The Coldcard hack has no definitive loss figure yet as investigators rely on victim reports and onchain analysis that produce varying estimates.
The Coldcard hack is testing crypto investigators’ ability to measure losses from self-custody wallets, where victim reports are critical to establishing the scale of the theft.
Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin, while other analysts have traced substantially more funds to the attack.
Galaxy Research and blockchain intelligence company TRM Labs both say their analysis points to a higher toll, while distinguishing between losses directly confirmed by victims and funds attributed to the attack through onchain patterns.
That makes self-custody attacks difficult to quantify: Unlike an exchange hack, there is no complete list of affected accounts, leaving investigators to build estimates rather than pin down a definitive toll.
Galaxy’s Alex Thorn told Cointelegraph the platform’s earlier estimate of as much as 1,816 BTC was a potential figure rather than a confirmed loss total.
As of Tuesday, Galaxy put its high-confidence minimum at 1,730 Bitcoin, with Thorn saying the figure could still increase as more victim reports corroborate attack patterns.
“We have directly confirmed 450+ BTC directly from victim reports, but their reports have helped identify other, as-yet-unknown victims in more than 730 total BTC,” Thorn said. Galaxy uses those reports to corroborate broader attack patterns, while withholding funds it suspects but cannot yet sufficiently verify. “We are still withholding many more BTC we suspect but for which we lack sufficient corroboration,” Thorn said.
Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers
TRM Labs said its independent tracing lands in the same range as Galaxy, while its recent analysis estimated that attackers drained about 1,816 BTC from more than 5,200 addresses across four waves. “Investigators should expect the estimate to keep moving upward before it stabilizes,” TRM’s global head of policy Ari Redbord told Cointelegraph.
CryptoQuant’s head of research, Julio Moreno, told Cointelegraph that the company starts with public reports from victims, including wallet addresses or transaction IDs, and then checks those reports against known onchain patterns from the attack.
That approach puts CryptoQuant’s confirmed tally at 1,432 BTC, which Moreno described as a floor that could rise if more victims publicly disclose their hacked addresses.
Source
This article is syndicated for educational reading. For the latest updates, visit the original publisher.
Read on cointelegraph.com
