White-Hat Hackers Recover 52 BTC From Coldcard Exploit, $149M Remains Missing

White-hat actors have clawed back 52.37 BTC, worth roughly $4.5 million, from a Coldcard hardware wallet exploit that drained an estimated $154.1 million in Bitcoin from victims. The recovered coins now sit in a fresh address tagged as a "Crypto Recovery Trust," where verified victims can file to reclaim their funds.

Galaxy Digital tracked 1,789.28 BTC in total losses tied to the incident, making this one of the largest hardware wallet security failures on record by dollar value. The 52.37 BTC recovered represents just 2.8% of the total haul. The remaining 97.2%, approximately $149.6 million at current prices, is still missing.

Coinkite, the Canadian company that manufactures Coldcard wallets, attributed the exploit to weak security implementation rather than a fundamental flaw in the device's core architecture. That framing matters: it suggests user-facing or integration-layer failures rather than a compromised secure element, though the distinction offers cold comfort to victims who followed standard setup procedures. Coinkite has not publicly detailed the exact attack vector, leaving the security community to piece together what went wrong.

The white-hat response follows a pattern that has become familiar in crypto incident response. Ethical hackers front-run malicious actors to secure whatever funds remain accessible, then route them to a controlled address while a recovery process spins up. It happened after the Euler Finance exploit in March 2023, when the attacker ultimately returned $177 million after white-hat pressure and negotiation. The Coldcard situation is structurally different: the recovered funds appear to have been secured by third-party actors rather than returned by the exploiter, and the bulk of the Bitcoin is still unaccounted for.

"White hats rescued 52.37 BTC worth more than $4.5 million from the Coldcard exploit. Crypto Recovery Trust now holds the rescued Bitcoin for verified victims to reclaim."

Victims who want to access the Crypto Recovery Trust funds will need to go through a verification process. The specifics of that process have not been fully disclosed, which introduces friction at exactly the wrong moment. People who just lost Bitcoin to a hardware wallet breach are not well-positioned to navigate a complex claims procedure, and delays create windows for further complications.

The broader hardware wallet security picture is uncomfortable here. Coldcard has long been positioned as the paranoid-grade option for Bitcoin self-custody, favored by technically sophisticated users who distrust custodians and hot wallets. Its reputation rested on air-gapped signing, open-source firmware, and a community that did its own verification. A $154 million loss event cuts against all of that branding, regardless of whether the root cause was a firmware vulnerability, a supply-chain issue, or implementation errors on the user or integration side. Until Coinkite publishes a detailed post-mortem, every Coldcard user has reason to sit with some uncertainty.

Bitcoin is trading near $86,000, down 0.5% in the past 24 hours, with $35 billion in daily volume. At that price, 1,789 BTC represents a concentrated, meaningful loss for what is likely a relatively small number of affected wallets. Hardware wallet exploits rarely move spot prices, but they do move behavior: expect a near-term spike in questions about multisig setups, passphrase configurations, and whether Coldcard devices should be treated as compromised pending further disclosure.

The 97.2% still unrecovered is the number that matters most right now. Bitcoin on-chain is pseudonymous but traceable, and a haul this size will attract chain-analysis attention from multiple directions. Whether the attacker can successfully launder nearly 1,737 BTC without touching a flagged address is the open question. For victims, the honest answer is that the odds of additional recovery depend almost entirely on whether the exploiter makes a mistake.