White-hat operators consolidated 52.37 BTC from Coldcard wallets affected by the seed-generation flaw into an address associated with the Wyoming-based Crypto Recovery Trust. Alex Thorn, Head of Firmwide Research at Galaxy Research, said the September 21 transaction in Bitcoin block 967,948 was the first sizeable public delivery from the recovery cluster to a clearly labeled trust address. The transfer drew from Wave 2 and Galaxy-tracked footprints AA, AU and AX, and included an OP_RETURN message directing claimants to the trust's website. Galaxy also identified 3.0134 BTC in the transaction whose source remains unestablished, although Thorn said it was co-spent with confirmed white-hat Coldcard funds. The trust holds recovered assets while claimants prove ownership through signed wallet messages and supporting records. Galaxy said 1,789.28 BTC were lost in the wider attacks, valued at $154.1 million at current prices, while its mapping accounted for 1,393 BTC, or 76.1% of its published exploit figure, and 1,082.57 BTC in Wave 1 remains untouched.