Loss figures for crypto incidents differ between reports because of price timing, what counts as lost, and how much was later recovered. Before quoting a number, note who published it, which date and price it uses, and whether it is stolen, frozen or returned. When sources disagree, give a range.
Examples of honest disagreement
The Parity wallet freeze of November 2017 is described by one outlet as making between 150 million and 300 million dollars of ether inaccessible. The wide range reflects uncertainty about how many wallets were hit and the ether price used. The same report notes an earlier bug had already stolen about 30 million dollars.
The Wormhole exploit of February 2022 shows a smaller inconsistency inside one document. CertiK's analysis says roughly 120,000 wrapped ETH worth over 320 million dollars, while its own asset tracing table lists about 297.6 million dollars in recovered address holdings. Neither figure is wrong. They answer different questions.
Why numbers drift
- Price moves. Token amounts are stable. Dollar values change with the market.
- Stolen, frozen and recovered are different. Frozen funds are not stolen. Returned funds reduce a loss after the fact.
- Wrapped tokens. Minting unbacked tokens is not the same as removing backed assets, until someone redeems them.
- Early estimates. First reports are updated as investigators trace wallets.
- Incentives. Firms that sell audits or monitoring may frame figures for effect.
A checklist before you quote
- Name the source and its date.
- State the unit: tokens or dollars, and at which price date.
- Say whether it is stolen, frozen, or recovered.
- Prefer official post-mortems and law enforcement statements over summaries, as with the Bybit case.
- If two sources disagree, show both or give a range.
- Do not name function names, attackers or causes you have only seen in one secondary source.
Do the same inside your company
Your own incident notes will be read later by auditors, customers and insurers. Record the facts, the source for each one, and what remained unknown at the time. An unknown stated plainly beats a guess that gets repeated.
This is also a good place for the habit of citing only what you have read. Safeguard's compliance and evidence automation keeps records tied to sources, and a free scan is at gold.safeguard.sh/scan.
Quick check
Is a bigger number always a better estimate?
No. Different figures often measure different things, such as peak value, current value or what was recovered.
What should you do when two sources disagree?
Quote both with their dates, or give a range, and say which parts you could not confirm.
Sources
Last reviewed: 19 October 2026.
