Balchunas claims that Bitcoin ETF has new arguments after Coldcard was stolen of $89 million

Bloomberg Intelligence Analysts: Cold Wallet security vulnerability highlights the advantages of spot bitcoin ETFs

Eric Balchunas, senior ETF analyst at Bloomberg Intelligence, said on August 2 that the Coldcard security vulnerability further proves the rationality of the U.S. spot bitcoin ETF and is especially suitable for investors who want to hold long-term exposure to bitcoin prices but are unwilling to manage private keys.

Incident Summary

Galaxy Research traced the theft of a total of 1,367.05 bitcoins from 4585 addresses, and estimates that the total loss caused by the Coldcard incident was close to US$88.6 million. Balchunas believes that institutional custody makes Bitcoin ETFs more suitable for investors seeking only long-term price exposure. ETF investors do not need to manage seed keys, but they also give up direct ownership, payment capabilities and 24-hour access to the Bitcoin network.

His comments stem from Galaxy Research's estimate that three waves of suspected attacks stole 1,367.05 bitcoins, worth approximately US$88.6 million, from 4585 addresses. "Yes, ETFs can solve this problem," Balchunas wrote. At the same time, it was pointed out that some self-custody advocates disparaging such funds as "paper bitcoins." This is his personal view on the custody method, and there is no evidence that investors have transferred funds to ETFs due to the incident. When he issued his weekend comments, U.S. markets were closed, so there was no verifiable reaction to the flow of funds after the comments.

Technical details and impact

Block's Bitcoin engineering team found that a firmware integration error caused the random number generation path to be directed to a deterministic MicroPython alternative rather than the expected hardware source. It reported that Mk2 and Mk3 devices running the affected firmware did not add any cryptographic entropy through this path. Subsequent models were re-seeded using limited safety elements. Coinkite's security bulletins cover versions 4.0.1 to 4.1.9 of Mk2 and Mk3 firmware, as well as seeds generated using Mk4, Mk5 and Q devices before its fixed versions were released. The company has released revised firmware, but warned that the update software cannot repair the seeds that have been created and that users must generate new seeds and transfer funds.

Galaxy's latest estimates cover three waves of suspected theft. The third wave removed 207.7294 bitcoins from 1912 addresses, and the transaction pattern was different from the previous two waves. Galaxy called the $88.6 million an "estimate of the observed scale," meaning that the figure is still an on-chain estimate rather than a final total confirmed by Coinkite or law enforcement.

Balchunas also questioned whether a purportedly small hardware wallet company should shoulder the responsibility of protecting huge amounts of money. He called the number of employees mentioned in the report "a red flag." Coinkite has not publicly confirmed the number of employees cited in its post, and the size of the company itself does not determine whether the security system is adequate.

U.S. Spot Bitcoin ETF eliminates seed management risks

Spot Bitcoin ETFs exempt investors from participating in seed creation, firmware updates, backup and wallet migration. Funds and their service providers are responsible for these tasks. BlackRock said its iShares Bitcoin Trust ETF simplifies the operations and custody involved in holding Bitcoin directly. The ETF reported net assets of $46.52 billion on July 31 and charged a 0.25% management fee. According to its filing with the SEC, Coinbase Custody holds the trust's private key in an isolated cold storage wallet, and also lists Anchorage Digital Bank as another custodian that BlackRock may use. The document describes the process of limited employee access, external control review, and no single managed employee can access the complete private key.

Fidelity holds bitcoins for its Wise Origin Bitcoin Fund through Fidelity Digital Assets. Such products allow U.S. investors to gain Bitcoin exposure through brokerage accounts, trust accounts, and tax-favored accounts without having to operate a hardware wallet. This is particularly important for financial advisers and retired investors who seek only price exposure.

However, the term "regulated ETF" requires contextual understanding. IBIT is a product reported to the SEC and listed on NASDAQ, but BlackRock made it clear that the trust is not registered under the Investment Company Act of 1940 and therefore does not enjoy all the protections applicable to traditionally registered mutual funds and ETFs.

Bitcoin ETF transfers rather than eliminates custody risks

The ETF structure replaces personal seed risk with institutional custody, operating and counterparty risk. IBIT's annual filing warns that hacking, employee misconduct, technical failures or unauthorized transfers can still lead to losses. The filing also states that Coinbase's shared insurance may not be sufficient to cover all possible scenarios. Documents show that shareholders are not allowed to directly file claims against the Bitcoin custodian under the custody agreement. No party guarantees all trust assets or the obligations of the service provider. These disclosures do not suggest that ETFs are less secure than personal wallets, but rather that risks are transferred to institutions and contractual arrangements.

ETF shareholders hold securities rather than disposable bitcoins. IBIT shares are traded on NASDAQ, and redemption is made by authorizing participants in a minimum basket of 40,000 shares. Retail investors cannot withdraw ETF positions to personal addresses, make bitcoin payments, and trade anytime when the network is open. The structure provides easier access and professional hosting, but eliminates direct ownership and round-the-clock access.

The $89 million theft has not yet become a catalyst for ETF inflows

Balchunas's argument may appeal to investors who simply want to get Bitcoin price performance. The incident may also prompt holders to disperse funds into personal wallets, multi-signature schemes and regulated custodians rather than relying on a single device or provider. These are still possible reactions rather than confirmed investor behavior.

There is currently no verified data showing that the Coldcard theft incident has generated new demand for Bitcoin ETFs. BlackRock's latest official figures are as of July 31, before Balchunas's comments on August 2. IBIT's net worth fell 2.78% on the day, but the change cannot be entirely attributed to the wallet event. The next U.S. trading day may show whether ETF flows have changed, but a single day of activity is not enough to prove a correlation. Bitcoin prices, economic conditions and portfolio rebalancing will also drive fund creation and redemption.