White hats rescued and moved 52.37 BTC from wallets exposed by the Coldcard entropy flaw to the Crypto Recovery Trust, a Wyoming-based entity created to return funds to victims.

About 40% of the second wave rescues were routed to the trust to shield victims’ funds, according to Galaxy Digital’s Alex Thorn.

In a wider sweep, 52.37 BTC from multiple attacker clusters was funneled into a fresh address flagged for the Crypto Recovery Trust, amounting to roughly 2.8% of the total exploit.

Coinkite advised that fixing the seed-generation flaw does not require a firmware update and that updating firmware won’t repair an already created seed.

Thorn did not immediately respond to Cointelegraph’s request for comment.

Verification for any return includes checks of recovery records, chain of custody, and proof of ownership, and may be affected by sanctions or competing claims.

The article notes AI-assisted generation in parts of the reporting and references broader coverage of the Coldcard attack and follow-up.

Determining ownership of recovered coins involves multiple evidence paths, including seed-forensics, exchange KYC records, victim-provided keys, and FBI reports.

The entropy flaw enabled easier seed reconstruction; owners with exposed funds should migrate per manufacturer guidance and avoid sending seeds, keys, PINs, or recovery codes through web forms.

An initial public trace and ongoing reporting aim to provide transparency and a public path for victims to seek lawful reclaim of assets.

Thorn noted a portion of the transfer came from previously untracked addresses, with origin unconfirmed but likely from affected wallets.

The firmware flaw originated in a March 2021 update, meaning some wallets could have remained vulnerable for years; Coinkite released emergency firmware updates.