A Bitcoin transaction confirmed on September 21 in block 967,948 carried a reference to Crypto Recovery Trust, according to analysis by Galaxy Digital researcher Alex Thorn. The transaction is linked to approximately 52.37 BTC recovered from clusters associated with the Coldcard hardware wallet exploit, representing 2.8% of the total exploit funds.
The recovered Bitcoin has been placed with Crypto Recovery Trust, a claims portal operated by digital-asset recovery firm DART. Victims can check their eligibility through the trust’s public portal using only their wallet address as an initial step.
Recovery and Verification Process
DART reported in August that it had secured just over 50 BTC and placed the funds with Crypto Recovery Trust. The September transaction confirms the movement of those recovered assets on-chain, with the trust reference embedded in the transaction data.
The recovery process requires victims to verify ownership separately from the initial address check. DART’s verification includes checking recovery records, chain of custody, and proof of ownership, including source-of-funds and exchange records. The firm warns against sending seeds, private keys, PINs, or recovery codes through a web form.
Sanctions, competing claims, or other restrictions can affect any return to victims. DART did not specify how long the ownership verification process takes or whether any payouts have been completed.
The Coldcard Vulnerability
The Coldcard entropy flaw made some older wallet seeds easier to reconstruct. An existing seed created under affected firmware remains exposed even after a firmware update. DART and independent researchers worked to identify and recover funds from addresses generated by compromised seeds, though the names of the independent researchers were not disclosed.
The September transaction also shows 3.0134 BTC entering the destination address from previously untracked sources. DART did not clarify the origin or status of those additional funds.
