White hats rescued and moved 52.37 BTC from wallets exposed by the Coldcard vulnerability into the Crypto Recovery Trust, a Wyoming-based entity set up to return funds to victims.

Approximately 40% of the Bitcoin in the second wave of rescues was routed to the trust to safeguard victims’ funds, according to Galaxy Digital’s Alex Thorn.

A broader sweep redirected 52.37 BTC from multiple attacker clusters into a fresh address flagged for the Crypto Recovery Trust, representing about 2.8% of the total exploit.

Coinkite advised that fixing the firmware seed-generation flaw did not require a firmware update to repair an existing seed, underscoring that updates cannot repair seeds already created.

Thorn did not immediately respond to Cointelegraph’s request for comment.

Context notes AI-assisted generation in parts of the reporting and references to broader Coldcard attack coverage.

Thorn noted that 3.0134 BTC in the transfer came from addresses Galaxy had not previously tracked, with the origin of those coins unconfirmed.

Thorn added that another 3.0134 BTC appeared to be rescued from affected wallets but its origin could not be confirmed.

The firmware flaw originated in a March 2021 update, meaning some wallets could have remained vulnerable for over five years before the exploit; Coinkite acknowledged the issue and issued emergency firmware updates.

Determining ownership of recovered coins is challenging, with forensics on seed creation, exchange KYC records, victim-provided keys, and FBI reports guiding claims.

Coinkite urged affected users to migrate to freshly generated seeds and implemented extra security measures after the breach.

Galaxy Digital’s analysis cites a total of 1,830 BTC across 9,162 addresses linked to the vulnerability, showing the scale of the incident.