Postare

If the BTC stolen from Coldcard users is actually recovered, returning it to the rightful victims would be complicated. The concern is that after the low-entropy seed vulnerability was discovered, attackers may still be able to figure out some of the old wallet seeds and control addresses connected to those wallets. So simply sending the recovered BTC back to the original addresses isn't a reliable way to prove who owns the funds. An attacker who has the old seed could potentially sign transactions from the same addresses too. The proposed solution is: Old addresses: Use them only to determine how much each victim lost. Ownership verification: Confirm victims using evidence from before the incident, such as withdrawal records, police reports, or platform records. Refunds: Send compensation only to new wallet addresses generated from fresh, high-entropy seeds. Use additional verification, a waiting period, and small test transactions before sending the full amount. Bottom line: The original BTC amounts can be returned, but the original compromised addresses should not be used for refunds.