The Coldcard hack is testing crypto investigators’ ability to measure losses from self-custody wallets, where victim reports are critical to establishing the scale of the theft.
Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin, while other analysts have traced substantially more funds to the attack.
Galaxy Research and blockchain intelligence company TRM Labs both say their analysis points to a higher toll, while distinguishing between losses directly confirmed by victims and funds attributed to the attack through on-chain patterns.
That makes self-custody attacks difficult to quantify: Unlike an exchange hack, there is no complete list of affected accounts, leaving investigators to build estimates rather than pin down a definitive toll.
Galaxy traces losses beyond victim reports
Galaxy’s Alex Thorn told Cointelegraph the platform’s earlier estimate of as much as 1,816 BTC was a potential figure rather than a confirmed loss total.
As of Tuesday, Galaxy put its high-confidence minimum at 1,730 Bitcoin, with Thorn saying the figure could still increase as more victim reports corroborate attack patterns.
Source: Galaxy Research
“We have directly confirmed 450+ BTC directly from victim reports, but their reports have helped identify other, as-yet-unknown victims in more than 730 total BTC,” Thorn said. Galaxy uses those reports to corroborate broader attack patterns, while withholding funds it suspects but cannot yet sufficiently verify. “We are still withholding many more BTC we suspect but for which we lack sufficient corroboration,” Thorn said.
Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers
TRM Labs said its independent tracing lands in the same range as Galaxy, while its recent analysis estimated that attackers drained about 1,816 BTC from more than 5,200 addresses across four waves. “Investigators should expect the estimate to keep moving upward before it stabilizes,” TRM’s global head of policy Ari Redbord told Cointelegraph.
CryptoQuant takes a stricter approach
CryptoQuant’s head of research, Julio Moreno, told Cointelegraph that the company starts with public reports from victims, including wallet addresses or transaction IDs, and then checks those reports against known on-chain patterns from the attack.
That approach puts CryptoQuant’s confirmed tally at 1,432 BTC, which Moreno described as a floor that could rise if more victims publicly disclose their hacked addresses.
Source: CryptoQuant
Moreno said CryptoQuant is cautious about identifying victims solely from on-chain patterns because doing so could produce false positives and inflate the estimate.
“Because the stolen Bitcoin belonged to individuals and not to a centralized entity, like an exchange, we can only confirm what each victim publicly discloses,” he said.
Hard number to pin down
Moreno emphasized the total will remain an estimate because investigators can only confirm what victims disclose. He said:
“Knowing the total BTC stolen is difficult, and it will always be an estimation.”
Chainalysis told Cointelegraph it has not conducted an independent tally of the losses, while blockchain investigator ZachXBT publicly said he has no plans to monitor or trace the incident.
Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?
