Overview
(September 24, 2026, Washington, DC) – The Crypto Recovery Trust, a Wyoming statutory trust advised by attorneys in Steptoe LLP's national security practice, has returned more than 20 BTC to its rightful owner, whose bitcoin had been left insecure by the Coldcard exploit. The Trust announced the return on September 23. It verified the owner's claim before returning the bitcoin, at no cost to the owner. Steptoe serves as counsel to the Trust.
To date, white hat cybersecurity professionals have deposited approximately 50 BTC from the Coldcard exploit with the Trust. The Trust holds virtual currency secured from compromised or vulnerable wallets, verifies ownership claims, and returns the assets to their owners without charging a fee or accepting a reward. It continues to work to identify the owners of the remaining bitcoin in its custody.
The Coldcard exploit stems from a firmware flaw dating to March 2021. The flaw weakened the randomness of wallet seeds generated on affected devices, which allowed keys to be reconstructed without physical access to the device. Sweeps of affected addresses began on July 30, 2026. Galaxy Research, which has tracked the incident, puts confirmed losses at approximately 1,789 BTC across more than 8,800 addresses. Galaxy also reported that, as of early September, roughly 82% of the bitcoin taken had not moved from the addresses to which it was originally swept.
Owners who believe their bitcoin may be held by the Trust can begin a claim at the Trust’s website https://www.cryptorecoverytrust.com. Neither the Trust nor Steptoe will ever ask an owner for a fee, a reward, a seed phrase, or a private key, and any such request made in either the Trust or Steptoe's name should be treated as fraudulent. Owners who still hold funds on a seed generated with affected Coldcard firmware should follow Coinkite's published migration guidance, because installing corrected firmware does not repair an existing seed.
About Steptoe
In more than 110 years of practice, Steptoe has earned an international reputation for vigorous representation of clients and innovative thinking before governmental agencies, successful advocacy in litigation and arbitration, and creative and practical advice in structuring business transactions. Steptoe has more than 500 lawyers and other professional staff across offices in Beijing, Brussels, Chicago, Hong Kong, Houston, London, Los Angeles, New York, San Francisco, and Washington, DC. For more information, visit www.steptoe.com.
