The Coldcard hack has shown how difficult it is to assess the damage to owners of non-custodial wallets: the scale of the theft is largely determined by reports from victims.
The blockchain analytics platform CryptoQuant currently estimates confirmed losses at 1,432 $BTC, while other analysts have tracked significantly more funds linked to the attack.
Galaxy Research and blockchain analytics firm TRM Labs believe the damage is higher. They distinguish between losses directly confirmed by victims and funds attributed to the attack based on on-chain patterns.
This complicates the assessment of attacks on non-custodial wallets: unlike a centralized exchange hack, there is no complete list of affected addresses. Researchers have to build estimates, not determine a final damage figure.
Galaxy Tracks Losses Beyond Victim Reports
Alex Thorn from Galaxy told Cointelegraph that the platform's previous estimate—up to 1,816 $BTC—was a preliminary, not a confirmed total loss figure.
As of Tuesday, Galaxy assessed with high confidence a minimum damage of 1,730 $BTC. According to Thorn, the amount could rise if new victim reports confirm the attack patterns.
Source: Galaxy Research
"We have directly confirmed over 450 $BTC based on victim reports; however, these reports helped identify other, previously unknown victims with losses exceeding 730 $BTC," Thorn said. Galaxy uses these reports to confirm broader attack patterns but does not count funds it suspects are linked but cannot reliably verify yet. "We are still not counting many $BTC that are suspicious but lack sufficient confirmation," Thorn added.
Related: Coldcard Hackers Moved 64 $BTC and 200 ETH to Crypto Mixers
TRM Labs stated that its independent estimate is in the same range as Galaxy's, and recent analysis showed that the attackers stole about 1,816 $BTC from over 5,200 addresses across four attack waves. "Researchers should expect the estimate to rise before stabilizing," Ari Redbord, TRM's Global Head of Policy, told Cointelegraph.
CryptoQuant Applies a Stricter Approach
CryptoQuant Head of Research Julio Moreno told Cointelegraph that the company starts with public victim reports, including wallet addresses and transaction IDs, then cross-references them with known on-chain attack patterns.
This approach gives CryptoQuant a confirmed estimate of 1,432 $BTC. Moreno called it a lower bound that could rise if more victims publicly reveal their compromised addresses.
Source: CryptoQuant
Moreno stated that CryptoQuant is cautious about identifying victims based solely on on-chain patterns, as it could lead to false positives and inflate the estimate.
"Since the stolen bitcoins belonged to individuals and not a centralized organization like an exchange, we can only confirm what each victim discloses publicly," he said.
Difficult to Pinpoint an Exact Figure
Moreno emphasized that the total amount will remain an estimate, as researchers can only confirm information disclosed by victims. He explained:
"It is difficult to establish the total number of stolen $BTC, and it will always be an estimate."
Chainalysis told Cointelegraph that it had not conducted an independent loss assessment, while blockchain researcher ZachXBT publicly stated he does not plan to track or investigate this incident.
Magazine: Do Coldcard Attacks Mean All Hardware Wallets Are Now Insecure?
end-content
