Coldcard hack sends $382M into Bitcoin ETFs

A $130 million hack of Coldcard, a top-tier Bitcoin hardware wallet, has shaken trust in self-custody storage just as Bitcoin spot ETFs see a surge in new money.

Investors pulled $382 million into Bitcoin ETFs over the first two days of this week, according to fund-flow data. The inflows landed as Coldcard maker Coinkite revealed that certain wallets had weaker-than-expected randomness in their recovery seed phrases, letting attackers guess private keys and steal funds. The flaw only affected a subset of devices, but the damage to the wallet’s reputation is already done. Bitcoin’s price barely budged, showing the market sees the problem as specific to one product, not the blockchain itself.

Coldcard was long regarded as the gold standard for offline Bitcoin storage, the go-to choice for users who wanted maximum control. Now that trust is in question. Affected customers thought their seed phrases were truly random; instead, some were predictable enough for hackers to crack. The incident highlights a wider dilemma: most people don’t have the time or skill to vet every obscure crypto product they use. When self-custody fails, the default becomes large, trusted institutions—exactly the kind of middlemen Bitcoin was designed to bypass.

The biggest beneficiaries are the biggest ETFs. Of the $382 million that flowed in, 74% went to BlackRock’s iShares Bitcoin Trust and 14% to Fidelity’s Wise Origin Bitcoin Fund. Both are run by trillion-dollar asset managers with established compliance and security teams. The hack may push cautious investors toward these regulated products, not away from them, reinforcing the trend of institutional Bitcoin ownership.