A hardware wallet exploit that has rattled the Bitcoin custody world took another turn this week. According to CoinDesk and Cointelegraph, white-hat researchers managed to intercept roughly 52 bitcoin during a second wave of fund movements tied to the Coldcard hack — securing about 40% of what was being moved and routing it to a Wyoming recovery trust. The trust address carries an OP_RETURN message pointing to a claims site, giving affected users a formal path to seek restitution.
This is meaningful, but the situation remains unresolved. White hats outrunning attackers in real time is genuinely rare. It is also a reminder of just how narrow the margin is when a hardware vulnerability is actively being exploited. Galaxy Digital confirmed the recovery operation details. Victims who believe they were affected are being directed to the recovery trust to file claims — the process is still early.
Why Hardware Wallet Security Matters Right Now
The Coldcard incident is not an abstract risk story. Coldcard devices are widely used by self-custody Bitcoin holders precisely because they are considered among the most security-conscious options available. A successful exploit against that kind of hardware shakes assumptions that many holders have quietly relied on for years.
- Second-wave attacks suggest the original exploit gave bad actors ongoing access or information — not just a one-time breach.
- White-hat intervention required moving fast enough to beat automated or manual attacker withdrawals, which is extraordinarily difficult at scale.
- The recovery trust structure in Wyoming adds a legal layer to what is otherwise a purely technical rescue operation.
Users who hold Bitcoin on any hardware device should treat this as a prompt to verify firmware versions and review their seed phrase security practices. That is not overcaution — it is basic maintenance.
ETF Inflows Hit a 2026 High on the Same Day
Separately, Monday produced the largest single-day inflow into US spot Bitcoin ETFs since October 2025. The Block reported net inflows of $999 million — the ninth-largest daily total ever recorded for these funds. Bitcoin briefly crossed $87,000 during the session before settling near $86,000.
CoinDesk noted that ETF holders are now back in profit for the first time since January. That is a concrete shift in sentiment, though it does not say much about what comes next. What it does confirm is that institutional demand through regulated channels has not dried up, even after months of choppy price action.
The ETF inflow story and the Coldcard hack story are easy to treat as separate news items. They are not, really. One reflects growing confidence in Bitcoin as an asset held through traditional financial rails. The other is a sharp reminder that self-custody — while powerful — carries real technical risk when hardware is compromised. Both truths can be true at once.
For anyone considering how they hold Bitcoin, whether through an ETF, a hardware wallet, or a custodial service, today's news is worth sitting with. Security decisions deserve the same care as financial ones.
At BitcoinForCharity.org, donations move directly on-chain to vetted organizations — which means the security of every transaction matters just as much as the generosity behind it.