White Hats Move Over $4.5 in Bitcoins From Coldcard to Recovery Trust

HACK OR EXPLOITWhite Hats Move Over $4.5 inBitcoins From Coldcard toRecovery Trust45IMPORTANCECLOSED2NEWS MEDIA2PIECESSep 22, 2026 20:33blockboard.net

White-hat actors moved bitcoin tied to the Coldcard exploit into a new address labeled for a Crypto Recovery Trust. Galaxy Research said the coins consolidated there were a small share of the total haul, while Alex Thorn said the transfer was meant to protect potential victims and create a path for them to reclaim funds.

What this rests on

Claim by claim, with its source
✓
Alex Thorn said on X on Monday that white hats took the funds from the hacked Coldcard signing devices to protect potential victims.
✓
Thorn said the bitcoin was moved into a trust for would-be victims to reclaim.
✓
White-hat actors moved coins tied to the Coldcard exploit into a fresh address tagged for a Crypto Recovery Trust.
✓
Galaxy Research said the coins moved into that address represented 2.8% of the total haul.

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

People tied to the Coldcard exploit and anyone trying to recover those coins are the groups most directly affected today. The transfer into a recovery-labeled address means the assets are now sitting in a different place than before, and the move was described as being for potential victims to reclaim later.

In practice, the coins were consolidated into a fresh address marked for a Crypto Recovery Trust, which is a change in where the funds sit and how they are labeled. What stays the same is that the funds are still tied to the exploit, and Galaxy Research said the moved amount was only 2.8% of the total haul.

Market reaction

We track BTC, but we only have 1 price point in that window. The series is stored every half hour, so newer events will have it. Computing it from two points would not be a reaction, it would be a coincidence.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 22 17:20
Bitcoin Magazine scoop
Breaks the event: $154.1M and $4.5M
+2 h 11 m
Sep 22 19:31
Decrypt echo
No new facts: consolidated, represent, research; with quotes

Thefts of a similar size

WhenWhat happenedFigure
3 days ago KolanHook (1.279453 ETH) incident no figure in dollars
12 days ago SetProtocol (5.083725683631735476 ETH) incident no figure in dollars
18 days ago MUS (~0.400168 ETH) incident no figure in dollars
25 days ago Meter · Unknown incident no figure in dollars
29 days ago MultiversX incident no figure in dollars

4200 incidents stored · 2135 were as large as this one or larger ($4)

What could happen next

What the prediction markets currently price as likely. This is context, not a forecast of ours: there is money on it, and that is all we show.

2 % +0 pts
Kalshi · $4,465,194 of open interest · resolves on Jan 1, 2027
1 % no series
Kalshi · $1,022,099 of open interest · resolves on Oct 1, 2026
4 % +1 pts
Kalshi · $754,254 of open interest · resolves on Jan 1, 2027
11 % +0 pts
Kalshi · $601,374 of open interest · resolves on Jan 1, 2027