Coldcard Flaw Revives Bitcoin Wallet vs ETF Debate
Coldcard’s wallet failure has exposed the operational risks of self-custody at a time when spot Bitcoin ETFs are drawing fresh inflows and older BTC is moving.
Key Takeaways
- US spot Bitcoin ETFs have logged four straight positive sessions, but there is no evidence linking those inflows to Coldcard users.
- Bitcoin ETFs shift key management to brokers, funds and institutional custodians.
- FDIC and SIPC protections do not insure the Bitcoin held inside a spot Bitcoin product.
- Long-term-holder supply fell by roughly 210,000 BTC, but the data cannot show where those coins moved or why.
For Coldcard users, the problem was not simply that funds had been stolen. The weakness affected the process used to create the recovery phrases protecting those funds.
Our initial July 31 report covered a warning from Coldcard maker Coinkite after hundreds of Bitcoin addresses were swept and the company identified a weakness in how some devices generated recovery phrases.
The problem was unusually serious because the hardware wallet itself did not need to be hacked. If a recovery phrase had been created with insufficient randomness, an attacker could search a much smaller set of possible keys until finding the wallet.
Updating the device could prevent it from generating another weak seed, but it could not repair one that already existed.
Coinkite later widened the scope of its warning. Its updated advisory says affected seed generation was not confined to older Mk2 and Mk3 devices. Seeds created on Mk4, Mk5 and Q models before the corrected firmware releases were also affected, although the company says the weakness was less severe on the newer hardware.
Coldcard Changes the Custody Calculation
The incident exposes an important limitation of self-custody. Self-custody gives the owner direct control over their Bitcoin and responsibility for the hardware, software, recovery process and cryptographic keys protecting it.
At the same time, SoSoValue data shows US spot Bitcoin ETFs recording net inflows for four consecutive trading sessions after the incident was first announced.
| Date | Daily Total Net Inflow (USD) |
|---|---|
| Aug 6, 2026 | $128.69M |
| Aug 5, 2026 | $244.42M |
| Aug 4, 2026 | $211.49M |
| Aug 3, 2026 | $170.09M |
Those flows should not be read as evidence that Coldcard users are moving into ETFs. ETF demand is influenced by Bitcoin’s price, institutional allocation, macro conditions and other factors, and there is no data tracing Coldcard funds directly into regulated investment products.
A person holding Bitcoin directly has to protect a recovery phrase, verify addresses, maintain secure hardware and know how to recover the wallet if something goes wrong. If the seed is stolen, exposed or generated incorrectly, there is generally no institution capable of reversing the resulting transaction.
A spot Bitcoin ETF removes most of that work from the investor. The investor owns a security in a brokerage account rather than controlling the Bitcoin private keys, while the fund and its institutional custodians handle the underlying coins.
The SEC notes that spot Bitcoin products can remove some of the direct risks associated with personally using crypto exchanges, wallets and cryptographic keys.
ETF Custody Comes With Different Protections
Using an ETF does not turn Bitcoin exposure into an insured bank deposit.
FDIC insurance does not cover Bitcoin, stocks or ETF shares. It applies to qualifying bank deposits such as checking and savings accounts, not investment products.
SIPC provides a narrower form of protection at the brokerage level. If ETF shares are held through a SIPC-member brokerage and that broker fails with customer securities missing, eligible cash and securities can be protected up to $500,000 per customer, including up to $250,000 for cash. SIPC is designed to restore missing brokerage assets; it does not compensate investors for losses caused by Bitcoin falling in price.
BlackRock’s IBIT, for example, uses institutional Bitcoin custodians, including Coinbase Custody, with the underlying assets held on behalf of the trust. BlackRock states that the trust itself is not FDIC- or SIPC-insured and that neither the trust nor its sponsor insures its Bitcoin.
The same BlackRock disclosures state that Coinbase maintains commercial crime insurance covering certain events such as theft, hacks and fraudulent transfers, but the policy is shared across Coinbase customers and may not be sufficient to cover every possible loss.
US spot Bitcoin products also differ from conventional registered ETFs. They are generally structured as exchange-traded commodity trusts rather than investment companies registered under the Investment Company Act of 1940, meaning they do not receive all the statutory protections that apply to ordinary mutual funds and registered ETFs.
Older Bitcoin Is Moving, but the Destination Is Unknown
Bitcoin’s long-term-holder data was also changing during the same period.
According to Glassnode’s Long-Term Holder Supply data, roughly 210,000 BTC have left the cohort over the past week, the largest decline since December 2024 based on the supplied period. Long-term-holder supply now stands at roughly 14.77 million BTC, with Glassnode’s latest reading at 14.7729 million.
Glassnode does not classify every wallet that has been inactive for exactly 155 days as a long-term holder. Its model works at the entity level and uses coin age around a 155-day threshold to distinguish shorter- and longer-term ownership behaviour.
A decline in long-term-holder supply shows that older Bitcoin is becoming more liquid. The metric does not reveal where those coins went. They may have been sold or transferred between wallets, custodians or investment structures, and the data provides no basis for linking those movements to Coldcard or ETF inflows.
The Coldcard failure shows why custody remains one of Bitcoin’s most consequential practical decisions. Self-custody puts security in the holder’s hands, while an ETF depends on brokers, fund sponsors and institutional custodians.
- Methodology: The article uses Coinkite’s Coldcard advisory, SoSoValue ETF flow data, Glassnode long-term-holder metrics, and public information from the SEC, FDIC, SIPC and BlackRock.
- Disclaimer: This article is for informational purposes only and does not constitute financial, investment or security advice. Bitcoin custody and ETF products involve different risks, and past or current market data does not guarantee future outcomes.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
