The Coldcard 'Rescue' Is 52.37 BTC Against 1,789 BTC Stolen: 2.9% Recovered, 1,393 BTC Still in Attacker Hands, and the Wyoming Trust Only Returns Coins to Owners Who Can Sign From the Compromised Key
The headline number. On September 21, 2026 (block 967,948) white-hat operators consolidated 52.37 BTC into a single address controlled by Crypto Recovery Trust, a Wyoming statutory trust represented by Steptoe LLP, with an OP_RETURN reading "claim:cryptorecoverytrust dot com". A further 3.01 BTC with no tracked history was co-spent into the same address.
The denominator. Galaxy Research's August 24 accounting puts the Coldcard entropy theft at 1,789.28 BTC from 8,865 addresses, worth $114.7 million at the time of theft (TRM Labs has ~1,816 BTC / ~$116 million; Galaxy has flagged a possible fourth wave that would take it to ~2,055 BTC). 52.37 / 1,789.28 = 2.9% recovered. CoinDesk's framing of 2.8% "of tracked exploit funds" is the same arithmetic. Roughly 1,393 BTC (76%) sits untouched in attacker clusters and another ~97 BTC has been laundered.
Where the 52.37 BTC came from. Wave 2 (1,478 victim addresses): 30.19 BTC, about 40% of that wave, was white-hatted; the other 60% (45.9 BTC) is in other hands. Footprint AX: 17.98 BTC across 100 victim addresses, fully white-hatted. Footprints AA and AU: 1.19 BTC combined. Nick Bax (SEAL) rescued about 50 BTC in late July before the malicious operators reached those addresses and did not take a bounty; DART published its recovery report August 17 and Bax disclosed publicly on September 9.
Where the rest is. Wave 1, the July 30 sweep that drained 1,196 addresses in 41 minutes for 1,082.65 BTC (~$70 million then), is entirely untouched by white hats. Wave 3 (214.07 BTC) is 55% dormant and 45% laundered, with 97.09 BTC pushed through CoinJoin, THORChain and Tornado Cash on September 7. At least 15 distinct attackers participated between July 30 and August 6, after which Galaxy says sweeps stopped.
How a victim actually gets coins back. The trust does not publish a wallet list. A claimant searches their address, signs a one-time message with the private key of the compromised wallet, submits documentation, and passes ownership review, source-of-funds screening, sanctions checks and notice attempts before any return. That is the correct design, but it means victims who have already destroyed or lost the weak seed cannot prove ownership through the primary channel.
The root cause has not changed. A March 2021 firmware build error made seed generation fall back to a software PRNG: effective key space ~40 bits on Mk2/Mk3 and ~72 bits on newer models, against a designed 128. Updating firmware does not repair an existing seed; users must generate a new seed on fixed firmware and move funds. We covered this in our August 22 card on the 40-bit seeds.
Two platform-card corrections. This story is filed under "lightning" and its sibling ("White Hats Beat Coldcard Attackers, Rescuing Millions") under "etf"; both are self-custody security stories. And "rescuing millions" is true but misleading in proportion: the white hats rescued about $4.5 million from a theft of $115-140 million. The reassuring frame belongs to the 2.9%, not the 100%.
Sources (6)
AI Research
Key Takeaway
White hats moved 52.37 BTC into a Wyoming recovery trust, but that is 2.9% of the 1,789 BTC Coldcard theft; Wave 1 (1,082 BTC) is entirely in attacker hands and victims must sign from the compromised key to claim.
The headline number. On September 21, 2026 (block 967,948) white-hat operators consolidated 52.37 BTC into a single address controlled by Crypto Recovery Trust, a Wyoming statutory trust represented by Steptoe LLP, with an OP_RETURN reading "claim:cryptorecoverytrust dot com". A further 3.01 BTC with no tracked history was co-spent into the same address.
The denominator. Galaxy Research's August 24 accounting puts the Coldcard entropy theft at 1,789.28 BTC from 8,865 addresses, worth $114.7 million at the time of theft (TRM Labs has ~1,816 BTC / ~$116 million; Galaxy has flagged a possible fourth wave that would take it to ~2,055 BTC). 52.37 / 1,789.28 = 2.9% recovered. CoinDesk's framing of 2.8% "of tracked exploit funds" is the same arithmetic. Roughly 1,393 BTC (76%) sits untouched in attacker clusters and another ~97 BTC has been laundered.
Where the 52.37 BTC came from. Wave 2 (1,478 victim addresses): 30.19 BTC, about 40% of that wave, was white-hatted; the other 60% (45.9 BTC) is in other hands. Footprint AX: 17.98 BTC across 100 victim addresses, fully white-hatted. Footprints AA and AU: 1.19 BTC combined. Nick Bax (SEAL) rescued about 50 BTC in late July before the malicious operators reached those addresses and did not take a bounty; DART published its recovery report August 17 and Bax disclosed publicly on September 9.
Where the rest is. Wave 1, the July 30 sweep that drained 1,196 addresses in 41 minutes for 1,082.65 BTC (~$70 million then), is entirely untouched by white hats. Wave 3 (214.07 BTC) is 55% dormant and 45% laundered, with 97.09 BTC pushed through CoinJoin, THORChain and Tornado Cash on September 7. At least 15 distinct attackers participated between July 30 and August 6, after which Galaxy says sweeps stopped.
How a victim actually gets coins back. The trust does not publish a wallet list. A claimant searches their address, signs a one-time message with the private key of the compromised wallet, submits documentation, and passes ownership review, source-of-funds screening, sanctions checks and notice attempts before any return. That is the correct design, but it means victims who have already destroyed or lost the weak seed cannot prove ownership through the primary channel.
The root cause has not changed. A March 2021 firmware build error made seed generation fall back to a software PRNG: effective key space ~40 bits on Mk2/Mk3 and ~72 bits on newer models, against a designed 128. Updating firmware does not repair an existing seed; users must generate a new seed on fixed firmware and move funds. We covered this in our August 22 card on the 40-bit seeds.
Two platform-card corrections. This story is filed under "lightning" and its sibling ("White Hats Beat Coldcard Attackers, Rescuing Millions") under "etf"; both are self-custody security stories. And "rescuing millions" is true but misleading in proportion: the white hats rescued about $4.5 million from a theft of $115-140 million. The reassuring frame belongs to the 2.9%, not the 100%.