Post-Hack Appreciation and the Valuation Date

concept

Core idea

A stolen crypto amount has at least three different dollar values: at the time of the theft, at the time of seizure, and today. They can differ by orders of magnitude, and none of them is more “correct” than the others. Which one appears in a report is a choice, and a report that gives a figure without naming the date and the basis has not stated a fact, it has stated a number.

Components

The gap is not marginal. Across 64 hacks the Henry Jackson Society report puts the value at the time of each incident at roughly 12.8 billion USD and the present value of the same holdings at roughly 124.9 billion USD, attributing about 112 billion USD of the difference to what it calls post-hack appreciation. Across all typologies in its dataset it puts accrued gains at about 215 billion USD. Treat these as the report’s own estimates. They are aggregate modelling, not explorer-verified values, and they should be cited as one organisation’s figures rather than repeated as settled fact.
The ranking changes with the basis. In the same dataset the top five hacks were 53 percent of all hack value measured at the time of theft, but only 16 percent measured at present value. Sort by the wrong date and you get the wrong list of priority cases.
It cuts both ways. A seizure years later can recover more than was taken, which makes late enforcement worth more than it looks and can fund restitution that the original loss figure would not cover. The same appreciation also means an unrecovered theft keeps funding the offender, which is why the report frames hacks as a long-term investment for the actor rather than a one-off gain.
The gross principle. Slovenian case law cited in the OSCE handbook holds that an offender cannot deduct expenses that were themselves illegal, because those costs are inseparable from the criminal activity. Confiscation there is not only restitution to the status quo ante, it also aims to prevent the offender’s future activity, which supports arguing for the gross value of what was seized rather than a net figure.
Where the loss is fixed for the offence itself, the OSCE handbook takes the position that damage or illegal proceeds should be set at the value at the moment the perpetrator achieved the objective, which is when the units were received or the victim was prevented from using them. That is a different question from what the seized asset is worth now, and the two should not be blended in one sentence.

When to use

Whenever a figure goes into a report, a complaint, a restitution schedule, or a victim update. Also at scoping, where the choice of basis changes whether a case clears a jurisdiction’s monetary threshold.

Avoid when

Never present a single headline figure without the date, the basis, and the source of the price. And never carry an aggregate from a published report into a case file as if it were a traced value. Case-file amounts come from the explorer, tagged for verification status, exactly as any other on-chain fact.

Example

The 2019 Upbit hack, as the report records it, took 342,000 ETH worth about 49 million USD at the time, with a present value it puts near 1.58 billion USD and under 0.01 percent recovered. A charging document, a victim restitution schedule, and a press line about the same incident would each properly cite a different one of those numbers, and each has to say which.

Separate On-Chain Fact from Analytical Inference · Anchor Every Finding With a Temporal Qualifier · Describe Laundering in Phases When the Transactions Cannot Be Counted · Post-Seizure Custody and Disposal of Seized Crypto · The Forfeiture-Complaint Tracing Narrative (DOJ Civil Forfeiture Structure) · Known Weaknesses to Disclose in a Forensic Report · Crypto Cost-Basis Methods: FIFO vs HIFO vs LIFO · Enforcement Outcome Rates by Crypto Typology · Recovery Budget Tiers by Asset Value