White-hat trace links 52.37 BTC to Coldcard; owners can check

Galaxy researcher Alex Thorn posted a public trace tying a Sept. 21 Bitcoin transaction in block 967,948 to 52.37 BTC connected to funds exposed by a Coldcard entropy flaw.

Thorn directed Coldcard owners to a Crypto Recovery Trust portal where entering a public Bitcoin address will show whether the recovered coins match that address. The check requires only a public address and does not accept seed phrases, private keys, PINs or recovery codes.

The 52.37 BTC is part of pools recovery teams have tracked after the entropy weakness made some older wallet seeds easier to reconstruct. Digital-asset recovery firm DART reported on Aug. 17 that it and independent researchers had secured just over 50 BTC and transferred those coins to Crypto Recovery Trust; Thorn noted the Sept. 21 trace should not be counted as a separate recovery beyond DART’s disclosure.

Thorn also flagged 3.0134 BTC entering the same destination from addresses Galaxy had not tracked previously. He described those inputs as possible additional white-hat recoveries, but their Coldcard origin has not been confirmed.

DART and Crypto Recovery Trust say they will verify recovery records, establish chain of custody and confirm proof of ownership before any return of funds. Proof of ownership can include source-of-funds paperwork and exchange records. The trust cautioned that legal restrictions, sanctions or competing claims could delay or prevent payouts even if an address appears in the trace.

The Coldcard entropy flaw affects seeds generated under the vulnerable firmware. The device maker has published migration guidance for owners whose wallets were created before the fix; recovery teams say firmware updates do not protect seeds created under the affected firmware and recommend following the manufacturer’s migration steps to move funds to new seeds.

Recovery teams warn users never to submit private keys or seed phrases through web forms. The portal’s address check requires only public addresses and can start a documented ownership verification process if a match appears. Owners can use the public trace and the portal to determine whether recovered funds correspond to their addresses and to begin the verification process.