How Investigators Track Coldcard Hack Losses and Stolen Bitcoin
Crypto investigators are grappling with one of the toughest loss-allocation problems in digital asset security: estimating theft from self-custody wallets, where there is no authoritative registry of affected. . .
Crypto investigators are grappling with one of the toughest loss-allocation problems in digital asset security: estimating theft from self-custody wallets, where there is no authoritative registry of affected users. The ongoing analysis of the Coldcard-related hack is now producing markedly different figures depending on how teams treat “confirmed” victim reports versus on-chain attributions. Blockchain analytics platformCryptoQuantcurrently putsconfirmed losses at 1,432Bitcoin, whileGalaxy ResearchandTRM Labsargue the broader toll is higher when tracing suggests additional victims across multiple waves. The discrepancy highlights why hardware-wallet exploits can be hard to quantify—and why investors and security watchers should treat any single number as provisional. Key takeawaysCryptoQuantreports1,432BTCas a confirmed floor, relying on victim-provided evidence before labeling funds stolen. Galaxy Researchsays it has high-confidence minimum losses of1,730BTC, using victim reports to validate wider attack patterns. TRM Labsestimates attackers drained roughly1,816 BTCacross5,200+ addressesin four waves, with the figure expected to keep rising before stabilizing. All parties underscore that there isno complete list of affected self-custody accounts, so totals can only be inferred—not definitively counted. Why Coldcard thefts are difficult to totalSelf-custody incidents differ sharply from exchange hacks, where investigators can often begin with a centralized list of compromised accounts or balances. In the Coldcard case, analytics teams instead have to assemble estimates from scattered disclosures—wallet addresses and transaction identifiers shared by victims—then map those to on-chain behavior consistent with the attack. That structure creates two competing measurement philosophies. One is conservative: count only losses that victims directly confirm, to avoid “false positives” from pattern matching. The other is investigative: use confirmed losses to identify additional wallet clusters and transactions that likely belong to other victims, even when those victims have not yet come forward publicly. The result is a widening gap between “confirmed” and “attributed” totals—exactly the gap that matters for incident reporting, accountability, and the credibility of downstream security narratives. Galaxy narrows a moving minimum—backed by victim corroborationGalaxy’s approach, as explained toCointelegraphbyAlex Thorn, treats early totals as tentative until victim disclosures can corroborate suspected victims and linked on-chain activity. Thorn previously described Galaxy’s earlier estimate—up to1,816 BTC—as a potential figure rather than a finalized tally. By Tuesday, Galaxy reported ahigh-confidence minimum of 1,730 BTC. Thorn also indicated that the minimum could still increase as more victim reports align with the attack’s observed patterns. In Thorn’s description, the key distinction is between (1) losses directly supported by victim-reported information and (2) additional losses identified through the broader pattern those reports help validate. Galaxy said it hasdirectly confirmed 450+ BTCfrom victim reports, while those reports have helped uncover other victims in a wider set totalingmore than 730 BTC. At the same time, Galaxy said it is still holding back BTC it suspects but cannot yet verify with sufficient corroboration. For readers, this methodology matters because it suggests a “floor that can rise” dynamic: as the public dataset of victim evidence grows, the subset that analysts can confidently label as theft expands, improving the stability of the totals. TRM Labs: broader tracing across multiple wavesTRM LabstoldCointelegraphthat its independent tracing lands in the same general range as Galaxy. In its more detailed analysis, TRM said its work estimated that attackers drained about1,816 BTCfrommore than 5,200 addressesacrossfour waves. TRM’sAri Redbord, global head of policy, cautioned that investigators should expect estimates tokeep moving upwardbefore settling. That framing aligns with the reality that self-custody victims may take time to discover compromise, identify relevant addresses, and disclose the information needed for analysts to match on-chain traces. TRM’s results also underline why the same incident can generate different “totals” depending on whether analysts use strict victim confirmations or extend attribution to clusters and transactions that look consistent with the exploit. CryptoQuant uses victim evidence to avoid inflated claimsCryptoQuant takes a more restrictive stance. According to Cointelegraph, CryptoQuant’sJulio Morenosaid the company begins withpublic reports from victims—including wallet addresses or transaction IDs—then checks those disclosures against known on-chain patterns associated with the Coldcard attack. With that workflow, CryptoQuant’s current confirmed tally is1,432 BTC, which Moreno described as afloorthat may increase if additional victims publicly reveal the hacked addresses. Moreno emphasized that CryptoQuant avoids treating on-chain pattern matching alone as a basis for identifying victims, because doing so could produce false positives and inflate the estimate. In his explanation, the fundamental issue is that the stolenBitcoinbelongs toindividualsrather than a single centralized entity (like an exchange) that can provide consolidated incident data. As a result, analysts can only confirm what victims disclose. “Knowing the total BTC stolen is difficult, and it will always be an estimation. ”CryptoQuant’s stance is a reminder that, in self-custody incidents, analytical precision is constrained by data availability. The most cautious number may not reflect the full damage—but it can be the most defensible as “confirmed” while the case is still unfolding. What others are (and aren’t) tallyingCointelegraph also reported thatChainalysishas not conducted an independent loss tally. Separately, blockchain investigatorZachXBTpublicly stated he has no plans to monitor or trace the incident. While the absence of a consensus total could frustrate observers seeking a single figure, it also signals that the ecosystem is converging on a shared understanding: without complete victim registries, analysts must balance completeness against verification. For now, the main thing to watch is whether the announced figures stabilize as more victims submit corroborating wallet data. If disclosures accelerate, the “confirmed” floor should rise and estimates may converge—otherwise the spread between conservative and attributed totals may remain a persistent feature of how self-custody hacks are measured. Risk & affiliate notice:Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure