White-hat actors have initiated the recovery of Bitcoin linked to the extensive Coldcard hardware wallet exploit, moving millions in stolen funds toward a return process. The movement marks a significant development after months of inactivity in addresses connected to one of the largest self-custody security failures in recent years.