Coldcard $88.6M drain strengthens Bitcoin ETF case, Balchunas says

Galaxy Research identified three attack waves draining 1,367.05 BTC, worth about $88.6 million, from 4,585 Coldcard-generated addresses, per on-chain analysis published Aug. 2.

"Yes, an ETF fixes this," Eric Balchunas, senior ETF analyst at Bloomberg Intelligence, said on X, arguing that regulated funds remove the seed-management burden that left Coldcard users exposed. He called the reported staffing level at Coinkite, Coldcard's manufacturer, "a red flag" for a company protecting life-changing sums.

The first two waves hit roughly 3,200 addresses and moved about 1,000 BTC, while a third wave removed 207.7294 BTC from 1,912 addresses with a different transaction pattern. Block's Bitcoin engineering team traced the failure to a firmware integration error that routed random-number generation through a deterministic MicroPython fallback instead of the intended hardware source. Coinkite's security advisory covers Mk2 and Mk3 firmware from version 4.0.1 through 4.1.9, plus seeds generated on Mk4, Mk5 and Q devices before fixed releases.

The incident lands as self-custody faces its most visible test since FTX, with CryptoQuant data showing 39,600 BTC moved in sub-1 BTC transfers on Friday — the highest daily level since November 2022. Galaxy's Alex Thorn warned the attack remains ongoing and urged affected users to move funds immediately.

ETF structure shifts custody risk, not eliminates it

A spot Bitcoin ETF removes the investor from seed creation, firmware updates, backups and wallet migration. BlackRock's iShares Bitcoin Trust reported $46.52 billion in net assets on July 31 and charges a 0.25 percent sponsor fee. Its SEC filing names Coinbase Custody as the primary custodian holding private keys in segregated cold-storage wallets, with Anchorage Digital Bank as an additional custodian. Fidelity uses Fidelity Digital Assets to custody Bitcoin for its Wise Origin Bitcoin Fund.

But the wrapper replaces individual seed risk with institutional custody, operational and counterparty risk. IBIT's annual filing warns that hackers, employee misconduct, technical failures or unauthorized transfers could still cause losses, and that Coinbase's shared insurance may be insufficient for every possible event. Shareholders cannot bring direct claims against the Bitcoin custodian under the custody agreement. ETF shareholders also own securities rather than spendable Bitcoin — IBIT shares trade on Nasdaq, and redemptions occur through authorized participants in baskets of 40,000 shares.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that "self-custody is over," arguing that because self-custody is distributed, users have time to respond as threats are identified. He estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen in the attack.

No verified data yet shows the Coldcard drain has created new Bitcoin ETF demand. BlackRock's latest official figures cover July 31, before Balchunas's Aug. 2 comments. IBIT's NAV fell 2.78 percent that day, though the move cannot be tied solely to the wallet incident. The next U.S. trading session may show whether ETF flows change, though one day of activity would not prove a connection.

This article is for informational purposes only and does not constitute investment advice.