Demand for US spot Bitcoin exchange-traded funds (ETFs) has accelerated over the past week, with a string of daily inflows coinciding with the Coldcard wallet hack — timing that has prompted speculation about whether some investors are reconsidering self-custody.
According to Bloomberg senior ETF analyst Eric Balchunas, BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), ARK 21Shares Bitcoin ETF (ARKB) as well as Defiance Daily Target 2X Long MSTR ETF (MSBT) have recorded inflows every trading day since the weekend exploit, totaling roughly $620 million. The cumulative figure is consistent with Cointelegraph’s recent reporting on the ETF inflow streak.
The Coldcard exploit drained more than $116 million worth of Bitcoin from over 5,200 wallet addresses, according to blockchain intelligence firm TRM Labs.
“I’m not saying it’s connected, we just don’t know,” Balchunas said in a post on X. “[Although] long-term I can’t imagine there aren’t some who migrate over.”
Source: Eric Balchunas
Related: Bitcoin Red Team reports 5K findings in sweeping security audit
Coldcard exploit renews debate over self-custody risks
The Coldcard hack renewed concerns that even hardware wallet users can be exposed to firmware flaws and software vulnerabilities, highlighting the operational risks that come with self-custody.
The incident also reignited debate over the trade-offs between holding Bitcoin directly and gaining exposure through regulated investment products such as spot Bitcoin ETFs, where asset custody and security are handled by institutional providers.
Binance co-founder Changpeng “CZ” Zhao also weighed in on the debate, arguing that storing crypto on centralized exchanges may now be “statistically safer” than self-custody, citing data from analyst Willy Woo that cumulative Bitcoin losses from self-custody incidents have surpassed those from exchange hacks.
Source: Changpeng Zhao
“Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported,” CZ said.
The debate comes as AI-assisted cyberattacks are becoming increasingly sophisticated. On Monday, Bitcoin swap service Boltz suspended its non-custodial bridge, citing a steady rise in AI-assisted exploits that were allowing attackers to identify and exploit vulnerabilities faster than its team could patch them.
Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?