Whitehat operators have transferred 52.37 BTC linked to the Coldcard hardware-wallet exploit to an address associated with a newly established recovery trust, Galaxy Digital research chief Alex Thorn said.

The receiving Bitcoin address contains an OP_RETURN message directing users to “claim:cryptorecoverytrust dot com.” The transfer is part of an effort to safeguard funds removed from wallets affected by the July exploit and potentially return them to their owners.

The Coldcard attack began July 30 and involved three separate waves, labeled Waves 1, 2 and 3. The combined incidents are estimated to have resulted in more than $100 million worth of Bitcoin being lost.

The vulnerability was tied to seed generation. Affected wallets used a weaker software-based random-number source instead of Coldcard’s dedicated random-number generator, creating the possibility that attackers could reconstruct wallet seeds.

Coinkite, the company that develops Coldcard, has patched the affected firmware. However, the update cannot restore security to seed phrases that were already exposed before the vulnerability was fixed.

Thorn said blockchain analysis indicates that some funds moved from compromised wallets were handled by whitehat operators rather than the original attackers. These security researchers used their skills to move vulnerable assets into safer custody and prevent them from being stolen.

The 52.37 BTC transferred this week came from Wave 2 of the tracked exploit funds, along with three additional tracked footprints identified as AA, AU and AX. The transaction was sent to the recovery trust address and confirmed in Bitcoin block 967,948.

The transfer represents about 2.8% of the total exploit funds being tracked, Thorn said. He added that approximately 40% of Wave 2 has now been identified as whitehat activity.

The same transaction also moved an additional 3.0134 BTC that had no previous tracking history. Thorn said the coins are presumed to be further Coldcard funds recovered by whitehat operators, although their origin has not been confirmed.

Coldcard victims can check whether their funds were recovered by searching their wallet addresses through cryptorecoverytrust.com.