Spot Bitcoin exchange-traded funds attracted $626 million in fresh capital following the disclosure of a major Coldcard hardware wallet breach that resulted in over $130 million in losses.

According to data from Farside Investors, major U.S. funds managed by BlackRock, Fidelity, Grayscale, Morgan Stanley, and others collectively received the inflows following news of the hack on Friday.

Hackers began draining millions of dollars in Bitcoin from Coldcard wallets last week after discovering a vulnerability in the product's software. A firmware flaw — traced back to a 2021 build issue that bypassed the device's dedicated randomness chip — allowed an attacker to guess weak private keys. Estimates of total Bitcoin lost now exceed $130 million, with millions of dollars being siphoned on a daily basis since the attack was initiated.

The breach is particularly notable given Coldcard's standing among self-custody advocates. Manufactured by Toronto-based Coinkite, the device has been widely recommended within Bitcoin circles for its air-gapped design, making the compromise a significant blow to confidence in hardware wallet security — a storage method generally regarded as safer than keeping funds on exchanges.

Bloomberg Intelligence senior ETF analyst Eric Balchunas addressed the surge in a post on X (formerly Twitter) on Thursday, noting that while the inflows may not be directly tied to the hack, investors could benefit from delegating custody to established fund managers.

"Who are you gonna trust to not screw up the security of your bitcoin (or get it back if some scumbag does mess with it): a 5-man boutique in Canada or this guy and his 25,000-employee, $15T by-the-book empire?" wrote Balchunas, accompanying the post with an image of BlackRock CEO Larry Fink and criticizing Coldcard's parent company, Coinkite, for its small team size.

who are you gonna trust to not screw up the security of your bitcoin (or get it back if some scumbag does mess with it): a 5-man boutique in Canada or this guy and his 25,000-employee, $15T by-the-book empire? TradFi doesn't seem so lame now after all does it? pic.twitter.com/EHTVeQVcAm
— Eric Balchunas (@EricBalchunas) August 6, 2026

He added: "TradFi doesn't seem so lame now after all does it?"

The juxtaposition underscores a long-running tension in the cryptocurrency community between the principle of self-custody — where users control their own private keys without intermediaries — and the operational safeguards that regulated financial institutions provide through insured custodians and compliance infrastructure.

BlackRock's iShares Bitcoin Trust (IBIT) captured the majority of the new ETF investment. The fund, approved by the U.S. Securities and Exchange Commission in January 2024, recorded the most successful ETF launch in history. The product enables investors who were previously deterred by the complexities of cold storage and private key management to gain Bitcoin price exposure through shares traded on regulated stock exchanges.

Collectively, spot Bitcoin ETFs managed by leading Wall Street firms now hold $77.8 billion in assets, according to Coinglass data.

Since the Coldcard attack began, cautious investors have been relocating their holdings to alternative storage solutions, including cryptocurrency exchanges. The ongoing nature of the drain — with funds being extracted daily — has heightened urgency among hardware wallet users to assess their own security arrangements and prompted renewed scrutiny of firmware auditing practices across the hardware wallet industry.

This article first appeared on Bitcoin Magazine and was written by Mathew Di Salvo.