Jameson Lopp published an interactive dashboard mapping 360 physical attacks against Bitcoin holders. No time range is disclosed. No methodology note. No raw dataset. No source list.
That is the whole diagnostic. Everything that follows is downstream of those four absences.
In 2018 I spent 200 hours reading the ERC-20 logic of the Bytom ICO contracts line by line, found an integer overflow in the vesting schedule that would have let early team members drain 40% of treasury before the public sale, and filed the fix as anonymous GitHub issue #42. I declined the $5,000 bounty that came with it. The lesson was not that code breaks. The lesson was that code can be read. A vesting schedule is a ledger. The ledger does not lie, only the narrative does.
Lopp's dashboard is a narrative wearing a ledger's clothes.
Physical attacks in Bitcoin have a name: the $5 wrench attack. The economics are trivial. Coerce a holder in person, avoid the cryptography entirely. No reentrancy. No oracle manipulation. No governance exploit. A hardware wallet in a safe is defeated by a person standing in a doorway.
For a decade, the security industry ignored this layer. Chainalysis, Crystal, TRM Labs built on-chain forensics. They trace flows, score wallet risk, map sanctions exposure. None of them track a home invasion in Ohio. The gap is real and it is structural. On-chain data is public and machine-readable. Physical events are private and reported in prose.
Jameson Lopp is a credible author for this work. Casa co-founder, long-running Bitcoin infrastructure engineer, self-custody advocate, and a person who has himself been swatted and has written publicly about being a target. His credibility is the project's primary asset. That is not a compliment or a criticism. It is a balance-sheet observation.
The timing is not accidental. Every bull market produces a security narrative. In 2017 it was exchange hacks. In 2021 it was NFT rug pulls. In 2024 it was ETF custody. In 2026 the narrative that is cheap to produce and hard to falsify is physical security, because the evidence is scattered, the victims are quiet, and the number 360 sounds authoritative. A dashboard is the perfect vehicle for a claim that cannot be quickly checked.
We are in a bull market. Self-custody holdings rise with price. When BTC trades high, the dollar value of a $5 wrench attack rises with it. The attack surface scales with the asset, not with the user's sophistication.
The press framed the dashboard as evidence that the crypto industry urgently needs better physical security. That framing is a value judgment, not a finding. And it is the point where the analysis has to start.
360 is a number without a denominator and without an interval. A count of events is meaningless without a time window. If the dashboard covers 2011 through 2025, 360 is roughly 25 events per year globally โ a rounding error against the hundreds of thousands of self-custody holders. If it covers 2023 through 2025, 360 is a step change. Same number, opposite conclusions. The absence of a time range is not a formatting oversight. A count without an interval is not data. It is decoration.
The absence of a source list matters more. I have audited enough messes to know what a clean dataset looks like. A row per event. A URL per row. A date. A geography. A loss figure. A field indicating confidence. What Lopp shows is the aggregate. The confident claim is that the aggregation is incomplete, not that it is wrong. Two failure modes dominate: underreporting and selection bias.
Underreporting is severe. Most physical attacks never reach a news outlet. A victim in Lagos or Buenos Aires is not filed to a Western crypto desk. A victim who pays quietly is not filed at all. A victim who pays and reports to police in a jurisdiction with no crypto literacy is filed to a record nobody reads. 360 is a floor, not a population.
Selection bias runs alongside it. Public English-language media is the likeliest substrate for a hand-assembled dataset. That substrate overweights the United States, United Kingdom, and Canada, and it overweights events with dramatic detail โ kidnapping, torture, home invasion โ because those get headlines. A politely worded extortion that never escalates does not get written up. The dataset likely maps the spectacle, not the distribution.
Response capacity varies by jurisdiction in a way the dashboard cannot capture. A case in a jurisdiction with crypto-literate law enforcement produces a report, a charge, and a public record. A case in a jurisdiction without one produces nothing. The dataset will systematically overweight the former. That is not Lopp's fault. It is a structural property of any dataset built from published records, and it should be printed on the dashboard in bold.
I ran this exact kind of reconstruction in 2022. After Terra LUNA collapsed I rebuilt the UST de-peg from 50,000 blockchain transactions and showed the death spiral was not market panic. It was a deterministic failure in the mint/burn mechanism. Arbitrageurs extracted roughly $4 billion in under 72 hours. Nothing about that was emotional. It was a loop that could not do anything else. Panic is just poor data processing in real-time. The Terra loop was not processing anything at all.
The difference between the Terra analysis and the Lopp dashboard is verifiability. Terra gave me 50,000 rows and a block explorer. Every claim traced to a hash. The dashboard gives me a number and a map. I cannot reproduce a single one of the 360 events from first principles. There is no commit hash here.
This is where the comparison to on-chain analytics is instructive but limited. Chainalysis earns its reputation on a specific claim: every attribution traces to a public ledger entry. You can disagree with the clustering heuristic, but you cannot argue the underlying transaction does not exist. A physical-attack database has no such anchor. The anchor would be a police report, a court filing, or a first-person account. Without them, the dashboard is a set of assertions about the world that cannot be audited.
There is a second-order angle here that nobody in the coverage touched. A coerced transfer leaves a fingerprint on-chain. It is not the amount. It is the behavior. A holder who moves everything in one block, to a fresh address, with no prior interaction, at an hour inconsistent with their history, is not trading. They are being emptied. Chain analytics can flag that pattern after the fact. It cannot prevent it, and it cannot separate coercion from a routine migration without ground truth from the physical event. The physical database supplies the ground truth; the on-chain graph supplies the mechanism. Together they are a criminal intelligence tool. Separately they are a map and a ledger, and neither one closes.
Attack economics deserve their own entry. Extortion against a self-custody holder has near-zero capital cost and near-zero technical skill requirement. The return depends entirely on the victim's balance and their willingness to disclose it. That asymmetry โ trivial cost, unbounded upside โ is why the attack persists across bull and bear markets. In 2021 I watched a hundred NFT collections inflate and collapse inside 48 hours because the mint mechanics rewarded speed over substance. Physical attacks reward the same thing. The difference is that the mint had a contract you could read. The wrench does not.
In 2024 I traced 15,000 BTC of spot ETF inflow into BlackRock and Fidelity cold storage and documented how the trustless story ran on multi-signature schemes held by centralized custodians. The settlement layer still routed through traditional banking rails. The institutional product was a custody wrapper, not a cryptographic one.
The relevance is data handling. A physical attack database, done carelessly, is a target list. If the dashboard shows a city, a date, and a rough loss amount, it is a risk map. If it shows a name, a neighborhood, or a wallet address tied to an identity, it is an intelligence product for anyone with a wrench and a search bar. Lopp has spent a decade telling people not to dox themselves. It is reasonable to assume the dashboard uses city or country granularity and links to press coverage. It is equally reasonable to assume it does not. The source material does not say.
On-chain correlation makes this worse than it looks. The 2021 NFT floor scripts I ran across 1,000 collections taught me how fast a pseudonymous holder set can be de-anonymized by pattern. Minting rates, funding paths, gas behavior, and timing link wallets to each other. A physical event with a date and a city can be joined against a wallet graph to narrow a victim. The dashboard is not a passive document. It is a joinable table.
The project is a person, not an institution. Lopp's reputation carries the credibility. That is also the concentration risk. If he stops maintaining it, the data stops and the map fossilizes. A static security database is not neutral. It is actively misleading, because readers assume it is current. The 2026 NeuroPay audit I published turned on the same principle. A reentrancy bug in the oracle integration drained $2 million in a single transaction. The failure was not exotic. It was engineering negligence at a speed the novelty encouraged. Novelty is not a substitute for maintenance. Neither is reputation.
Governance-wise there is nothing to evaluate. No token, no treasury, no vote. That simplifies the model. The project is a public good with a single maintainer, or it is a future SaaS product with a single founder. Either way, the sustainability question has exactly one answer holder.
The consequential use case is not education. It is pricing. Insurers underwriting self-custody risk need loss data. A physical-attack dataset is a natural input into premiums, coverage exclusions, and risk tiers. If the dashboard becomes the reference for an emerging physical attack risk map, then its sample bias becomes a premium. Underrepresented regions get mispriced. Overrepresented regions get overpriced. Capitals price risk with whatever data exists, not with whatever data is correct.
Collateral was a mirage; solvency was a myth โ that was true of algorithmic stablecoins. The corollary for data is simpler. A dataset's authority is a function of its auditability, not of its publisher's reputation. Lopp's name will buy the dashboard adoption it may not have earned on methodology. That is how credibility risk works. It compounds quietly until someone prices against it.
The bears on this project miss something. The gap Lopp filled was real. On-chain forensics had no physical-layer counterpart. Building one, even imperfectly, beats the prior state of nothing. A floor of 360 documented events is more than the zero that preceded it, and the zero was the actual competitive benchmark.
The aggregation also has second-order value. Each event, if linked to a news source, becomes a citation. A citation can be verified by a human. That is a slower, manual form of the auditability the dashboard lacks in bulk. If the source list exists behind an interface the press did not describe, the project is significantly better than the reporting suggests. Absence of evidence in one article is not evidence of absence.
And there is a real argument that no better dataset is currently obtainable. Police reporting is fragmented across jurisdictions. Non-English coverage is not machine-aggregated. Victims frequently do not report at all, because reporting exposes them again. A perfect physical-attack census is not a solvable problem. A best-effort one is. Judging a best-effort dataset by the standard of a census is a category error, and the critics who do it are usually the people who never tried to build the census.
Structure outlives sentiment; code outlives hype. But structure also has to be built by someone. Lopp built what nobody else built, and that belongs in the record regardless of what the next audit finds.
The dashboard is the beginning of a data problem, not the end of one. What determines whether it matters is what happens next: whether the source list gets published, whether the time range gets stated, whether an insurer or a wallet vendor adopts it before it can be audited, and whether the 360 number survives contact with a second compiler. The number will be quoted thousands of times in the next quarter. The methodology will be quoted close to zero. That gap is the actual risk event, and it has not happened yet.