Bitcoin ETF Inflows Rise After Coldcard Hack, Bloomberg Notes Unclear Link

Spot Bitcoin ETFs have seen a notable acceleration in demand over the past week, according to Bloomberg ETF analyst Eric Balchunas. Several major funds reported inflows on every trading day since a Coldcard wallet vulnerability exploit became public—an overlap that has sparked renewed discussion about whether some investors are reconsidering self-custody in favor of regulated products.

Balchunas’ tally attributes roughly $620 million in cumulative inflows to BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity’s Wise Origin Bitcoin Fund (FBTC), Bitwise’s Bitcoin ETF (BITB), ARK 21Shares Bitcoin ETF (ARKB), and Defiance Daily Target 2X Long MSTR ETF (MSBT). His observations echo earlier streak reporting from Cointelegraph, which covered an ETF inflow run reaching similar magnitudes.

Key takeaways

• Bloomberg’s Eric Balchunas says multiple spot Bitcoin ETFs recorded daily inflows for the entire stretch since the Coldcard exploit.
• Balchunas estimates the combined inflows at roughly $620 million across named funds.
• TRM Labs linked the Coldcard incident to theft of more than $116 million in Bitcoin from over 5,200 wallet addresses.
• The timing has intensified debate over the relative operational risks of self-custody versus ETF custody through institutional providers.
• Crypto security concerns are evolving alongside more sophisticated cyberattacks, including AI-assisted exploits highlighted by industry reporting.

ETF inflow streak lines up with Coldcard exploit fallout

The current inflow momentum centers on a simple pattern: funds that track spot Bitcoin exposure have continued bringing in net new capital day after day following the weekend Coldcard exploit. Balchunas’ post on X points to inflows at IBIT, FBTC, BITB, ARKB and MSBT every trading day since the incident, totaling about $620 million.

While the overlap is striking, Balchunas was careful to avoid claiming causation. He said on X that the connection is unknown—adding that, “long-term I can’t imagine there aren’t some who migrate over.” That framing matters: investors may already be rotating toward ETFs for accessibility and compliance reasons, but the Coldcard event appears to have sharpened attention on how custody failures can materialize even when users follow “best practice” assumptions.

For readers, the key question is whether this is a temporary spike tied to headlines—or evidence of a more durable shift toward ETF custody. The only way to judge that will be to watch whether inflows persist if attention on the exploit fades, or whether the streak breaks.

What happened in the Coldcard incident, and why it resonated

The Coldcard exploit involved a vulnerability affecting certain wallet devices, leading to significant losses. According to blockchain intelligence firm TRM Labs, the incident drained more than $116 million worth of Bitcoin from over 5,200 wallet addresses.

That scale is part of why the debate has reignited across the industry. Self-custody has traditionally been framed as a way to reduce reliance on intermediaries. But security research and real-world incidents have repeatedly shown that self-custody is not a single risk level—it’s a system of risks spanning device firmware, user setup, operational processes, and the broader ecosystem that supports hardware wallet usage.

The Coldcard episode thus serves as a reminder that hardware wallet users can still be exposed when flaws exist below the user interface—particularly when vulnerabilities emerge that can be exploited without requiring the user to willfully do something unsafe.

Self-custody vs. exchange custody: CZ revives the “statistical safety” argument

The ETF timing has also fed into broader arguments about whether self-custody is truly “safer” on a population basis. Binance co-founder Changpeng “CZ” Zhao commented on the ongoing discussion, suggesting that storing crypto on centralized exchanges may be “statistically safer” than self-custody, pointing to data from analyst Willy Woo. CZ’s reasoning is based on the visibility of losses: exchange-related incidents are easier for observers to detect and document, while self-custody failures (including hacks and lost funds) may go unreported or be harder to quantify.

In a post on X, CZ noted that “Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported.”

The practical implication isn’t that all custody models are equally reliable. Instead, it highlights an asymmetry in measurement: even if self-custody failures occur frequently, the public record can undercount them relative to highly visible exchange events. For investors deciding how to allocate Bitcoin exposure, this creates a problem of incomplete information—one reason ETFs continue to attract interest as a middle path between direct custody and exchange-managed holding.

Cyber risk is shifting, and custody debates are following

The Coldcard exploit arrives as concerns about rapidly escalating cyber threats become harder to ignore. Industry reporting cited by Cointelegraph points to increasing AI-assisted attack capabilities, where adversaries can identify and exploit vulnerabilities faster than defenders can patch them.

For example, Cointelegraph reported that Bitcoin swap service Boltz suspended its non-custodial bridge, citing a steady rise in AI-assisted exploits that were enabling attackers to move faster than the team could remediate issues. While that incident is not the same as the Coldcard hardware vulnerability, it reinforces a larger theme: attackers are increasingly benefiting from automation and speed—meaning the security burden on individuals and small teams can become disproportionately heavy.

That matters for custody decisions because self-custody security is often treated as a “set and forget” activity. In reality, device maintenance, software/firmware updates, environment hygiene, and broader operational discipline all require ongoing attention. If the threat landscape is accelerating, the gap between what users can comfortably manage and what attackers can probe may widen.

How investors should think about the ETF streak from here

Even if the Coldcard timing played a role in investor behavior, it may not be the only driver of ETF flows. ETFs already offer regulated access, standardized custody arrangements with institutional-grade processes, and simplified onboarding compared with direct device ownership and operational management.

The next test is persistence. Readers should watch whether daily inflows continue beyond the immediate news cycle and whether new inflow streaks emerge alongside future security incidents. If inflows remain strong while headlines fade, it would suggest that some capital is moving for structural reasons. If inflows taper quickly, the streak may reflect near-term sentiment shifts rather than a lasting change in custody preferences.