White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'

Published 22 Sep 2026, 19:40 UTC. Updated 23 Sep 2026, 13:48 UTC.

Galaxy Research says white-hat actors consolidated coins tied to the exploit into a fresh address tagged for a "Crypto Recovery Trust," though the funds represent just 2.8% of the total haul.

Directly affected

CRCW Crypto
Named in this report.

Indirectly affected

IBIT iShares Bitcoin Trust
This price moves with the crypto market
COIN Coinbase
The crypto exchange moves with trading volumes
MSTR Strategy
This company's value is tied to its bitcoin holdings
MARA MARA Holdings
Bitcoin miners move with the bitcoin price
RIOT Riot Platforms
Bitcoin miners move with the bitcoin price
HOOD Robinhood
Retail trading apps move with crypto volumes
GBTC GRAYSCALE BITCOIN TRUST ETF
GA selected GBTC as a RELATED security because its canonical security name directly matches this event's themes: bitcoin, trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article.
AMDW ROUNDHILL ETF TRUST
GA selected AMDW as a RELATED security because its canonical security name directly matches this event's themes: trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article.
AVL DIREXION SHARES ETF TRUST
GA selected AVL as a RELATED security because its canonical security name directly matches this event's themes: trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article.
BITB BITWISE BITCOIN ETF TR
GA selected BITB as a RELATED security because its canonical security name directly matches this event's themes: bitcoin. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article.

Price reaction, T-5 to T+3

Ticker	T-5	T-3	T-1	T0	T+1	T+2	T+3
CRCW	—	—	—	—	—	—	—
IBIT	—	—	—	—	—	—	—
COIN	—	—	—	—	—	—	—
MSTR	—	—	—	—	—	—	—
MARA	—	—	—	—	—	—	—
RIOT	—	—	—	—	—	—	—
HOOD	—	—	—	—	—	—	—
GBTC	—	—	—	—	—	—	—
AMDW	—	—	—	—	—	—	—
AVL	—	—	—	—	—	—	—
BITB	—	—	—	—	—	—	—

Galaxy Research says white-hat actors consolidated coins tied to the exploit into a fresh address tagged for a "Crypto Recovery Trust," though the funds represent just 2.8% of the total haul.

Source: Decrypt

The price since 22 Sep 2026: Grayscale Bitcoin Trust ETF (GBTC) versus the S&P 500

Since the first closing price after “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Grayscale Bitcoin Trust ETF (GBTC) is -3.41%. The S&P 500 fund (SPY) is -0.17% over the same days, a -3.24% difference versus the market.

GBTC

SPY

Who gains and who loses around Grayscale Bitcoin Trust ETF (GBTC)

Companies carried with this story

GBTC Grayscale Bitcoin Trust ETF
For “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Grayscale Bitcoin Trust ETF (GBTC) is linked, with no stored direction, medium confidence. Reason on file: GA selected GBTC as a RELATED security because its canonical security name directly matches this event's themes: bitcoin, trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article
IBIT iShares Bitcoin Trust ETF
iShares Bitcoin Trust ETF (IBIT) is linked, with no stored direction, medium confidence in the 22 Sep 2026 story “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'.” Reason on file: GA selected IBIT as a RELATED security because its canonical security name directly matches this event's themes: bitcoin, trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article
AMDW Roundhill Etf Trust
In “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Roundhill Etf Trust (AMDW) is linked, with no stored direction, medium confidence. Reason on file: GA selected AMDW as a RELATED security because its canonical security name directly matches this event's themes: trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article
AVL Direxion Shares Etf Trust
In “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Direxion Shares Etf Trust (AVL) is linked, with no stored direction, medium confidence. Reason on file: GA selected AVL as a RELATED security because its canonical security name directly matches this event's themes: trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article
BITB Bitwise Bitcoin ETF
In “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Bitwise Bitcoin ETF (BITB) is linked, with no stored direction, medium confidence. Reason on file: GA selected BITB as a RELATED security because its canonical security name directly matches this event's themes: bitcoin. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article
BITU Proshares Ultra Bitcoin Etf
For “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust',” Proshares Ultra Bitcoin Etf (BITU) is linked, with no stored direction, medium confidence. Reason on file: GA selected BITU as a RELATED security because its canonical security name directly matches this event's themes: bitcoin. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article

Grayscale Bitcoin Trust ETF (GBTC)

On 22 Sep 2026, “White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'” is the story that connects Grayscale Bitcoin Trust ETF (GBTC) to this story.

What ties Grayscale Bitcoin Trust ETF (GBTC) to the headline is this: GA selected GBTC as a RELATED security because its canonical security name directly matches this event's themes: bitcoin, trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article

iShares Bitcoin Trust ETF (IBIT) is here too. Its reason reads: GA selected IBIT as a RELATED security because its canonical security name directly matches this event's themes: bitcoin, trust. This is an explainable DERIVED market relationship, not a claim that the security was named in the source article

Price levels for Grayscale Bitcoin Trust ETF (GBTC)

AMDW traded between 82.73 and 109.35 across 20 sessions. The latest close on file is 84.45. GBTC traded between 61.55 and 67.38 across 20 sessions. The latest close on file is 63.11. IBIT traded between 45.12 and 49.39 across 20 sessions. The latest close on file is 46.29.

A simple score for Grayscale Bitcoin Trust ETF (GBTC)

46 out of 100

“White-Hat Hackers Route Coldcard Exploit Bitcoin Into 'Recovery Trust'” scores 46 out of 100. The score uses 1 sources, and 6 linked companies.