Finally some good news in the Coldcard file. Nearly two months after the Coldcard breach which siphoned off more than 1,800 BTC from wallets deemed tamper-proof, 52.37 bitcoins have just taken the opposite path. They are now in a Wyoming legal trust responsible for returning them to their owners. The loot is worth around $4.5 million at today's rate. You still have to knock on the right door without falling into a new trap.
Key points:
On September 21, whitehats bundled 52.37 BTC linked to the hack at a Crypto Recovery Trust address.
According to Galaxy Research, nearly 40% of second wave funds were taken by security researchers, not thieves.
Victims prove they control their address by signing a message, without ever delivering their recovery phrase.
Updating your Coldcard does not protect a seed created with the old firmware.
Hack Coldcard: the hackers were not alone at the time
Back to July 30. In 25 minutes, 594 BTC leaves around 500 Coldcard addresses. The cause? A firmware defect caused the seeds (the recovery phrase that gives access to funds) to be generated from an all-too-predictable software random source instead of the dedicated chip, which made the keys guessable by brute force. Subsequent waves brought the addition to around 1,830 BTC according to Galaxy Research.
Except that not everyone was dumping these addresses for the same purpose. According to Alex Thorn, director of research at Galaxy, cited by CoinDesk on September 22, around 40% of bitcoins in the second wave were swept away by ethical hackers. These whitehats exploit the loophole before the criminals to protect the money.
The September 21 transfer, confirmed in block 967,948, brings together 30.19 BTC from this second wave, 17.98 BTC from a group of addresses called AX and a few crumbs from two others. Added to this are around 3 BTC with no known history, which Thorn attributes to other Coldcard rescues without being able to confirm it. It all landed on an address marked with an OP_RETURN message, a text inscription engraved in the blockchain, which links to cryptorecoverytrust.com.
Who holds the keys to the Coldcard bitcoin vault
First reflex, distrust. An address that invites you to “claim” lost funds looks exactly like scams that target hacking victims. On paper, however, this arrangement holds up. The Crypto Recovery Trust is a Wyoming statutory trust (Recovered Digital Asset Statutory Trust of Wyoming) whose trustee is Agentic Trace LLC. Lawyers from the national security division of the Steptoe firm advise him. DART, a structure specializing in the recovery of digital assets, coordinated the rescues and already claimed “a little more than 50 BTC” secured as of August 17.
No one will ask you for your seed. DART specifies it in black and white: no recovery phrase, no private key, no PIN code, only addresses and transaction identifiers. To prove control of an address, the applicant signs a unique message with keys that never leave their home. The trust then verifies the ownership and origin of the funds and screens the applicants through sanctions lists before any restitution. The site also ensures that it does not charge any fees.
Victims of the Coldcard hack: the right reflexes before claiming
If your bitcoins disappeared between the end of July and the end of August, type the site address yourself rather than clicking on a link received by message or email, then search for your addresses in the trust database. Fake recovery services sprout up like mushrooms after every hack, and this one will be no exception. A request for a recovery phrase or “unblocking fee” is a sure sign of a scam.
Another trap, more devious. Many owners think they are out of the woods because their Coldcard is running the latest firmware. Coinkite has nevertheless hammered it home: an update does not repair a seed generated by the defective version. If yours was created on a Mk2 or Mk3 before the patch, you must generate a new one and transfer your funds to it, whether your coins were affected or not.
