Coldcard Hack Losses Diverge as Investigators Debate Victim Confirmation

The ongoing investigation into the Coldcard hack has highlighted the challenges of estimating losses from self-custody wallets, where there is no centralized registry of affected users.

CryptoQuant currently estimates confirmed losses at 1,432 BTC, while Galaxy Research and TRM Labs argue that the broader toll is higher when tracing suggests additional victims across multiple waves.

The discrepancy highlights why hardware-wallet exploits can be hard to quantify, and why investors and security watchers should treat any single number as provisional.

Galaxy's approach, explained by Alex Thorn, treats early totals as tentative until victim disclosures can corroborate suspected victims and linked on-chain activity.

TRM Labs estimated that attackers drained roughly 1,816 BTC across over 5,200 addresses in four waves, with the figure expected to keep rising before stabilizing.