Coldcard Hack Drains $116M, ETFs Get $620M: Coincidence? Balchunas Has Opinions

US spot Bitcoin exchange-traded funds have absorbed roughly $620 million in inflows over five consecutive trading sessions, a stretch that began immediately after the Coldcard wallet exploit drained more than $116 million worth of $BTC from over 5,200 wallet addresses, according to blockchain intelligence firm TRM Labs. Bloomberg senior ETF analyst Eric Balchunas tracked the inflow streak across BlackRock's iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), ARK 21Shares Bitcoin ETF (ARKB) and the Defiance Daily Target 2X Long MSTR ETF (MSBT), noting that all five products posted positive daily flows since the weekend attack. The cumulative figure aligns with Cointelegraph's reporting on the same streak.

Balchunas stopped short of drawing a direct line between the two events. "I'm not saying it's connected, we just don't know," he said in a post on X. "[Although] long-term I can't imagine there aren't some who migrate over." The Coldcard breach — disclosed this week — has revived a long-running debate over whether investors are better off holding $BTC directly or accessing it through regulated products where institutional custodians handle storage and security.

Binance co-founder Changpeng Zhao entered the discussion with a pointed claim. Citing data from analyst Willy Woo, Zhao argued that storing crypto on centralized exchanges may now be "statistically safer" than self-custody, pointing to cumulative Bitcoin losses from self-custody incidents surpassing those from exchange hacks. "Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported," Zhao said. The Coldcard incident drew renewed attention to firmware and supply-chain risks in hardware wallets, with security researchers noting that even air-gapped devices can be exposed to software vulnerabilities.

The broader threat landscape is also shifting. On Monday, Bitcoin swap service Boltz suspended its non-custodial bridge, citing a steady rise in AI-assisted exploits that let attackers identify and patch vulnerabilities faster than the platform's team could respond. Boltz said the suspension was a precautionary measure while it works on a redesigned version of the bridge. The move adds to a growing list of crypto platforms that have publicly flagged AI-driven attacks as a rising operational concern.

The Coldcard hack and the ETF inflow streak remain temporally adjacent but unproven as causally linked. Eric Balchunas has acknowledged the optic while declining to assert causation, and no on-chain or regulatory data has been published to confirm that victims of the exploit or concerned self-custody users are reallocating to spot Bitcoin ETFs. For now, the numbers are the numbers: $116 million lost by Coldcard users, $620 million added to spot Bitcoin ETFs in the same window, and a renewed industry-wide conversation about where $BTC is safest.