Crypto Recovery Trust announces Bitcoin restitution after the Coldcard exploit
The Crypto Recovery Trust announced that it had returned more than 20 BTC to a verified owner after funds were rescued during the Coldcard exploit. The restitution connected a technical rescue to a legal process for establishing ownership.
On September 23, 2026, the Crypto Recovery Trust announced the return of more than 20 BTC, then worth approximately $1.7 million, to their verified owner. Steptoe, whose attorneys advised the trust, published its account the following day. The disclosure date establishes when the return was publicly announced, not necessarily the time of the transfer itself.
The coins came from a larger pool of roughly 50 BTC rescued by white-hat actors during the Coldcard exploitation episode in late July. Reporting on that rescue appeared in September. The wallet problem involved weak seed generation in affected firmware: once a recovery seed is predictable, installing a software update does not retroactively make the old seed safe.
Rescue and restitution were different operations. Moving vulnerable coins out of an exploitable wallet could prevent an attacker from taking them, but it left the rescuers holding property belonging to someone else. The trust used a claim-verification process to establish entitlement before returning funds. Its account said owners did not have to disclose seed phrases or private keys and were not charged a recovery fee.
This first reported return demonstrated an ownership-verification route after an emergency intervention in self-custodied Bitcoin. It did not mean all exploit losses were recovered or every coin held by the trust had already been returned.