CoinMeta data: Some Bitcoin that was stolen in the vulnerabilities of Coldcard hardware wallets is being transferred by white-hat hackers to an account called a Recovery Trust. According to monitoring from Galaxy Research, on September 21st, a transaction transferred 40.71 BTC, worth approximately $3.31 million, involving 11 addresses and 480 outputs. The transaction contained an OP_RETURN message with " claims : cryptorecoverytrust.com ". Galaxy attributes these Bitcoins to attackers labeled as " footprint aa ". The study leader, Alex Thorn, stated that another round of transfers resulted in 52.37 BTC being moved to the same new address in the Recovery Trust, with the white-hat funds accounting for about 2.8% of the total amount stolen in the Coldcard vulnerability. This transfer marks a significant shift in one of the largest self-managed disasters of this year.