https://twiiit.com/BitcoinArchive/status/2102129317345960077

https://x.com/BitcoinArchive/status/2102129317345960077

https://x.com/intangiblecoins/status/2102114798833946783?s=20

https://x.com/KLoaec/status/2102330165720154232?s=20

ThatWhichisNotSeen

52 BTC moved from the Coldcard theft — with a message attached

A new movement in the Coldcard theft has caught attention: 

52.37 BTC was consolidated into a new address described as a trust address

, according to reporting based on Galaxy Research's on-chain analysis.

, apparently presenting itself as a recovery channel for affected victims. The funds represented roughly 

The bigger picture is even more significant. Galaxy's investigation had previously identified 

1,778.84 BTC stolen from more than 8,600 addresses

, with additional possible thefts under investigation.

That makes every subsequent movement worth watching—but an 

OP_RETURN message is not proof that the sender is genuinely offering recovery

. Anyone affected should independently verify the transaction, the addresses involved, and the identity of whoever controls the supposed recovery service.

The blockchain doesn't forget. Every movement leaves a trail.

bitcoin

bitcoin_beginners

Coinjoins

### 52 BTC moved from the Coldcard theft — with a message attached

A new movement in the Coldcard theft has caught attention: **52.37 BTC was consolidated into a new address described as a trust address**, according to reporting based on Galaxy Research's on-chain analysis.

The transaction also included an **OP_RETURN message pointing to `cryptorecoverytrust.com`**, apparently presenting itself as a recovery channel for affected victims. The funds represented roughly **2.8% of the stolen Bitcoin** referenced in the report.

The bigger picture is even more significant. Galaxy's investigation had previously identified **1,778.84 BTC stolen from more than 8,600 addresses**, with additional possible thefts under investigation.

That makes every subsequent movement worth watching—but an **OP_RETURN message is not proof that the sender is genuinely offering recovery**. Anyone affected should independently verify the transaction, the addresses involved, and the identity of whoever controls the supposed recovery service.

**The blockchain doesn't forget. Every movement leaves a trail.**

Source: [Gate News — Coldcard Whitehats Transfer 52.37 BTC](https://www.gate.com/en-us/news/detail/coldcard-whitehats-transfer-5237-btc-to-trust-address-representing-28-of-17877769)