Analytics firms and crypto investigators are working to determine the total losses from the recent Coldcard wallet exploit, but the numbers remain uncertain as victim self-reporting plays a critical role in establishing the true scale of the theft.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLInvestigations reveal varying loss estimates
Blockchain analytics provider CryptoQuant listed confirmed losses at 1,432 Bitcoin as of this week. This figure is based on publicly reported victim addresses and cross-verified on-chain activity associated with the attack.
However, Galaxy Research and TRM Labs have reported higher estimates. Both organizations differentiated between direct confirmations from victims and funds identified using transaction patterns that match the exploit. TRM Labs, a blockchain intelligence company specializing in tracing illicit crypto flows, placed the likely losses close to 1,816 BTC, noting the funds originated from over 5,200 individual wallet addresses across multiple coordinated attack waves.
Alex Thorn, head of research at Galaxy, explained that the group’s high-confidence minimum currently stands at 1,730 Bitcoin, though the total could rise further if more victims come forward. He clarified that Galaxy had directly confirmed over 450 BTC from explicit victim disclosures, while on-chain analysis and victim reporting helped attribute more than 730 BTC to unidentified victims.
Thorn emphasized that Galaxy is cautious in classifying other affected funds, withholding amounts suspected but not yet thoroughly corroborated.
We have directly confirmed over 450 BTC through victim reports, which have assisted in identifying other, as-yet-unconfirmed victims linked to more than 730 BTC. Many more BTC are being withheld while we seek additional verification.
TRM Labs’ global head of policy, Ari Redbord, stated that their findings are broadly in line with Galaxy’s, although the investigations are ongoing. Redbord warned that estimates are likely to increase before a stable figure is reached, given the evolving nature of reports and on-chain findings.
Mini dictionary: TRM Labs is a blockchain analytics company that works closely with law enforcement and financial institutions to investigate digital asset crime, trace on-chain transactions, and provide insights into illicit cryptocurrency flows.
| Analytics Provider | BTC Loss Estimate | Methodology |
|---|---|---|
| CryptoQuant | 1,432 BTC | Confirmed via public victim reports and on-chain activity |
| Galaxy Research | 1,730 BTC (high-confidence minimum) | Direct confirmations plus correlated on-chain patterns |
| TRM Labs | 1,816 BTC | Patterns and address analysis across four attack waves |
Self-custody challenges complicate detection
The decentralized nature of self-custody wallets has made loss determination particularly challenging for investigators. With no central list of affected users, each individual victim must come forward and verify their loss, resulting in varying estimates and numerous unconfirmed cases.
Julio Moreno, who heads research at CryptoQuant, said the firm’s process depends on victims who publicly share wallet addresses or transaction evidence, which investigators then match to known attack patterns on the blockchain. Moreno described the 1,432 BTC tally as a conservative floor, predicting that any broader disclosures could push the figure up further. He said the company avoids identifying victims solely on transaction analysis to prevent overstated totals due to potential false positives.
Because the stolen Bitcoin belonged to individuals and not a central entity like an exchange, confirmation depends on what each victim publicly discloses.
Moreno added that the overall damage will likely remain an estimate, as assessments hinge on the level of transparency from those affected.
Other analysts’ positions and broader implications
Chainalysis, another leading blockchain analysis firm, indicated it has not produced an independent total for the Coldcard breach, while renowned crypto investigator ZachXBT stated he does not plan to monitor or trace funds related to this incident.
As the investigation continues, questions about the security of self-custody hardware wallets have increased within the community, though there is no consensus regarding broader risks to similar devices.
