TL;DR
- The Coldcard hack has no definitive loss figure: CryptoQuant confirms 1,432 BTC stolen, while Galaxy and TRM Labs estimate up to 1,816 BTC.
- Galaxy Research directly confirmed more than 450 BTC through victim reports, though it suspects higher amounts that cannot yet be corroborated with sufficient evidence.
- TRM Labs estimates that attackers drained around 5,200 addresses in four waves, and expects the figure to keep rising before stabilizing.
The hack of Coldcard is testing the limits of blockchain investigation methodologies for quantifying losses in attacks on self-custody wallets. Unlike what happens when a centralized exchange is breached, no complete record of affected accounts exists, which forces researchers to build estimates rather than determine a definitive figure.
The blockchain analytics platform CryptoQuant places Coldcard losses at 1,432 BTC. Its methodology is based on public reports from victims who provide wallet addresses or transaction IDs, and cross-references that information with known onchain patterns from the attack.
Julio Moreno, head of research at CryptoQuant, explained that the criterion is deliberately conservative to avoid false positives. “Since the stolen Bitcoin belonged to individuals and not to a centralized entity, such as an exchange, we can only confirm what each victim publicly discloses,” Moreno said.
Coldcard: Only Estimates Can Be Made
Galaxy Research and TRM Labs agree on a higher figure. Alex Thorn, from Galaxy, indicated that the firm’s high-confidence minimum stands at 1,730 BTC, though he warned that the number could continue to grow as new reports from victims corroborate the attack’s patterns.
Thorn specified that Galaxy directly confirmed more than 450 BTC from testimonies of those affected, but that those same reports allowed the identification of other still-unknown victims accounting for more than 730 BTC in total. The firm also retains suspicious funds it cannot yet verify with sufficient backing.
TRM Labs, for its part, estimated that the Coldcard attackers stole approximately 1,816 BTC from more than 5,200 addresses spread across four waves. Ari Redbord, global head of policy at TRM Labs, warned that researchers should expect the figure to keep increasing before it stabilizes.
Chainalysis reported that it did not conduct an independent count of the losses. Blockchain investigator ZachXBT, meanwhile, publicly stated that he has no plans to investigate the incident. The absence of a centralized victim inventory means that, as Moreno summarized, the total amount stolen in Coldcard “will always be an estimate.”
