US spot Bitcoin ETFs have pulled in roughly $620 million over a week-long inflow streak that began right around the Coldcard wallet exploit, reviving a familiar debate about whether high-profile self-custody failures push investors toward regulated, custodial products instead. BlackRock's iShares Bitcoin Trust (IBIT), Fidelity's Wise Origin Bitcoin Fund (FBTC), Bitwise's BITB, ARK 21Shares' ARKB, and the Defiance Daily Target 2X Long MSTR ETF all recorded inflows on every trading day following the weekend the exploit became public.
The exploit itself was significant enough to explain investor unease on its own. TRM Labs, the blockchain intelligence firm tracking the incident, put the damage at more than $116 million in Bitcoin drained from over 5,200 wallet addresses after a firmware flaw undermined the random number generation Coldcard devices relied on to create seed phrases.
Correlation, not confirmed causation
Bloomberg senior ETF analyst Eric Balchunas was careful to separate the two events rather than draw a straight line between them. “I’m not saying it’s connected, we just don’t know,” he said, though he added the caveat that matters more for the long-term picture: “Long-term I can’t imagine there aren’t some who migrate over.” That framing captures why the timing is getting attention even without hard proof — a week of steady inflows across five separate products immediately after a widely covered hardware wallet failure is, at minimum, a pattern worth watching.
Related: Coldcard's Five-Year RNG Flaw Linked to $116M Bitcoin Theft
CZ reframes the custody math
Binance co-founder Changpeng Zhao used the moment to argue that centralized exchange custody may now be “statistically safer” than self-custody for many holders, pointing out that exchange hacks tend to generate headlines while self-custody losses go undercounted: “Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side.” The claim has some data behind it — CZ has separately cited figures suggesting roughly 1.57 million BTC has been lost through self-custody failures compared to about 1.51 million BTC lost to exchange breaches, a gap close enough that framing either side as categorically safer oversimplifies the picture.
The broader numbers complicate any tidy conclusion further. Exchange hacks alone accounted for $2.87 billion in stolen crypto across nearly 150 incidents in 2025, with February's Bybit breach responsible for over half that total at $1.46 billion. Meanwhile, surveys of US crypto users show a persistent gap between stated preference and actual behavior: about 66% say self-custody matters to them and 46% worry about a major exchange breach, yet 88% keep assets on centralized exchanges anyway, with only a third holding a cold wallet.
What the flows actually show
Whether or not Coldcard users specifically are behind the ETF inflows, the episode adds to a running theme in 2026: high-profile security failures on the self-custody side keep coinciding with renewed institutional interest in regulated, custodial exposure to Bitcoin. Balchunas's caution about correlation versus causation is the right note to end on — the inflows are real and measurable, but the reason behind them remains, for now, inferred rather than proven.
