The price of Bitcoin has halved, yet ETFs are experiencing the strongest capital inflow in four months: cryptocurrency funds are shifting from "self-custody" to institutional holdings.

The Bitcoin exchange-traded funds (ETFs) listed on the U.S. stock market recorded the strongest weekly inflow of funds since April, following a recent hacking incident that reignited market focus on the risks associated with the secure custody of digital assets. In contrast, these ETF products allow investors to gain exposure to Bitcoin and other cryptocurrencies without personally holding or safeguarding them. Last week, these Bitcoin ETFs attracted over $850 million in net inflows, setting a four-month record. The surge in Bitcoin ETF inflows occurred after a security vulnerability involving the Coldcard wallets manufactured by Canadian company Coinkite was disclosed. The incident resulted in an estimated $130 million worth of Bitcoin being stolen almost instantaneously and prompted some cryptocurrency analysts to believe that investors might be turning towards regulated crypto asset investment tools offered by Wall Street. Eric Balchunas, a senior research analyst at Bloomberg Intelligence, stated, The Coldcard hack could make these spot Bitcoin ETFs on the stock market more attractive to some investors, including those who have long held Bitcoin. As shown in the above chart, the weekly inflow into U.S. Bitcoin ETFs has reached its highest level since April. The security myth of cold wallets has been shattered! $130 million worth of Bitcoin stolen, and funds are accelerating towards Wall Street's ETF custody system. Cold wallets have long been considered by cryptocurrency investors as one of the safest ways to store digital assets. These physical devices remain offline and use proprietary secret codes to enable owners to conduct cryptocurrency transactions. The innovative design, isolated from the internet, aims to make the assets held within them less susceptible to cyberattacks. The Coinkite incident challenges this traditional perception. Significant flaws in certain versions of Coinkite firmware made the security information used by some wallets easier to predict than originally designed, allowing attackers to take control of the affected wallets and steal the Bitcoin without ever needing to access the physical Coldcard devices. Coinkite stated in an email sent to the media last Thursday, We are doing everything we can to assist the affected customers. This hacking incident represents the latest and most severe blow that holders of Bitcoin and other cryptocurrencies have faced. Previously, they had witnessed the price of this cryptocurrency plummet about 50% from the historical peak reached last October. Since June, Bitcoin trading prices have remained within a narrow range of $60,000 to $67,000, with relatively moderate price fluctuations. This surge in demand for Bitcoin ETFs in the U.S. market over the past few days is particularly noteworthy, as it has not been accompanied by a significant increase in Bitcoin prices. Rajiv Sawhney, head of international portfolio management at Wave Digital Assets, stated that this robust demand for Bitcoin ETFs signifies that marginal Bitcoin and other cryptocurrencies are moving from self-custody to institutional investment tools where they transition into locked and configured market supply. Switching to ETFs does not eliminate the broader position risk. The cryptocurrency custodians of ETFs may still be vulnerable to security breaches, although numerous large investment institutions on Wall Street, including BlackRock, typically equip specialized security teams and implement extensive cybersecurity measures to protect client assets. Some investors who have sensed the risks associated with cryptocurrency assets have also relinquished the autonomy that comes with directly holding Bitcoin. After years of experiencing exchange closures, bankruptcies, and financial fraud in the cryptocurrency industry, many investors have remained vigilant. Balchunas noted, If a Wall Street ETF custodian were to face a massive breach one day, theres no guarantee that investors would not suffer losses, but such an event would likely trigger immediate scrutiny by regulatory bodies and investigations by law enforcement. He added that this could lead some investors to be more confident about relying on large financial institutions to manage Bitcoin prices and exposure. Coinkite's firmware vulnerability led to the theft of over $100 million in Bitcoin, bringing self-custody risks to light. Coinkite is a Canadian Bitcoin security hardware company established in 2012, primarily positioned as a Bitcoin-only self-custody infrastructure provider. Its most well-known product is the Coldcard hardware wallet, which focuses on offline private key storage, air-gapped signing, dual security chips, and verifiable firmware; in addition, it offers other physical security products for Bitcoin, such as OPENDIME, TAPSIGNER, and SATSCARD. Coinkite is neither an exchange nor a custody institution, but rather a hardware security company that helps users control their own private keys, making the impact of this incident particularly severe: the problem lies precisely in the tier long perceived as the safest the key generation process of offline cold wallets. The root of the incident is not a breach of the Bitcoin protocol or remote hacking of Coldcard devices, but rather that certain Coldcard firmware erroneously bypassed the true hardware random number generator when generating wallet seeds, reverting to a predictable software pseudorandom number path. Blocks technical investigation revealed that this regression error can be traced back to a firmware change from March 2021: a certain compilation configuration set the hardware RNG to off, but the underlying library only checked whether that macro existed, not whether it was actually enabled, resulting in the randomness needed to generate private keys being replaced by predictable states such as device UID and timer data. For some Mk2/Mk3 versions, the seeds could even be highly deterministic; although Mk4/Q/Mk5 introduced entropy from the security chip, the effective secure space remained compressed. Attackers could thus enumerate candidate seeds in an offline environment and validate if they matched against public addresses or xpubs, allowing them to rebuild private keys and directly transfer Bitcoin without ever needing to come into contact with physical wallets. This incident has altered the narrative of self-custody = absolutely safer. Coinkite has released a firmware fix but has explicitly stated that upgrading the firmware does not rectify previously generated weak seeds; affected users must create a completely new seed and migrate their assets. At least 50 independent dice entropy inputs or a strong BIP-39 passphrase can reduce risk, but cannot change the fact that weak seeds already exist. For the cryptocurrency asset market, this event has expanded the security risk from could an exchange go bankrupt to does the hardware wallet code truly generate unpredictable keys, so it is not surprising that some funds have shifted towards spot Bitcoin ETFs as these ETFs sacrifice self-custody control in exchange for large custodial institutions, compliance audits, insurance, and regulatory accountability mechanisms.