According to Galaxy Digital's Head of Research Alex Thorn, white-hat hackers have moved 52.37 Bitcoin linked to the July Coldcard wallet exploit into an address associated with a newly formed recovery trust. The transaction was confirmed in block 967,948 and represents 2.8% of the total tracked exploit funds. As reported by Galaxy Digital, this recovery action demonstrates the ongoing efforts of ethical cybersecurity professionals to protect and return compromised cryptocurrency assets. Thorn explained that some of the coins moved out of victim wallets weren't taken by malicious actors but by whitehats, or ethical cybersecurity professionals who use hacking skills to find and fix security weaknesses. These ethical hackers swept the funds specifically to keep them safe until they could be returned to their rightful owners. The latest movement includes funds from Wave 2 (30.18 BTC) and Footprint AX (17.98 BTC), with minimal amounts from Footprints AA and AU, along with an additional 3.0134 BTC from an unidentified source.
The Coldcard crypto hardware wallet hack began on July 30, 2026, with attackers siphoning off an estimated 1,500+ BTC with total losses surpassing $100 million. According to TradingView News, starting on July 30, 2026, attackers drained approximately 594 BTC within minutes from exposed wallets. The speed suggested automated tooling, likely scripts scanning the blockchain for addresses generated with the faulty entropy and sweeping them in bulk. The vulnerability traces back to a firmware build error in certain COLDCARD hardware wallet models, compromising the device's hardware random-number generator responsible for producing seed phrase generation entropy. Coinkite, the maker of Coldcard, acknowledged the issue and released emergency firmware updates, though the firmware build error reportedly originated in a March 2021 update, meaning some wallets had been silently vulnerable for over five years before the exploit was carried out.
The 52.37 BTC moved this week represents consolidated funds from Wave 2 of the tracked exploit funds along with three footprints labeled AA, AU and AX. As reported by Galaxy Digital, the funds were sent to an address carrying an OP_RETURN message reading "claim:cryptorecoverytrust.com." Additionally, 3.0134 BTC with no prior tracking history also flowed into the CRT address in the same transaction, presumably representing additional white-hat-recovered Coldcard funds, though this remains unconfirmed. TradingView News reports that DART, the Digital Asset Recovery Trust, identified vulnerable address clusters tied to the COLDCARD entropy flaw and had reportedly secured over 50 BTC by late July 2026, parking it in the Crypto Recovery Trust. The trust is a Wyoming-based statutory entity advised by Steptoe LLP, with a stated mission to document recoveries, segregate assets from any operational funds, and verify rightful ownership before releasing anything. At Bitcoin's price of roughly $85,293 as of the latest reports, the recovered 52.37 BTC is worth approximately $4.5 million. The Crypto Recovery Trust allows verified owners to submit claims and provide evidence for returned assets through its website, with the process including blockchain analysis, proof-of-ownership checks and sanctions screening before assets can be returned.
According to Galaxy Digital's latest analysis, the recovery process has progressed through multiple waves with varying success rates. Wave 1 accounts for approximately 1,082.57 BTC, which remains untouched, while Wave 2 now accounts for roughly 76.09 BTC, with part moved into the Crypto Recovery Trust and approximately 45.90 BTC still held. Wave 3 accounts for about 214.07 BTC, of which approximately 116.98 BTC remained held while another portion had moved elsewhere. All these waves, along with the additional tracked footprints, account for roughly 1,393 BTC (76.1% of the published total COLDCARD-exploited funds). Researchers note that they do not know whether the other roughly 60% of Wave 2 was also moved by white hats, though roughly 40% of Wave 2 was moved into the recovery operation, with the status and identity of the operator behind the remaining funds remaining uncertain.
Bitcoin ETFs experienced a dramatic turnaround from midweek volatility, with the category posting $6.21 million in weekly inflows by Friday's close after nursing more than $426 million in redemptions earlier in the week. According to latest reports, the recovery was driven by a $433.03 million surge that reversed the negative sentiment. The week began strongly with $160.04 million flowing into bitcoin funds on Monday, but Tuesday saw $450.33 million exit following the Senate's failed cloture vote on the Digital Asset Market Clarity Act. Wednesday brought another $295.98 million withdrawal as the Fed raised rates by 25 basis points to 3.75%-4%, marking its first increase since July 2023. Thursday produced a $159.45 million rebound before Friday's buying completed the turnaround. Blackrock's IBIT finished the week with $120.66 million in net inflows, while Fidelity's FBTC added $79.9 million and Morgan Stanley's MSBT gained $13.2 million. Notably, Ark & 21Shares' ARKB suffered the largest weekly exit at $141.9 million, while Grayscale's GBTC lost $62.3 million.
