Block's investigation traced the first 1,082.65 BTC Coldcard drain to a paid account at a blockchain-data provider after internal logs matched the attacker's query number, timing and sequence with extraordinary specificity, and the information was shared with authorities. Galaxy Research said confirmed losses reached at least 1,778.84 BTC, worth about $112.7 million at then-prevailing prices, across more than 8,600 addresses based on reports from 190 victims. Separately, on-chain investigator Specter disputed a reported 73 BTC claim worth $4.6 million, saying the funds had previously passed through Whirlpool, moved partly to Ethereum and then entered a phishing Tornado Cash interface. The purported victim's activity in Telegram groups focused on private-key searches and brute-force attacks led Specter to suggest the person could have been a threat actor whose funds were later stolen by another.