White Hats Rescue 40% of 52 Bitcoin in Coldcard Exploit Second Wave

The recovery is notable less for its size than for its structure: white hats reaching funds before attackers could move them, then routing them into a purpose-built trust rather than holding them ad hoc. That suggests improvised but coordinated incident response is becoming a repeatable playbook in the Coldcard fallout, which matters for victims awaiting restitution and for the attackers watching their margins shrink. Whether the trust mechanism actually delivers funds back to victims, and whether the remaining portion is recovered or simply goes quiet, is the open question.