What happened.

White hats reportedly evacuated 52 Bitcoin from hacked Coldcard signing devices and routed the coins to an address tagged for a Wyoming Crypto Recovery Trust. Galaxy Digital’s Alex Thorn said the trust was intended to allow victims to reclaim the coins. The reporting describes an active recovery effort rather than a final resolution for affected holders.

Why it matters.

The transfer creates a reported recovery path for funds associated with the exploit. It also puts the focus on whether the tagged address, the trust, and the victim-reclamation process can be independently confirmed. For affected users, the relevant development is not only the movement of coins, but whether the recovery mechanism ultimately enables claims.

What remains unclear.

The available reports conflict on the size of the recovery relative to the exploited funds. Cointelegraph called the transfer roughly 40% of the exploit’s second wave, while Decrypt put it at 2.8% of the total haul. Those figures may use different denominators, but the supplied record does not explain them, so the scale of recovery cannot be resolved from this evidence alone.

What to watch

Watch for confirmation from the Crypto Recovery Trust or the tagged address that establishes how affected victims can reclaim the transferred coins.

Sources and limits

Upstream references and independent checks

Digest dated 2026-09-23 · upstream model sonnet. Direct links are matched to all 3 upstream source IDs.

  1. 1
    White Hats Move Over $4.5 in Bitcoins From Coldcard to Recovery TrustDirect upstream source · 5573f0335f9db8299733be9bbd25811a5562ac52
  2. 2
    White hats outrun Coldcard hackers in 52-Bitcoin evacuationDirect upstream source · 40eb9a0619460dc4ca2b4c8b998cea08dba6c0d0
  3. 3
    White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'Direct upstream source · a8ce23b034d2efc77af5bf2202a72b8af9ce3af1

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The most material limit is the conflicting reporting on what proportion of the exploited funds the 52-Bitcoin transfer represents, and the supplied record does not provide the underlying transaction or claims-process details.