Coldcard hack sends BTC into ETFs

A hardware wallet bug just did what a decade of ETF marketing couldn't: made institutional custody look like the safe choice. US spot Bitcoin ETFs pulled in $382 million over two trading days this week, right as a Coldcard hack estimated at $130 million in losses spread across roughly 7,300 addresses.

The flows behind the fear

BlackRock's IBIT led with $111 million on Monday and $170 million on Tuesday, according to Farside Investors data cited by Cointelegraph. Fidelity's FBTC added about $33 million and $20 million on the same two days. The smaller Invesco Galaxy Bitcoin ETF (BTCO) logged $6.7 million on Monday, its first positive day since July 1, a figure equal to nearly 4% of the fund's entire $172 million lifetime inflow. Galaxy Research, the same shop tracking BTCO, is also the one publishing running estimates on the Coldcard breach, putting suspected losses at $130 million across thousands of wallet addresses. Bitcoin itself barely moved, trading near $64,113 and down about 0.8% over the week, with Strategy adding another 1,638 BTC in sales to the mix of selling pressure.

Custody risk just got repriced

Bloomberg Intelligence's Eric Balchunas called the shift directly: what crypto users treated as a "bug," namely reliance on regulated custodians instead of self-custody, is starting to look like a feature. That's the read worth sitting with. ETFs don't sell convenience anymore, they sell someone else's operational risk instead of your own. A $130 million loss spread across 7,300 wallets is a distributed disaster no single custodian could shrug off with a press release, but it's exactly the kind of headline that makes a regulated fund's quarterly compliance filing look boring by comparison, and boring is the point. Two days of ETF inflows worth $382 million against a single hack estimated at a third of that isn't proof of mass migration out of self-custody. It's a data point that the market prices custody failures fast when they're public, traceable and attributed to a name like Coldcard rather than an anonymous smart contract exploit. Bitcoin's public ledger cuts both ways here too: commentators noted the stolen funds are hard to move without detection, which limits how fast an attacker can cash out but does nothing for the users who already lost coins.

What confirms the shift

The number to track isn't this week's inflow, it's whether BTCO and its peers keep pulling positive flows once the Coldcard headlines fade, or whether this was a one-off flight response that reverses as soon as the news cycle moves on. If ETF inflows hold through the next quiet week with no fresh custody scare, that's the real signal institutional wrappers are winning the argument, not the hack.