White-hat hackers moved 52.37 BTC linked to the Coldcard exploit into an address apparently controlled by Crypto Recovery Trust, a Wyoming trust established to help return recovered assets to victims. Alex Thorn of Galaxy said the coins came from Wave 2 and Footprints AA, AU and AX, and were consolidated in block 967,948 with an OP_RETURN message directing claimants to the trust. The recovered amount represents about 2.8% of the exploit and was worth more than $4.4 million at the cited valuation. A further 3.0134 BTC entered the same address, but its connection to Coldcard has not been confirmed. Thorn said about 40% of Wave 2 was swept by white hats, while the status of the remaining 60% is unclear. The incident involved a Coldcard seed-generation flaw that enabled remote reconstruction of some wallet seeds, affecting more than 8,600 addresses and roughly 1,779 BTC from July 30. The trust now faces the challenge of determining rightful ownership and returning the rescued funds.