News
Public · Published
Galaxy traces 40% of Coldcard's second hack wave to whitehats
Galaxy's Alex Thorn says about 40% of the Coldcard exploit's second wave was whitehat activity, with 52 and 37 BTC moved to a recovery trust address.
Published:
Updated:
What happened
Galaxy's Alex Thorn says about 40% of the Coldcard exploit's second wave was whitehat activity, with 52 and 37 BTC moved to a recovery trust address.
Confirmed
Global impact / market context
Whitehat activity means ethical hackers recovering funds, so a large share of this wave may be returned rather than stolen, reducing losses and shaping how investors judge Bitcoin wallet security risks.
Analyst inference
The article links 52 and 37 BTC to a recovery trust address, showing some exploited Bitcoin is being pooled for return, which may ease fear of permanent loss and influence investor positioning in Bitcoin.
Analyst inference
What to watch
- Galaxy's Alex Thorn stated about 40% of the Coldcard exploit's second wave was whitehat activity, with 52 and 37 BTC moved to a recovery trust address. Confirmed
- Track whether the remaining portion of the second wave is also classified as whitehat activity, because that would change the total losses tied to this Coldcard exploit. Proposed
- Watch Bitcoin flows from the recovery trust address, since their movement could signal whether recovered coins are returned or remain controlled by the trust. Analyst inference
Affected assets
- BTC — Bitcoin