The Coldcard hack is testing crypto investigators’ ability to measure losses from self-custody wallets, where victim reports are critical to establishing the scale of the theft.
Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin, while other analysts have traced substantially more funds to the attack.
Galaxy Research and blockchain intelligence company TRM Labs both say their analysis points to a higher toll, while distinguishing between losses directly confirmed by victims and funds attributed to the attack through on-chain patterns.
That makes self-custody attacks difficult to quantify: Unlike an exchange hack, there is no complete list of affected accounts, leaving investigators to build estimates rather than pin down a definitive toll.
Galaxy traces losses beyond victim reports
Galaxy’s Alex Thorn told Cointelegraph the platform’s earlier estimate of as much as 1,816 BTC was a potential figure rather than a confirmed loss total.
As of Tuesday, Galaxy put its high-confidence minimum at 1,730 Bitcoin, with Thorn saying the figure could still increase as more victim reports corroborate attack patterns.
Source: Galaxy Research
“We have directly confirmed 450+ BTC directly from victim reports, but their reports have helped identify other, as-yet-unknown victims in more than 730 total BTC,” Thorn said. Galaxy uses those reports to corroborate broader attack patterns, while withholding funds it suspects but cannot yet sufficiently verify. “We are still withholding many more BTC we suspect but for which we lack sufficient corroboration,” Thorn said.
Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers
TRM Labs said its independent tracing lands in the same range as Galaxy, while its recent analysis estimated that attackers drained about 1,816 BTC from more than 5,200 addresses across four waves. “Investigators should expect the estimate to keep moving upward before it stabilizes,” TRM’s global head of policy Ari Redbord told Cointelegraph.
