What this is

Coldtrail answers two questions about stolen crypto: how much, and where. It joins a decade of recorded thefts to the wallets the US Treasury has sanctioned, then watches those wallets move in real time.

It is a research aid. It is not evidence, and it is not a compliance tool. The section on what it cannot tell you is the most important part of this page.

Where the data comes from

The country problem

The incident feed has no country field, because most of these thefts do not have an obvious one. A protocol with an anonymous team, incorporated nowhere, drained by someone unidentified, has no honest flag to fly. So rather than force one number, Coldtrail keeps three separate dimensions and never mixes them:

Victim jurisdiction

Where the entity that lost the money was based. Curated by hand. Protocols with no registered home are marked Unincorporated — a real answer, not a gap, and they are excluded from the map rather than assigned somewhere convenient.

Attacker origin

Set only where a government or a named forensics firm has published an attribution. In practice this is overwhelmingly North Korea. Everything else stays unattributed, and unattributed is the majority.

Sanctioned wallets

Treasury's own country attribution for each designated party. This is the one country dimension here that is measured rather than curated.

Every curated row carries a confidence level and a source. The footer of the dashboard reports coverage as a share of dollars, so a map with holes in it is never mistaken for a map of where crypto crime happens.

What the incident feed is not

This is the single most important thing to understand before reading the map. The incident feed is a DeFi and exchange exploit dataset — 499 of its 613 records are DeFi protocols. It is not a crypto crime dataset, and it contains none of the following:

• Ransomware — no Conti, REvil, LockBit, Colonial Pipeline.
• Darknet markets — no Hydra.
• Exchanges that became laundering services — no BTC-e, Garantex, Bitzlato.
• Ponzi and exit scams — no PlusToken, no Thodex.
• The pre-2016 era — no Mt. Gox, and not the 2016 Bitfinex theft.

That omission has a direction. Those categories are precisely where Russia, China and Iran dominate, which is why the attacker map looks like North Korea acting alone. It is not. Switch the map to Sanctioned wallets and the picture inverts: Russia holds 122 designated addresses, China 66, Iran 33, against North Korea's 25 — 47 named entities between them, including Hydra Market, Suex, Grinex, LockBit's Dmitry Khoroshev, REvil operators, and Iran's central bank.

So: two layers, two different worlds of crime, and neither one alone is the whole picture. Read them together.

Sanctioned entity markers

Every OFAC-designated party that holds crypto is drawn as a dot at its country, sized by how many addresses it holds and clustered on a golden-angle spiral so a country with two dozen of them stays readable. Hovering names the entity, its programs, its address count and whatever balance is currently readable. 90 entities across 28 countries.

This is the layer where Hydra Market, Suex, Grinex, LockBit's operators and Iran's central bank actually appear. Turn it off with the toggle above the map if it gets in the way of the choropleth.

Flow lines

An arc is drawn only where both ends are known: a victim with a real jurisdiction, and an attacker someone has publicly named. Pulses travel from victim to attacker, and thickness scales with value.

An arc needs a real place at both ends, so thefts from DAOs and anonymous teams draw no line — they have no location to leave from. They are still counted everywhere else on the page.

Most arcs terminate in North Korea. That is not an editorial position, it is what the public attribution record contains — the DPRK is the only actor that governments routinely name on the record. Read the sparseness of the other arcs as a statement about attribution, not about who steals crypto.

Arcs and markers attach to a country's geometric centre, except where that lands somewhere unhelpful. Russia's fell in central Siberia and China's in Gansu, so both are pinned to their capitals instead. Scroll to zoom, drag to pan; entity clusters spread apart as you zoom in.

Movement watching

One sanctioned address is checked every four seconds, cycling forever; a full pass takes about half an hour. Any balance change worth more than a dollar is written to the movement log. A row there means a wallet the US Treasury has designated is being used right now.

440 of the 474 listed addresses can be read. The remainder are reported with a reason rather than shown as zero: 22 sit on chains with no keyless endpoint — six of those are Monero, where the chain itself forbids it, which is rather the point of Monero. Ten are truncated inside OFAC's own CSV export, which caps its remarks column mid-address. Two are filed under an asset their address format does not match.

What it cannot tell you

• It is not a total. The incident feed records thefts that were reported and quantified. Unreported losses, individual victims and slow-drip scams are absent.
• Attribution is not proof. A country on an arc means somebody credible said so publicly. Attribution gets revised, and occasionally retracted.
• A balance is not a holding. Sanctioned addresses are often long abandoned, seized, or burned. Value sitting at an address says nothing about who controls it today.
• Movement is not laundering. The watcher sees a balance change. It does not see a counterparty, an intent, or a destination.
• Jurisdiction is not culpability. A country shaded dark for losses is where victims were based. It is a map of where money was taken from.

Built with

Node's standard library and nothing else — no npm dependencies, no build step, no analytics, no third-party scripts beyond Google Sign-In. The world map is 153 KB of GeoJSON bundled into the image, so it never calls a CDN. Sign-in is restricted to an allowlist.

← Back to the dashboard