Bitcoin ETF inflows rise as Coldcard flaw puts custody choices in focus
U.S. spot Bitcoin ETFs reported $381.5 million in two days of inflows as Coldcard users face a seed-migration warning.
By Sofia Marchetti · Columnist
· 3 min read
Bitcoin ETF inflows totaled a reported $381.5 million across Monday and Tuesday, while a security warning from hardware-wallet maker Coinkite renewed attention on how investors hold Bitcoin. The timing has fueled a custody debate, though the available data does not show that the Coldcard incident caused the fund flows.
U.S.-listed spot Bitcoin ETFs posted reported net inflows of $170 million on Monday and $211.5 million on Tuesday, according to SoSoValue figures cited by Cointelegraph. For investors, the figures show fresh money entering funds that offer Bitcoin price exposure through a brokerage account, rather than direct control of the underlying Bitcoin.
BlackRock's iShares Bitcoin Trust, or IBIT, led the reported activity, with $111 million on Monday and $170 million on Tuesday, according to Farside Investors data cited by Cointelegraph. Fidelity's Wise Origin Bitcoin Fund, or FBTC, added about $33 million and $20 million on those respective days. The Invesco Galaxy Bitcoin ETF, BTCO, recorded $6.7 million on Monday, its first reported positive daily flow since July 1.
What does the Coldcard advisory mean for Bitcoin holders?
Coinkite said that some wallet seeds, the cryptographic data generated by a device to secure a wallet, may be at risk because affected Coldcard software produced less randomness than intended. Its August 1 advisory covers seeds created on Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, as well as seeds generated on specified pre-fix releases for Mk4, Mk5 and Q models.
For affected Mk4, Mk5 and Q seeds, Coinkite said the software provided about 72 bits of entropy, a measure of randomness, rather than the expected 128 bits. The company said fixed firmware is available, but installing it does not repair a seed created under vulnerable software. Its stated remedy is to install the relevant fixed release before creating a replacement seed, then migrate funds to that new seed.
The advisory includes important exceptions. Coinkite said seeds created using at least 50 independent, private dice rolls are not considered at risk from this random-number-generation issue alone. A strong, unique BIP-39 passphrase provides an additional barrier, Coinkite said, but it still urged passphrase users to migrate as soon as practical. Coinkite's advisory lists the affected models, releases and migration steps.
Could the Coldcard incident be driving Bitcoin ETF inflows?
That conclusion remains unproven. Bloomberg Intelligence ETF analyst Eric Balchunas said the episode could make the institutional custody used by ETFs look more appealing, according to Cointelegraph. An ETF removes the need for a shareholder to manage wallet software and related credentials, but the shareholder holds fund shares rather than directly self-custodying Bitcoin.
The scope of the thefts should also be treated cautiously. CoinDesk reported nearly 600 Bitcoin, worth about $38 million, had been stolen as of July 31. Cointelegraph later cited Galaxy Research's estimate that as many as 7,300 addresses may have been affected and suspected losses could reach about $130 million. Those estimates differ across reports and dates, and the available reporting does not provide a method that reconciles them.
The immediate facts are clearer than the market narrative: ETFs logged reported inflows, and Coinkite has told users with potentially affected seeds to create new ones and migrate funds. Whether the security event changes longer-term investor custody preferences will require more than two days of flow data to establish.
This story draws on original reporting from Cointelegraph.
