Coldcard hack loss estimates range from 1,432 BTC floor to about 1,816 BTC

Why the total is difficult to measure

The dispute is not necessarily about whether losses occurred, but about what can be counted with confidence. In an exchange hack, investigators can often start from a known pool of affected accounts. In this case, the theft hit individual self-custody wallets, so researchers must assemble the picture from victim disclosures and on-chain behavior.

That makes the final tally inherently uncertain. Analysts can identify patterns that appear linked to the attack, but they differ on how much should be included before victims themselves confirm the affected addresses or transactions.

Galaxy and TRM trace a higher amount

Galaxy Research’s Alex Thorn said the firm’s earlier figure of up to 1,816 BTC should be understood as a potential total rather than a fully confirmed loss number. As of Tuesday, Galaxy said its high-confidence minimum stood at 1,730 BTC and could rise if additional victim reports validate the broader attack pattern.

According to Thorn, Galaxy has directly confirmed more than 450 BTC from victim reports. Those reports, he said, have also helped identify more than 730 BTC involving other victims not yet directly known. At the same time, Galaxy says it is still excluding additional Bitcoin it suspects may be tied to the hack because it does not yet have enough corroboration.

TRM Labs said its own independent tracing falls in the same general range. In recent analysis, the firm estimated that attackers drained about 1,816 BTC from more than 5,200 addresses across four waves. TRM’s Ari Redbord said investigators should expect the estimate to continue moving upward before it settles.

CryptoQuant keeps to a confirmed floor

CryptoQuant is using a narrower methodology. Head of research Julio Moreno said the company begins with public victim reports that include wallet addresses or transaction IDs, then checks those claims against known on-chain patterns associated with the hack.

Using that standard, CryptoQuant has confirmed 1,432 BTC in losses. Moreno described that figure as a floor, not a final count, and said it may increase if more victims publicly identify their compromised wallets.

Moreno said the firm is wary of labeling additional victims based only on pattern matching, arguing that doing so risks false positives and could overstate the scale of the theft. Because the stolen Bitcoin belonged to individuals rather than a centralized entity, he said the total can only be firmly confirmed when victims disclose their own losses.

What is confirmed so far

All of the investigators cited agree on one point: no definitive total is available yet. The current range reflects different confidence thresholds, not a settled consensus on the exact amount stolen.

Moreno said the overall number will remain an estimate because disclosure from victims is incomplete. Chainalysis told Cointelegraph it has not produced an independent tally, while blockchain investigator ZachXBT has publicly said he does not plan to monitor or trace the case.

For now, the next confirmed step is the same across the competing estimates: more victim reports and further corroboration on-chain will determine whether the current floor rises and whether the higher-end estimates can be more fully validated.