A group of white-hat researchers has moved 52.37 BTC from wallets compromised in the COLDCARD exploit to a recovery address controlled by the Crypto Recovery Trust. The transfer, which occurred around block 967,948, represents roughly 2.8% of the total funds drained during the attack.

The COLDCARD exploit saw attackers siphon off an estimated 1,500+ BTC, with total losses surpassing $100 million. Starting on July 30, 2026, attackers drained approximately 594 BTC within minutes from exposed wallets. The speed suggested automated tooling, likely scripts scanning the blockchain for addresses generated with the faulty entropy and sweeping them in bulk.

The effort was partly organized by DART, the Digital Asset Recovery Trust, which identified…