried an OP_RETURN message<\/a> reading \u201cclaim:cryptorecoverytrust dot com,\u201d effectively leaving an onchain signpost explaining where the rescued bitcoin had gone. Thorn calculates that those rescued coins amount to \u201c2.8% of the Coldcard exploit.\u201d More importantly, his analysis changes the picture surrounding Wave 2, one of several groups of transactions researchers have been tracking since the drains began.<\/p>\n<p>\u201cWe now know that ~40% of Wave 2 was actually white hats sweeping coins to protect victim funds,\u201d Thorn explained. Those coins, he added, \u201chave now apparently been delivered to an address controlled by Crypto Recovery Trust,\u201d a Wyoming trust established to help <a href=\"https:\/\/news.bitcoin.com\/security\/openai-hacked-white-hat-researchers-anthropic-claude-opus-5\/\">legitimate white hats<\/a> get recovered assets back to victims.<\/p>\n<h2>The Numbers Get Stranger<\/h2>\n<p>The 52.37 BTC\u2014more than $4.4 million worth, as of this writing\u2014may not be the whole haul. Thorn noticed another 3.0134 BTC entering the Crypto Recovery Trust address in the same transaction, but he is deliberately cautious about counting it.<\/p>\n<p>\u201cWe have not seen these coins before,\u201d he wrote in his X thread, adding that they are \u201cpresumably\u201d additional Coldcard funds recovered by white hats, although his team cannot yet confirm their origin.<\/p>\n<p>That caution matters because Thorn is trying to reconstruct an exploit involving a great deal more money. His accounting of Waves 1, 2, and 3, together with the trust funds, covers 1,393 BTC, or 76.1% of the published Coldcard exploited total. Wave 1 alone remains untouched at 1,082.57 BTC. Wave 3 has 116.98 BTC untouched, while 97.09 BTC <a href=\"https:\/\/news.bitcoin.com\/featured\/coldcard-hacker-resumes-moving-stolen-bitcoin\/\">was coinjoined<\/a> or routed through Thorchain to Ethereum, and then attackers used Tornado Cash to mix the ether. Footprints AX, AA and AU, by contrast, are now considered \u201c100% white-hatted.\u201d<\/p>\n<h2>What About the Rest of the Bitcoin?<\/h2>\n<p>The mystery isn\u2019t completely solved. Thorn said researchers still don\u2019t know whether the remaining 60% of Wave 2 funds were taken by malicious attackers or by another group of white hats. What he can say is that the two portions appear to involve different operators. Thorn has also spoken with individual Coldcard victims represented in both parts of Wave 2, strengthening the link between those transactions and the broader Coldcard incident.<\/p>\n<p>\u201cWe do not know if the other 60% of funds taken in Wave 2 are also white hats,\u201d Thorn wrote. He said that, white hat or not, the remaining coins appear to have been handled by \u201ca different operator (or operators)\u201d from the group whose bitcoin ultimately reached Crypto Recovery Trust. In other words, investigators can now explain a large chunk of what initially looked like stolen bitcoin, but another substantial pile remains anyone\u2019s guess.<\/p>\n<h2>Proving Who Really Owned the Bitcoin<\/h2>\n<p>Recovering the coins creates another problem: How does a trust determine who actually owned them when both the victim and attacker may possess credentials capable of accessing the wallet? When an X user <a href=\"https:\/\/x.com\/intangiblecoins\/status\/2102198990016032991?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">put that question<\/a> to Thorn, he said there are several pieces of evidence that could be combined rather than relying on one definitive test.<\/p>\n<p>\u201cCould do it a few ways,\u201d Thorn replied, suggesting that \u201cseveral creates a preponderance.\u201d Among the evidence he listed were device forensics showing who created the seed first, exchange know-your-customer records showing withdrawals to an address that was subsequently drained, victims previously providing him with an xpub or zpub extended public key, and an early FBI report.<\/p>\n<p>Crypto Recovery Trust also allows <a href=\"https:\/\/news.bitcoin.com\/security\/how-bitcoin-hardware-wallets-supported-users-during-the-coldcard-crisis\/\">Coldcard victims<\/a> to search their addresses to determine whether their bitcoin may be among the funds rescued by white hats.<\/p>\n<h2>The Coldcard Bug That Started the Race<\/h2>\n<p>Behind Thorn\u2019s detective work is <a href=\"https:\/\/news.bitcoin.com\/featured\/the-coldcard-exploit-explained-who-lost-bitcoin-and-whos-at-risk\/\">a Coldcard firmware bug<\/a> that weakened wallet seed generation, allowing attackers to reconstruct seeds remotely. Beginning July 30, the exploit ultimately affected more than 8,600 addresses and roughly 1,779 BTC.<\/p>\n<p>Thorn\u2019s latest finding adds a twist. Basically, white hats discovered vulnerable coins too, beating attackers to 52.37 BTC and moving it into protective custody. Now the challenge is proving ownership and returning the bitcoin to rightful owners.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/white-hats-beat-coldcard-attackers-rescuing-millions-bitcoin\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways White hats beat Coldcard attackers to 52.37 BTC and moved the funds into a recovery trust. Thorn says 40% of funds from Coldcard\u2019s Wave 2 were swept by white hats protecting victim funds. Crypto Recovery Trust now faces the task of returning 52.37 BTC to rightful [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78526,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78525"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78525"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78525\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78526"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}