The Coldcard hack—targeting users of the Bitcoin-only hardware wallet manufactured by Coinkite—is stretching the capabilities of cryptocurrency forensic investigators, exposing a fundamental challenge in measuring losses from self-custody wallet breaches: without a centralized registry of affected accounts, the true scale of the theft may never be definitively known.

Blockchain analytics firms are converging on different figures depending on their methodologies, with estimates ranging from confirmed losses to broader pattern-based attributions. The discrepancy matters beyond academic precision: accurate loss accounting underpins potential victim restitution efforts, shapes regulatory attention to hardware wallet security standards, and informs an insurance market that is still developing coverage products for self-custody holders.

Divergent Estimates from Leading Analytics Firms

Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin. Galaxy Research and blockchain intelligence firm TRM Labs both say their analyses point to a higher toll, though each firm carefully distinguishes between losses directly confirmed by victims and funds attributed to the attack through onchain patterns. TRM Labs has characterized the incident as the largest hardware wallet exploit of 2026, with its analysis pointing to approximately $116 million in stolen funds.

Unlike a centralized exchange hack—where a complete list of compromised accounts is typically available—self-custody attacks leave investigators to construct estimates from fragmentary victim reports rather than establish an authoritative figure. This structural limitation has long been recognized in the industry but is now being stress-tested at scale, raising questions about whether existing forensic tools, originally built to trace exchange breaches and ransomware payments, are adequately equipped for a threat landscape where individual wallet users are the primary targets.

Galaxy Traces Losses Beyond Victim Reports

Galaxy's Alex Thorn told Cointelegraph that the platform's earlier estimate of as much as 1,816 BTC was a potential figure rather than a confirmed loss total. As of Tuesday, Galaxy placed its high-confidence minimum at 1,730 Bitcoin, a number Thorn said could still rise as additional victim reports corroborate attack patterns.

Galaxy Research has directly confirmed over 450 BTC from victim reports alone, but those same reports helped identify other, as-yet-unknown victims tied to more than 730 BTC in total, Thorn explained.

"We have directly confirmed 450+ BTC directly from victim reports, but their reports have helped identify other, as-yet-unknown victims in more than 730 total BTC," Thorn said. "We are still withholding many more BTC we suspect but for which we lack sufficient corroboration."

TRM Labs said its independent tracing lands in the same range as Galaxy. The firm's recent analysis estimated that attackers drained approximately 1,816 BTC from more than 5,200 addresses across four distinct waves.

"Investigators should expect the estimate to keep moving upward before it stabilizes," TRM's global head of policy Ari Redbord told Cointelegraph.

Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers

CryptoQuant's Conservative Methodology

CryptoQuant's head of research, Julio Moreno, told Cointelegraph that the company begins with public victim reports—typically wallet addresses or transaction IDs—and then validates them against known onchain patterns associated with the attack.

This approach yields a confirmed tally of 1,432 BTC, which Moreno characterized as a floor that could increase if more victims publicly disclose their compromised addresses.

Moreno explained that CryptoQuant deliberately avoids identifying victims solely from onchain patterns, as doing so risks false positives and an inflated estimate.

"Because the stolen Bitcoin belonged to individuals and not to a centralized entity, like an exchange, we can only confirm what each victim publicly discloses," he said. "Knowing the total BTC stolen is difficult, and it will always be an estimation."

Other Investigators Step Back

Chainalysis told Cointelegraph it has not conducted an independent tally of the losses. Blockchain investigator ZachXBT publicly stated he has no plans to monitor or trace the incident.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?