About 40% of Coldcard Wave 2 outflows were whitehat rescues, Galaxy says
- —52.37 BTC were sent to a recovery trust address in block 967,948 with a claim:cryptorecoverytrust.com note
- —Galaxy linked the coins to three attacker clusters it calls Footprint AA, AU and AX
- —Another 40.71 BTC (~$3.31 million) moved on September 21 in a transaction with 11 addresses and 480 outputs
- —Coldcard exploit losses are estimated at $100–130 million across more than 5,200 addresses
Why it matters: Some stolen funds were intercepted before attackers could move them, but most coins remain dormant in attacker wallets and old exposed seeds stay at risk.
Source: Cryptopolitan