White hats have transferred Bitcoin rescued from wallets exposed by a Coldcard vulnerability to a trust established to return the funds to victims.

A total of 52.37 BTC was moved to an address controlled by Wyoming-based Crypto Recovery Trust, Galaxy Digital head of research Alex Thorn said in an X post on Monday. The transfer represented about 40% of the Bitcoin associated with the exploit’s second wave, which white hats swept to protect victims’ funds. By routing the rescued coins into a designated trust, the operation gives affected users a single, verifiable place to check whether their funds were swept on their behalf.

Thorn said 3.0134 BTC in the transfer came from addresses Galaxy had not previously tracked. The funds were presumably also rescued from wallets affected by the Coldcard flaw, he said, although Galaxy could not confirm their origin.

Security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped rescue about 50 BTC at the end of July because the funds were “imminently going to be stolen” as a result of the Coldcard entropy flaw. Bax’s statement was published on X. Galaxy’s research team has tracked addresses tied to the flaw on-chain, while SEAL 911’s responders have carried out the wallet-level rescues.

Thorn cited a published total of 1,830 BTC across 9,162 addresses linked to the Coldcard vulnerability. Potential victims can enter their wallet addresses on the Crypto Recovery Trust website to determine whether the trust controls their funds.

Thorn did not immediately respond to Cointelegraph’s request for comment.

The development follows a report that a Coldcard third-wave attacker moved 45% of the stolen Bitcoin. Cointelegraph source With roughly 60% of the second wave outside Monday’s transfer, based on Thorn’s figures, how the remaining second- and third-wave funds are handled stands out as the detail to watch as the recovery effort continues.