Bitcoin ETFs' $1B week follows a hack

US spot Bitcoin ETFs took in roughly $1 billion in net inflows this week, the strongest showing since April and the third-best week since last October. The timing is hard to ignore: it lands days after a $116 million hack tied to a flaw in Coldcard hardware wallets, one of the more trusted names in self-custody.

The flow numbers

Bloomberg ETF analyst Eric Balchunas put the week's net inflows at about $1 billion, a sharp reversal from the uneven, often negative flows that had defined the summer. He called the stretch since October "Bitcoin's silent IPO," a reference to a theory popularized by investor Jordi Visser describing early holders selling into ETF and institutional demand. That distribution had been coinciding with softer flow data for months, which is what makes this week's jump stand out.

The Coldcard exploit, disclosed by wallet maker Coinkite, stemmed from a firmware flaw in how affected devices generated wallet keys, letting attackers drain funds from wallets created under vulnerable conditions. The loss sits near $116 million and is still being tracked on-chain. Balchunas flagged the sequence himself: the surge in ETF inflows came right on the heels of the hack becoming public. He was careful to note correlation isn't causation, but added he expects some self-custody holders to migrate toward ETFs over time.

What the timing suggests

A hardware wallet failure is the worst kind of advertisement for self-custody because it strikes at the exact promise that draws people to it: that holding your own keys means no one else can lose them for you. When the device meant to secure that promise fails structurally, the psychological ground shifts fast. ETFs sell the opposite trade-off. Investors give up direct control of their coins in exchange for custody handled by regulated intermediaries with audits, insurance structures and legal accountability. For a segment of holders, particularly newer or less technical ones, that trade-off just got a lot more attractive.

None of this means self-custody is broken as a concept. Coldcard's flaw was a specific firmware issue, not evidence that all hardware wallets are compromised. But perception moves faster than technical nuance, and a $116 million loss headline travels further than the patch notes that follow it. Balchunas is right that the link is unproven. He's also right that it doesn't need to be proven to change behavior. People act on fear before they act on data.

What comes next

The real test is whether this inflow strength holds once the Coldcard headlines fade, or whether it was a one-week reaction that reverts once the news cycle moves on. A second or third consecutive week of inflows near this level would back the migration story. A snapback to the thin, choppy flows seen through the summer would suggest this was fear-driven and temporary rather than a lasting shift in how people want to hold Bitcoin.