Demand for US spot Bitcoin exchange-traded funds (ETFs) picked up over the past week, according to Bloomberg ETF analyst Eric Balchunas, with multiple products posting inflows on every trading day since the Coldcard wallet exploit. The timing has sparked fresh discussion about whether some investors are reassessing the risks of self-custody.

Balchunas said that BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity’s Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise’s Bitcoin ETF (BITB), ARK 21Shares’ Bitcoin ETF (ARKB), and Defiance Daily Target 2X Long MSTR ETF (MSBT) all recorded inflows every day since the weekend breach. The combined total was roughly $620 million, aligning with Cointelegraph’s earlier reporting on an ETF inflow streak.

Key takeaways

• Bloomberg’s Eric Balchunas attributes the latest run of daily inflows (about $620 million) to several major spot Bitcoin ETFs starting after the Coldcard exploit.
• TRM Labs estimates the Coldcard attack drained more than $116 million in Bitcoin from over 5,200 wallet addresses.
• Balchunas cautioned that a direct connection between the hack and ETF buying is unproven, but acknowledged some investors may be shifting toward regulated custody.
• Industry figures including Binance co-founder Changpeng Zhao argued that, based on available data, exchange custody may be “statistically safer” than self-custody—though underreporting remains a concern.
• Broader security debates are intensifying as AI-assisted exploits accelerate the pace at which vulnerabilities are identified and attacked.

Spot Bitcoin ETFs see daily inflow streak after Coldcard exploit

In his update shared on X, Balchunas highlighted a multi-day pattern of inflows across several leading spot Bitcoin ETFs. The list included large, established issuers (including BlackRock and Fidelity) as well as other active fund providers. Per Balchunas, inflows have continued every trading day since the weekend of the Coldcard exploit, with the group’s cumulative figure landing at roughly $620 million.

Cointelegraph previously reported on the continuation of a Bitcoin ETF inflow streak, noting that the latest totals were consistent with that trend. Together, the data suggest that recent capital flows have been persistent rather than limited to a single “reaction” day after the incident.

Still, Balchunas explicitly framed the connection as speculative. “I’m not saying it’s connected, we just don’t know,” he wrote, while adding that over the long term he can’t imagine there aren’t investors who choose to migrate away from self-custody after incidents like this.

Coldcard hack highlights exposure even for hardware wallet users

The renewed self-custody debate traces back to the Coldcard wallet exploit. Cointelegraph reported that the incident involved an attack against the Coldcard ecosystem, draining more than $116 million worth of Bitcoin from over 5,200 wallet addresses, according to blockchain intelligence firm TRM Labs.

For many participants in the market, hardware wallets are viewed as a last line of defense—designed to keep private keys offline and reduce the risk of direct theft through compromised online environments. However, the Coldcard incident underscored that end-to-end security still depends on firmware integrity and operational handling, and that even users of advanced self-custody tools may be vulnerable if software components are compromised.

Self-custody vs regulated custody: CZ’s “statistically safer” argument

The Coldcard hack fed into a longer-running argument about the relative risks of self-custody and centralized exchange (CEX) custody. Binance co-founder Changpeng “CZ” Zhao weighed in, suggesting that storing crypto on centralized exchanges could now be “statistically safer” than self-custody.

Zhao pointed to analysis by Willy Woo, claiming that cumulative Bitcoin losses from self-custody incidents have surpassed losses from exchange hacks. In his X post, Zhao also argued that differences in reporting make direct comparisons difficult: “Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported.”

That framing matters for investors because it shifts the conversation from a purely technical question (“Which custody model is more secure?”) to an evidentiary one (“Which system’s failures are more visible and therefore easier to measure?”). Until self-custody incidents are tracked with the same completeness as major exchange events, any conclusion about relative safety remains inherently asymmetric.

Security pressure is mounting as AI-assisted attacks evolve

Beyond the Coldcard case, the broader cyber threat landscape is intensifying. Cointelegraph earlier reported that on Monday, Bitcoin swap service Boltz suspended its non-custodial bridge after citing a steady rise in AI-assisted exploits. The service said attackers were using artificial intelligence to identify and exploit vulnerabilities faster than its team could patch them.

While that suspension does not confirm a direct link to the Coldcard incident, it reinforces a common theme across current security discussions: defenders face a faster and more adaptive attack cycle. For ordinary users, this can translate into a growing sense that the gap between “known risks” and “unknown vulnerabilities” is narrowing.

For ETF investors, the implication is more indirect but still important. Regulated investment products typically centralize custody with institutional providers and established operational controls, meaning some risks are moved away from individual users and into broader compliance and security frameworks. Whether that results in higher safety in practice is difficult to quantify, but the market’s recent capital flows suggest that at least some investors are paying close attention to custody trade-offs after high-profile self-custody failures.

Going forward, readers should watch whether the daily inflow pattern persists beyond the immediate post-incident window, and whether additional analysis clarifies how (or if) the Coldcard exploit influenced investor behavior. The key open question is whether the ETF buying reflects a short-term narrative shift or a longer-term reallocation toward regulated custody.

Demand for US spot Bitcoin exchange-traded funds (ETFs) has accelerated over the past week, with a string of daily inflows coinciding with the Coldcard wallet hack — timing that has prompted speculation about whether some investors are reconsidering self-custody.

According to Bloomberg senior ETF analyst Eric Balchunas, BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), ARK 21Shares Bitcoin ETF (ARKB) as well as Defiance Daily Target 2X Long MSTR ETF (MSBT) have recorded inflows every trading day since the weekend exploit, totaling roughly $620 million. The cumulative figure is consistent with Cointelegraph’s recent reporting on the ETF inflow streak.

The Coldcard exploit drained more than $116 million worth of Bitcoin from over 5,200 wallet addresses, according to blockchain intelligence firm TRM Labs.

“I’m not saying it’s connected, we just don’t know,” Balchunas said in a post on X. “[Although]  long-term I can’t imagine there aren’t some who migrate over.”

Source: Eric Balchunas

Related: Bitcoin Red Team reports 5K findings in sweeping security audit

Coldcard exploit renews debate over self-custody risks

The Coldcard hack renewed concerns that even hardware wallet users can be exposed to firmware flaws and software vulnerabilities, highlighting the operational risks that come with self-custody.

The incident also reignited debate over the trade-offs between holding Bitcoin directly and gaining exposure through regulated investment products such as spot Bitcoin ETFs, where asset custody and security are handled by institutional providers.

Binance co-founder Changpeng “CZ” Zhao also weighed in on the debate, arguing that storing crypto on centralized exchanges may now be “statistically safer” than self-custody, citing data from analyst Willy Woo that cumulative Bitcoin losses from self-custody incidents have surpassed those from exchange hacks.

Source: Changpeng Zhao

“Hack data is easier to collect on the CEX side, usually major news. It is harder on the self-custody side, where hacks, lost coins, etc are often not reported,” CZ said.

The debate comes as AI-assisted cyberattacks are becoming increasingly sophisticated. On Monday, Bitcoin swap service Boltz suspended its non-custodial bridge, citing a steady rise in AI-assisted exploits that were allowing attackers to identify and exploit vulnerabilities faster than its team could patch them.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?

This morning, Jefferies slashed its price target on SanDisk stock 42% from $3,000 to $1,750. ZeroHedge laughed out loud at the drastic action.

Just six weeks ago, on June 26, analysts at the investment bank had set their $3,000 price target. Nonetheless, SanDisk stock price is down, even after the AI chipmaker reported the best quarterly earnings in its history yesterday.

Its most recent quarterly revenue was a 372% year-over-year gain to $8.97 billion, far surpassing its own guidance range of $7.75-8.25 billion. 

Non-GAAP gross margin landed at 84.6%, dwarfing the prior year’s 26.4% and beating its guidance range of 79-81%. Non-GAAP earnings of $39.25 per share beat a FactSet consensus of analysts’ estimates by more than 12%.

Numbers from the blockbuster quarter were invariably positive. Data center revenue, the business SanDisk spent a year building, grew 103% in a single quarter to $2.98 billion.

Chairman and CEO David Goeckeler told analysts the company “delivered record revenue, gross margin, and earnings per share, each above the high end of our guidance, and repurchased $4.5 billion of company stock.”

Then, the board authorized another $14 billion of share buybacks.

SanDisk has lost a quarter of its value in a month

Despite these celebratory figures, SanDisk’s stock has crashed by 25% over the past month.

Analysts cut estimates. Susquehanna reduced 6%; Evercore trimmed to $2,800 from $3,100; Citi dropped from $2,500 to $2,100; Jefferies cut 42%, the deepest of them all.

Bitcoin miners are increasingly positioning themselves as AI and high-performance computing (HPC) infrastructure providers, reshaping revenue models around hosting demand rather than solely on mining economics. But a new industry analysis suggests that the market’s excitement for fresh AI-capacity announcements has cooled—meaning new deals may be generating less immediate upside for stocks than they did in earlier waves of adoption.

According to an analysis by Blocksbridge Consulting, published in TheEnergyMag’s Miner Weekly, the impact of AI infrastructure deal news has weakened over the past two years. The report examined 25 AI and HPC infrastructure deals announced between June 2024 and August 2026, finding a clear decline in how much investors moved the day a deal was announced.

Key takeaways

• Blocksbridge Consulting reports the average announcement-day stock move for AI and HPC infrastructure deals fell from about 24% in the earliest cohort to roughly 10% in the most recent cohort.
• Median gains from these announcements dropped by about half over the same period, even as deal sizes and contract values increased.
• Revenue per contracted megawatt has edged higher over time, indicating AI hosting is becoming more lucrative, but the market is less impressed by headline contract totals.
• Examples of early CoreWeave-related deals triggered large one-day stock surges, while later “mega-deals” produced smaller or short-lived price reactions.
• TheEnergyMag’s TEM AI Infrastructure Growth Index is down about 28.5% from its June peak, aligning with a broader pullback in AI infrastructure-linked equities.

AI hosting deals are bigger, but the stock reaction is smaller

Blocksbridge Consulting’s review points to a market that is still allocating capital to AI infrastructure—but in a more selective way. While the report shows that revenue annualized per contracted megawatt has generally improved as time has passed, the way investors respond to deal announcements has changed.

The most striking trend is how much less “market-moving” announcements have become. Blocksbridge’s dataset shows the average announcement-day move falling steadily from around a mid-20% figure for earlier deals to near 10% for the latest. Median gains roughly halved as well, suggesting the market’s expectations have matured: investors may be focusing less on the fact that a deal exists and more on whether a company can reliably execute and monetize it.

The report also frames this as a shift away from reacting primarily to contract headlines toward questions like financing structure, execution capability, and long-term profitability—factors that can determine whether AI hosting becomes durable earnings rather than a one-off boost.

From blockbuster reactions to muted follow-through

Deal-by-deal reactions illustrate the pattern. In earlier examples, markets appeared to reward companies far more aggressively for landing AI hosting arrangements. Core Scientific’s initial hosting agreement with CoreWeave reportedly sent its shares up more than 40%. Applied Digital’s first CoreWeave lease gained nearly 49%, while TeraWulf’s first Fluidstack deal surged almost 60%.

More recent announcements, by contrast, have tended to generate smaller immediate moves—sometimes followed by fading gains. TeraWulf’s 401-megawatt lease with Anthropic lifted its shares by about 5%. CleanSpark’s $6.6 billion AI hosting agreement gained nearly 9%. Bitdeer’s new Tydal contract reportedly pushed its stock up roughly 12% at one point, but those gains disappeared by the close.

For investors, this difference matters because it can signal a reduced probability that “new capacity” news automatically translates into near-term outperformance. If the market expects more deals to follow—and has already priced in a portion of AI hosting growth—then additional announcements may only narrow the gap between winners and laggards rather than create fresh upside broadly.

Bitcoin miners’ AI pivot meets a more cautious equity market

The muted deal reaction trend also shows up in broader performance among AI-leaning miners and infrastructure operators. TheEnergyMag’s TEM AI Infrastructure Growth Index, which tracks publicly traded companies building AI data center and digital infrastructure businesses, is down roughly 28.5% from its June peak. That decline suggests investor caution has risen even while underlying demand for AI infrastructure has remained strong.

Notably, TheEnergyMag’s index is still higher over the past year, but its momentum appears to have slowed in recent months. This is consistent with the idea that the market may be rebalancing: investors may believe in the long-term direction of AI infrastructure, yet be less willing to pay large premiums for announcements until execution risk, customer retention, and the path to sustained margins become clearer.

The report’s slowdown narrative aligns with a wider pullback in related equities. The Philadelphia Semiconductor Index reportedly fell nearly 17% from its July peak, reinforcing the sense that risk appetite across technology-linked sectors has cooled rather than AI demand disappearing overnight.

What investors should watch next

As AI hosting arrangements become more commonplace, the key question is likely to shift from “who lands the next contract?” to “who converts contracted megawatts into dependable, financed, and profitable operations.” Readers should watch for evidence that revenue per contracted megawatt keeps rising, while companies demonstrate execution—especially in financing structures and long-term profitability—so markets have less reason to fade gains after major announcements.

MyTrade founder Liu Zhou was fined $10,000 after admitting that his crypto market-making platform used bots to conduct wash trades for dozens of tokens.

MyTrade founder receives $10,000 fine

A federal court in Boston ordered Liu Zhou, the founder and primary operator of crypto market maker MyTrade, to pay a $10,000 fine for his role in a market-manipulation conspiracy.

U.S. District Judge Angel Kelley imposed the sentence, according to the Department of Justice. Zhou, 41, is a Canadian citizen and Chinese national.

Federal prosecutors charged Zhou alongside 17 alleged co-conspirators in October 2024. He pleaded guilty to conspiracy to commit market manipulation and wire fraud.

MyTrade provided market-making services through its MyTrade MM website and application. Its products included a feature called “Volume Support,” which allowed crypto projects to select how much artificial daily trading activity they wanted across specified exchanges.

The platform then used automated bots to repeatedly buy and sell the same cryptocurrencies. Those transactions created the appearance of greater trading volume and market interest without serving a legitimate commercial purpose.

FBI token exposed MyTrade’s wash-trading service

U.S. authorities identified the scheme through an undercover operation involving NexFundAI, a fake crypto company created by law enforcement.

Investigators launched a website and an Ethereum-based NexFundAI token, which traded on the decentralized exchange Uniswap before authorities disabled it. Undercover agents approached market makers while posing as the project’s promoters.

During discussions with the purported NexFundAI team, Zhou explained that MyTrade conducted simultaneous purchases and sales of the same asset.

“MyTrade MM does self-trades — a buy and a sell in the same second,” Zhou said, according to prosecutors.

He also said the company’s volume bot could execute “pump and dumps.” In another statement cited by the DOJ, Zhou said the objective was to attract outside buyers because “we have to make [the other buyers] lose money in order to make profit.”

MyTrade was still providing its Volume Support service to dozens of clients as of Oct. 1, 2024, the DOJ said.

Bots supported about 60 cryptocurrencies

As part of Zhou’s guilty plea, MyTrade agreed to stop offering Volume Support and permanently deactivate the bots used to create the artificial transactions.

Prosecutors said the bots had generated millions of dollars in daily wash trades involving approximately 60 cryptocurrencies. The firm was also required to publish a notice on its website acknowledging the legal status of the service.

“Volume support is a form of wash trading and illegal under the laws of the United States,” the required notice states.

The U.S. Attorney’s Office for the District of Massachusetts prosecuted the case with assistance from the FBI’s Boston Division.

The sentence adds to U.S. authorities’ wider enforcement effort against misleading conduct in crypto and event-contract markets. In July, former U.S. Representative George Santos settled a Commodity Futures Trading Commission case involving trades on prediction market Kalshi.

Santos agreed to return $17,569.98 in gains, pay a $17,500 penalty and accept a three-year ban from trading on CFTC-registered platforms. The CFTC accused him of making misleading public statements while betting on whether he would attend President Donald Trump’s State of the Union address. He neither admitted nor denied the findings.

Crypto manipulation faces wider regulatory scrutiny

Market-manipulation investigations are also increasing outside the United States. South Korean authorities examined more than 40 suspected unfair-trading cases during the first two years of the country’s Virtual Asset User Protection Act.

Regulators reported or referred more than 30 cases to investigative agencies and identified 25 suspects. Average alleged unlawful gains reached about 1.4 billion won, or roughly $940,000, per case.

For U.S. crypto projects, Zhou’s case shows that describing artificial activity as market making or volume support does not shield wash trading from fraud charges. The undercover token operation also shows that federal investigators can participate directly in digital-asset markets to identify suspected misconduct.

Bitcoin spent the Thursday Wall Street open hovering just above the $64,000 area, trapped in a narrow range as traders digested fresh macro signals pointing to renewed inflation pressure and weaker labour conditions. At the same time, market hopes around energy logistics in the Middle East cooled after Iranian officials played down assumptions that the Strait of Hormuz would quickly reopen.

The result for BTC has been a familiar kind of indecision: despite cross-asset movements elsewhere—such as gold firming and equities printing record highs—crypto has not delivered the decisive breakdown or breakout many analysts were waiting for. Instead, several monitoring desks described the current action as more “stalled” than truly capitulative.

Key takeaways

• BTC remained below $65,000 near the US open, down roughly 0.5% on the day, as geopolitical expectations around the Strait of Hormuz eased.
• US services PMI and employment data point to “stagflation” risk, with prices paid rising while employment conditions deteriorate.
• Glassnode characterised the current market as “boredom rather than capitulation,” suggesting conditions may be building for a turn but are not complete.
• Bitfinex Research argued that a “genuine breakdown” has not yet appeared, because a stronger macro trigger and volume-supported follow-through are still missing.

Iran’s caution blunts Strait of Hormuz rebound hopes

On the charts, BTC/USD hovered above $64,000 during the Wall Street open, with TradingView data showing the pair down about 0.5% at that point. US stock indices also opened roughly flat, indicating that broader risk appetite was not sharply moving on the day’s developments.

A key narrative for commodity traders—whether the Strait of Hormuz would reopen—failed to translate into meaningful volatility for Bitcoin. Anticipation had centred on a reported Iran–Oman understanding that could resume the route for international shipping, but Iran’s messaging introduced uncertainty about how quickly or fully any reopening could occur.

In comments carried by CNN, Iran’s Deputy Foreign Minister Kazem Gharibabadi said: “This understanding does not, in itself, mean that the Strait of Hormuz will reopen,” as quoted by the state-run Islamic Republic News Agency (IRNA). That clarification matters because energy-route risk is one of the channels that can feed into inflation expectations—an issue now resonating through the US macro data backdrop.

Oil was broadly steady as these geopolitical signals played out. WTI crude was little changed at around $76 per barrel, after dipping to three-week lows of about $74.30 the day before. Even with the energy market not collapsing, the lack of escalation suggested traders weren’t receiving a strong impetus to reprice macro risk aggressively at the open.

US services data revive stagflation fears

While the Middle East headlines failed to generate a clear impulse, the economic calendar offered a more direct storyline. Trading resource The Kobeissi Letter pointed to the latest US Institute for Supply Management (ISM) Services PMI and employment data released on Wednesday.

According to the figures highlighted by Kobeissi, July’s services PMI rose by 0.1 point to 54.1, while employment fell by 3.6 points to 47.4—the lowest reading since March. The divergence between output sentiment and labour conditions was paired with a notable jump in the prices paid index: +2.6 points to 70.3, near its highest level since October 2022.

Kobeissi also contextualised the inflation signal, noting that prices paid has trended higher for more than two years and is up about 16.9 points since March 2024. The central interpretation was that “the economy is increasingly under pressure from both rising prices and a weakening labor market,” and that the odds of stagflation were therefore “intensifying” based on the combined readings. The post was shared on X, where the same analyst discussed the data and its implications.

For crypto investors, this matters because a stagflation-style regime—where prices remain elevated while growth or hiring weakens—can complicate the usual interest-rate narrative and heighten uncertainty in liquidity conditions. Bitcoin’s role as a “macro proxy” is often debated, but when rates expectations and risk premiums shift, BTC frequently feels the drag even if inflation prints don’t immediately produce a clear direction for the asset.

Bitcoin shows “boredom,” not capitulation

Despite the macro noise, onchain and market analytics suggested the current BTC range has the characteristics of a pause rather than a flush. Glassnode described BTC/USD as showing “boredom rather than capitulation,” framing the lack of sustained downside momentum as an incomplete stress signal.

Glassnode’s commentary, shared in an analysis posted on X, also highlighted that BTC has been largely unresponsive while gold hit its highest level in six weeks and the S&P 500 moved to all-time highs. That combination—traditional safe-haven strength alongside continued equity confidence—can leave risk assets without a single, clean macro “directional” impulse, encouraging consolidation rather than trend.

In its one-line summary, Glassnode characterised the market regime as “a compressed, under-owned market that global risk appetite has left behind,” adding that “bottom conditions assembling but incomplete.” The distinction is important: it implies that bearish conditions may be developing, but the market still lacks the final ingredient that would typically mark a decisive turning point.

This view sits alongside earlier comparisons that Cointelegraph had reported, where bear-market patterns were being examined for potential similarities in 2026. Those earlier reports focused on history repeating through gradual support erosion before a larger macro floor is reached. Glassnode’s “incomplete” framing, however, suggests the move many traders expect hasn’t fully played out yet.

Bitfinex: a true breakdown needs more force and volume

Bitfinex Research, the analytics arm of the Bitfinex exchange, echoed the idea that BTC has not yet offered the kind of breakdown confirmation traders associate with a decisive regime shift. In an update posted on the Bitfinex blog on Wednesday, it argued that while macro developments and Bitcoin’s underperformance versus the Nasdaq and S&P 500 point to underlying stress, the market still does not show what it called a “genuine breakdown.”

The analyst wrote that a true breakdown requires “something more forceful, followed by volume-supportive price action.” Put differently: without a stronger macro trigger and the type of follow-through that typically comes with rising participation on declines, the current range may continue to act like a holding pattern rather than a distribution event.

This is consistent with the day’s price behaviour, where BTC stayed confined and did not accelerate lower even as traders tracked inflation-and-labour signals and waited for additional geopolitical clarity. If the market is indeed under-owned and compressed, it may be positioned to move quickly once a trigger arrives—but until then, signals can remain fragmented across asset classes.

For traders and investors, the immediate watchpoints are therefore twofold: whether new macro data meaningfully worsen the inflation-growth tension, and whether BTC finally transitions from consolidation into a directional move with clear confirmation. As of the Wall Street open, both Bitfinex’s “more forceful” requirement and Glassnode’s “incomplete” bottom conditions were still not satisfied.

Going forward, the key question is whether the stagflation narrative gains stronger traction through subsequent data releases, and whether BTC’s range eventually resolves with volume and follow-through—either signaling a durable breakdown or forcing the market to reprice risk back upward.