Investors pulled $8.26 billion out of US spot Bitcoin ETFs across eight straight weeks through the start of July, and the funds barely recovered any of it over the rest of the month.
That has changed in the first week of August, as the funds took in $853.54 million and posted their best week since April. However, four days before that run started, hackers drained thousands of self-custody wallets in the Coldcard exploit.
So did frightened Bitcoin (CRYPTO:BTC) holders move their coins into ETFs, or is something else going on?
Bitcoin ETFs Just Had Their Best Week Since April
Investors pulled $4.51 billion out of spot Bitcoin ETFs in June, the worst month of the year, and that capped a selling run that had started back in mid-May. Buying returned in July but barely, with the funds taking in $172.43 million across the whole month, which is what a single quiet week used to bring in.
The funds then took in $853.54 million in the week ending August 7, with every one of the five sessions positive. That is five times what arrived across all of July, in five trading days.
The funds last had a bigger week on April 17, when they took in $996.38 million. Only one week since has even topped $800 million.
But $853.54 million only recovers about a tenth of the $8.26 billion that left over those eight weeks. The funds hold $79.50 billion in net assets today, which is about 6.10% of Bitcoin’s market value.
Why Analysts Point at the Coldcard Hack
The Coldcard exploit started on July 30, when attackers began draining wallets whose seed phrases the device had generated weakly. TRM Labs counted more than $116 million taken from over 5,200 addresses, while Galaxy Research has confirmed over $100 million across roughly 7,300 addresses and suspects the real total is closer to $130 million across more than 7,700. That makes it the third-largest crypto theft of 2026.
Eric Balchunas, senior ETF analyst at Bloomberg Intelligence, made the case for ETFs on August 2, before any of the week’s money had moved. He wrote that an ETF fixes this, and that it was ironic given how many cold storage holders dismiss the funds as paper bitcoin.
His argument is that an ETF removes the risk that drained those wallets.Coldcard owners lost their coins because the device generated weak seed phrases, and an ETF holder never touches a seed phrase, since a custodian holds the Bitcoin and the investor holds shares. Institutional custody has been treated as crypto’s weak point for years, and it starts looking like a feature when the alternative is trusting firmware you cannot inspect.
Investors put almost all of it into the two biggest funds. IBIT took $693.7 million across the week, which is more than 80% of everything that went into Bitcoin ETFs, and on August 7 it took $86.71 million while FBTC added $40.95 million. VanEck’s HODL lost $10.55 million that same day and Invesco’s BTCO gave up $19.37 million, so investors were picking the two largest funds and leaving the smaller ones alone.
Meanwhile, coins have been moving out of private wallets. Long-term holders shifted roughly 210,000 BTC in the week after the exploit, and net transfers from private wallets to exchanges have been positive every day since July 31. That reverses a two-year trend running back to the FTX collapse, when holders were pulling coins off exchanges and into their own custody instead.
Bitcoin ETF Inflows Started Days Before the Jobs Report
The July jobs report came out on Friday, August 7, and payrolls fell by 23,000 when economists had expected a gain of around 80,000, with June’s figure also revised down to 20,000.
Weak jobs numbers make another rate hike hard to justify, and lower rates push investors toward riskier assets like Bitcoin. Traders cut the odds of a September hike from roughly 55% to 46%, and Bitcoin pushed through $65,000 to touch $65,340 and finish the week up around 3%.
But investors bought most of their ETF shares before any of that happened. They started on Monday, August 3, and by Friday morning $754.69 million of the week’s $853.54 million was already in, which is 88% of the total.
Wednesday, August 5 was the biggest day of the week, which is two days before the jobs numbers came out. The smallest inflow came on Friday, the day Bitcoin rallied, at $98.85 million. So the jobs report explains Friday’s rally, not the $754.69 million that went in before it, and the only thing that happened ahead of that buying was the Coldcard hack..
So Did the Coldcard Hack Move the Money Into Bitcoin ETFs?
The hack is the best explanation available, mostly because nothing else fits what ahppened. The buying started three days after the exploit, and it went almost entirely into the two biggest funds. And it was largely done before the only macro event of the week.
But the theory has holes. Ethereum ETFs took in $49.6 million on August 7 and had four straight days of inflows over the same stretch, which should not happen if this were Bitcoin holders running from hardware wallets. Nobody has traced a drained wallet into a fund either, and QCP Capital said the breach caused only limited concern in options markets.
What helps the theory most is the rotation. Ethereum ETFs out-raised Bitcoin ETFs for three straight weeks before the exploit, taking $103.9 million against Bitcoin’s $33.79 million in the week of July 20, then gaining money in the last week of July while Bitcoin funds lost $61.53 million. That changed in the week after the hack, and Coldcard is a Bitcoin-only wallet.
The next few weeks could settle it. If Bitcoin ETFs keep pulling in more than Ethereum’s through late August, when the hack is no longer news, then the custody argument holds. If Ethereum goes back to out-raising Bitcoin, then this was a macro week that happened to follow a hack.
Contact [email protected] for any questions or corrections.