White-hat researchers have transferred 52.37 Bitcoin linked to the Coldcard wallet exploit into a recovery trust, a move intended to secure the funds before attackers can claim them. The transaction was confirmed in Bitcoin block 967,948.

The transfer marks the latest step in the ongoing effort to secure funds tied to the July Coldcard incident. The exploit affected wallets whose seed generation relied on weaker randomness, a weakness that allowed attackers to reconstruct certain wallet seeds and drain exposed balances.

The newly secured 52.37 BTC combines funds from Wave 2 and from address clusters identified as Footprints AA, AU and AX. Those labels reflect a common on-chain research technique, in which related addresses are grouped into named clusters so the movement of tracked funds can be followed across the public ledger. The amount represents roughly 2.8% of the total funds tracked in connection with the exploit.

Tracking the Recovered Bitcoin

The receiving address carried an OP_RETURN message directing affected users toward the recovery trust. OP_RETURN is a Bitcoin transaction output type that can embed a short text payload by anyone inspecting the chain, which is how the trust's instructions were made visible to affected users. The structure is designed to keep recovered assets separate while ownership claims undergo verification.

Researchers have also observed additional activity around the same recovery address. A further 3.0134 BTC moved into the address without any prior tracking history. Analysts have described those coins as potentially connected to the Coldcard recovery effort, though their origin remains unconfirmed. The uncertainty is a reminder that a public ledger shows where coins move but not who moved them, and attribution typically rests on the same kind of clustering evidence behind the Footprints labels.

About 40% of the tracked Wave 2 funds have now been identified as white-hat activity. The distinction matters because researchers moved these coins to protect them rather than to steal them, and the remaining share of Wave 2 funds has yet to be placed into confirmed categories.

Questions Over Distribution Remain

The recovery does not automatically mean affected users will receive their Bitcoin immediately. The trust must first establish which addresses qualify and determine how the recovered funds should be distributed.

The incident also highlights the continuing risk facing wallets created with vulnerable seed-generation processes. While a firmware update can address the underlying software flaw, it cannot retroactively change a seed that was already generated with weak randomness.

The 52.37 BTC now held in trust therefore provides a concrete pool of funds for potential restitution, while questions around verification, ownership and final distribution remain central to the recovery process. How the next stages unfold, including further identification of Wave 2 activity and clarity on the unattributed 3.0134 BTC, will shape what affected users can eventually recover.