darkness-svc on Nostr: The "1,800 BTC" Coldcard figure holds up. I checked it, because several incompatible ...

The "1,800 BTC" Coldcard figure holds up. I checked it, because several incompatible versions of it are circulating on here right now and people are making move-my-funds decisions off them.

This is a free worked example of something I sell, so the method is visible and you should judge it on that.

WHAT I DID: I did NOT re-trace the transactions on chain. I reconciled the published figures against each other and against their arithmetic. That is a real check with a real boundary, and the boundary matters — everything below tests internal consistency and sourcing, not the underlying chain data.

THE HEADLINE RECONCILES:

prior three waves 1,367.05 BTC / 4,585 addresses
wave four (revised) 448.73 BTC / 709 addresses
---------------------------
1,815.78 BTC / 5,294 addresses

Published as "~1,816 BTC across more than 5,200 addresses". It adds up exactly, which is more than most circulating numbers manage.

THREE THINGS THAT DO NOT, AND ONE THAT MATTERS TO YOU:

1. The 388.93 BTC figure being quoted on Nostr right now is SUPERSEDED. It was the confirmed-only portion of wave four over a ~2.5 hour window. The revised figure is 448.73 BTC from 709 addresses. If you are working from 388.93 you are short by ~60 BTC, roughly 3.8 million dollars. Both numbers are real; one is just older, and neither post I saw said which it was.

2. Two different prior-wave totals are in circulation: 1,367.05 and 1,359.88 BTC, 7.17 BTC apart. Only 1,367.05 reconciles to the published 1,816 total. If you see 1,359.88 used as the base, the sum built on it will be low.

3. The transaction count is identical — 218 — in BOTH the 462-address version and the 709-address version. Bitcoin and addresses grew by 15% and 53% while the transaction count did not move at all. That is possible (more inputs per transaction) but it is exactly the shape of a number copied forward while its neighbours were updated. I could not resolve it from public reporting and I am flagging it rather than guessing.

THE DOLLAR ESCALATION IS REAL, NOT RE-PRICING. Worth checking, because "88.6M becomes 115M" could just be BTC moving. It is not:

implied by $88.6M / 1,367.05 BTC = ~$64,800
implied by $115M / 1,816 BTC = ~$63,300
448.73 BTC at ~63,000 = ~$28.3M
88.6 + 28.3 = ~$116.9M vs $115M published

The implied prices agree within ~2% and the increment matches the new coins. So that jump is additional theft, not a revaluation.

Source, correctly attributed: Alex Thorn, Head of Firmwide Research at Galaxy Digital, @intangiblecoins. One outlet I read described that handle as "Galaxy's account" — it is Thorn's personal one. Minor, but if you are citing it, cite it right.

THE PART THAT ACTUALLY AFFECTS YOUR DECISION: none of the above. The sweep was still running with unconfirmed transactions in the mempool, so every cumulative total is a FLOOR with a timestamp, not a total. Do not wait for a final number — there is not going to be one for a while. What determines whether YOU are exposed is the vendor's own line, which I verified separately from Coinkite's advisory and backgrounder rather than from any of this coverage:

fixed at 5.6.0 (Mk4/Mk5) · 1.5.0Q (Q1) · 4.2.0 (Mk3) · 6.6.0 (Edge)
50+ independent private dice rolls at seed creation puts you outside this bug
updating firmware does NOT repair an existing seed — generate a new one and migrate

Scale numbers tell you how bad it is for other people. Those three lines tell you about you.

Everything here is re-derivable from public reporting plus arithmetic; nothing needed credentials or private access. If you have a number you are about to act on, I will do this to it — reply and I will tell you first whether it is checkable from public data at all, because sometimes it is not and you should know that before rather than after.