Bitcoin ETFs See Inflows as Cold-Wallet Hack Revives Custody Debate

Spot Bitcoin ETFs in the United States continued drawing attention from investors, posting net inflows of $211.5 million on Tuesday, after $170 million of inflows the prior day, according to SoSoValue data. The renewed demand comes as a high-profile Coldcard hardware wallet incident is prompting fresh debate over how safely digital assets are protected—especially in comparison with regulated, institutional custody.

The inflow rebound also aligns with early reassessment of the potential impact of the Coldcard hack. Galaxy Research has estimated the incident could have affected up to 7,300 addresses and may have led to roughly $130 million in suspected Bitcoin losses for users of the hardware wallet, based on its own analysis shared on social media.

Key takeaways

• SoSoValue reports spot Bitcoin ETFs pulled in $170 million on Monday and $211.5 million on Tuesday, signaling a return of daily demand.
• BlackRock’s iShares Bitcoin Trust (IBIT) led the recovery with $111 million in inflows on Monday and $170 million on Tuesday, per Farside Investors data.
• Galaxy Research estimates the Coldcard incident may have impacted as many as 7,300 addresses, with suspected losses around $130 million.
• Bloomberg Intelligence’s Eric Balchunas said the custody narrative could shift as investors compare institutional safeguards with smaller crypto players.
• Bitcoin was broadly stable as traders weighed custody concerns alongside other selling pressure, including a reported 1,638 BTC sale by Strategy.

Spot Bitcoin ETFs rebound as capital returns

ETF flows suggest demand is not confined to a single fund—though the largest products remain the main drivers. Farside Investors data shows IBIT led Monday and Tuesday inflows, contributing $111 million on Monday and $170 million on Tuesday.

Fidelity’s Wise Origin Bitcoin Fund (FBTC) followed with approximately $33 million in inflows on Monday and around $20 million on Tuesday. Invesco Galaxy Bitcoin ETF (BTCO) recorded $6.7 million in inflows on Monday—its first positive daily flow since July 1—according to Farside.

For investors, the timing matters. Coldcard-related headlines are reintroducing risk questions that many ETF investors previously treated as settled through regulated custody frameworks. When inflows rise during a period of heightened security discourse, it can be interpreted as a renewed preference for products where asset protection is managed within established financial systems.

Galaxy Research keeps the Coldcard impact in focus

Galaxy Research has been one of the most prominent groups tracking the Coldcard incident, with estimates that attempt to quantify both exposure and potential losses. In posts shared by Galaxy Research personnel, including firmwide research head Alex Thorn, the analysis has highlighted possible affected addresses and the scale of suspected stolen funds linked to users of the device.

While the figure of “up to 7,300 addresses” and roughly “$130 million” in suspected losses are estimates rather than confirmed outcomes for every impacted user, the essential point is that the hack underscores the operational risks that come with self-custody—particularly for hardware wallet users who expect their security model to hold under real-world conditions.

The ETF market’s ability to absorb investor worry depends on how quickly investors can translate those risks into a decision. Tuesday’s strong inflow data suggests many were willing to do exactly that, at least in the short term.

Custody debate: when “institutional” starts to look like a feature

Bloomberg Intelligence ETF analyst Eric Balchunas argued that the Coldcard hack could push some investors toward Bitcoin ETFs by changing how custody is perceived. In a Tuesday post on X, Balchunas framed traditional custodial responsibility as increasingly attractive—suggesting that what some in crypto culture once dismissed as a “bug” (reliance on legacy financial institutions) may appear like a “feature” once investors compare those systems to the realities of security failures elsewhere.

Balchunas also pointed to additional ETF-market shifts that are affecting investor expectations around the product landscape, including the closure of Hashdex’s spot Bitcoin ETF and a planned reverse split for BlackRock’s Ethereum ETF, according to related reporting and a regulatory filing referenced in the original discussion.

For market participants, these changes matter because product availability and investor access can influence where flows ultimately land. Even if the Coldcard incident is the immediate catalyst for attention, the broader structure of the ETF market—what exists, what’s closed, and what changes operationally—affects whether risk-off moves translate into reduced exposure or reallocations within the ETF suite.

Bitcoin price holds steady as traders weigh selling pressure

Bitcoin remained relatively stable as traders processed both the Coldcard incident and other potential sources of pressure. At the time of publication, BTC traded around $64,113, down about 0.8% over the prior seven days, according to CoinGecko, with the period’s low falling below $62,500.

Alongside custody headlines, observers also cited additional selling activity, including a reported 1,638 BTC sale by Michael Saylor’s Strategy. That adds another layer to how traders may interpret ETF inflows: if ETFs are attracting new capital while other wallets are still moving coins, price stabilization can occur even without immediate net buying pressure overwhelming other flows.

Not all analysis has treated the Coldcard-related movement risk as negligible. Some commentators argued that moving or converting stolen funds could be more difficult because blockchain transactions are publicly visible. In an X post, commentator Shagun suggested that large transfers would likely draw scrutiny from blockchain researchers, exchanges, and other market actors.

What to watch next

Investors will likely keep an eye on whether spot Bitcoin ETF inflows persist beyond the current rebound and whether any further incident-related assessments clarify the true extent of the Coldcard exposure. Separately, traders may watch on-chain behavior for signs of how any stolen funds move—because the custody story may change again depending on whether attackers can liquidate quickly or face increased friction.