Bitcoin ETF inflows surge after Coldcard hack, but link is unclear: Bloomberg analyst

Demand for US spot Bitcoin exchange-traded funds (ETFs) has accelerated over the past week, with a string of daily inflows coinciding with the Coldcard wallet hack — timing that has prompted speculation about whether some investors are reconsidering self-custody.

According to Bloomberg senior ETF analyst Eric Balchunas, BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), $ARK 21Shares Bitcoin ETF (ARKB) as well as Defiance Daily Target 2X Long MSTR ETF (MSBT) have recorded inflows every trading day since the weekend exploit, totaling roughly $620 million. The cumulative figure is consistent with Cointelegraph’s recent reporting on the ETF inflow streak.

The Coldcard exploit drained more than $116 million worth of Bitcoin from over 5,200 wallet addresses, according to blockchain intelligence firm TRM Labs.

“I’m not saying it’s connected, we just don’t know,” Balchunas said in a post on X. “[Although] long-term I can’t imagine there aren’t some who migrate over.”

Source: Eric Balchunas

Coldcard exploit renews debate over self-custody risks

The Coldcard hack renewed concerns that even hardware wallet users can be exposed to firmware flaws and software vulnerabilities, highlighting the operational risks that come with self-custody.

The incident also reignited debate over the trade-offs between holding Bitcoin directly and gaining exposure through regulated investment products such as spot Bitcoin ETFs, where asset custody and security are handled by institutional providers.

Binance co-founder Changpeng “CZ” Zhao also weighed in on the debate, arguing that storing crypto on centralized exchanges may now be “statistically safer” than self-custody, citing data from analyst Willy Woo that cumulative Bitcoin losses from self-custody incidents have surpassed those from exchange hacks.

Source: Changpeng Zhao

“Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported,” CZ said.

The debate comes as AI-assisted cyberattacks are becoming increasingly sophisticated. On Monday, Bitcoin swap service Boltz suspended its non-custodial bridge, citing a steady rise in AI-assisted exploits that were allowing attackers to identify and exploit vulnerabilities faster than its team could patch them.