Two currents are pulling money into Bitcoin at the same moment, and both point the same way. Spot Bitcoin ETFs have logged three straight days of inflows worth roughly $626 million, while on-chain “whales” have quietly added close to 190,000 BTC since December. Sitting on top of it all is the Coldcard hardware wallet hack — a self-custody failure that has reopened one of crypto’s oldest arguments about where, exactly, it is safest to keep your coins.
US-listed spot Bitcoin ETFs pulled in $244.4 million on Wednesday, their third straight day of net inflows, according to data tracked by SoSoValue. BlackRock’s iShares Bitcoin Trust (IBIT) did most of the heavy lifting, drawing about $479 million over the three sessions and lifting its cumulative net inflows to nearly $61 billion, per Farside Investors. Bitcoin briefly pushed above $64,920 on Wednesday as the money flowed in — a marked change of pace after a weak, largely flat July.
The bigger bid: whales started before Wall Street
Zoom out from the ETF desks and the accumulation looks broader — and older — than the hack. Bitcoin whales, excluding exchange and mining-pool wallets, have lifted their collective holdings from about 2.87 million BTC in December 2025 to roughly 3.06 million BTC, an increase of nearly 190,000 BTC, according to CryptoQuant’s latest Smart Money report. The pace picked up after Bitcoin slid below $60,000 in June, with large wallets absorbing supply as smaller retail balances shrank.
The timing matters. Santiment data show the 1,000–10,000 BTC cohort began adding in the last week of July — lifting its share of supply before the ETF inflow streak began and before the Coldcard thefts escalated over the weekend. More recent tracking has larger wallets adding roughly 19,610 BTC even as small holders trimmed exposure, the classic pattern of coins moving from weaker to stronger hands. CryptoQuant frames the behavior as accumulation into a possible late-stage bear-market bottom, while cautioning that it is not yet proof of a reversal.
That broader bid helped power Bitcoin’s rebound from about $62,500 on August 3 to nearly $64,800 by August 5, with the ETF inflows layering on top of on-chain demand that was already building.
A debate the hack reopened
The custody question hanging over all of this comes from the Coldcard exploit. The attack began around July 30, when hackers started draining Bitcoin from Coldcard wallets by exploiting a March 2021 firmware bug that weakened the randomness of some wallet seeds — in the worst cases cutting effective key strength low enough to brute-force without malware, phishing or physical access to the device. Maker Coinkite has since shipped fixed firmware, but a patch does not repair a seed already generated on the vulnerable build.
Loss estimates vary as the thefts unfold in waves. Galaxy Research has tracked roughly 1,367 BTC, about $89 million across more than 4,500 addresses, while TRM Labs and Elliptic have placed the total higher, at around $116 million to $130 million across 5,000-plus addresses. On-chain analysts have flagged the possibility of more than a dozen separate attackers.
For an asset class built on the promise of “hold your own keys,” a flaw that emptied wallets owners believed were untouchable has handed regulated products an unexpected talking point. Cantor and FRNT Financial both told CoinDesk this week that the exploit could bolster demand for spot Bitcoin ETFs as some investors look for alternatives to managing their own keys — though both cautioned that the likelier long-run outcome is adaptation, with wallet makers hardening security, rather than a wholesale flight from self-custody.
“TradFi doesn’t seem so lame now”
Few have pressed the point harder than Bloomberg ETF analyst Eric Balchunas, who tallied the inflow streak at around $620 million across IBIT, Fidelity’s FBTC, Bitwise’s BITB, ARK 21Shares’ ARKB and MSBT and used it to needle Bitcoin’s self-custody purists. He stopped short of claiming the flows and the hack were connected — “we just don’t know,” he wrote — but framed the choice starkly: trust a small hardware-wallet maker in Canada, or, gesturing at BlackRock chief Larry Fink, a roughly 25,000-employee, $15 trillion asset manager. “TradFi doesn’t seem so lame now after all does it?”
Anticipating the “selling out” charge, Balchunas argued that ETFs “are not The Man” — low-margin products Wall Street would arguably rather do without — and that using one “is not selling out.” He did concede the limits of the case: for anyone who wants to actually transact in Bitcoin, or use it to escape a country or censorship, an ETF is useless, and he said it is important that Bitcoin stay usable that way. For plain long-term investing, though, he said he is hard-pressed to recommend anything else.
The correlation is real, but so is the counter-case. Flows were always likely to rebound from a soft July regardless of the hack, and three days is a thin sample; a reversal to outflows from any of the majors would flip the story fast. What is clear is that the market’s largest, longest-term holders have been leaning in through Bitcoin’s cruelest seasonal month — and the Coldcard episode has given the custody debate its sharpest framing in years.
Also Read: Coldcard Theft Sets Off 119K Dormant Bitcoin Migration
