Whitehat operators have moved 52.37 BTC to an address associated with a newly established recovery trust, according to Alex Thorn, head of research at Galaxy Digital.
The transfer comes amid the fallout from the Coldcard hardware wallet exploit that began on July 30. Several waves of attacks followed in subsequent days, with estimated bitcoin losses surpassing $100 million.
The vulnerability caused affected wallets to generate recovery seeds using a weaker software-based random number source instead of the device’s dedicated random number generator. As a result, some seeds could potentially be reconstructed by attackers.
Coinkite, the company behind Coldcard, has released a firmware patch to address the issue. However, funds generated under the older vulnerable seeds may remain at risk even after the update.
Thorn said some of the bitcoin moved from victim wallets was not taken by criminals, but by whitehat security professionals seeking to secure the funds.
The whitehats reportedly transferred the assets to the recovery trust to safeguard them until they can be returned to their rightful owners.
