Quick Summary
A billionaire-adjacent crypto investor says Coinbase lost $25 million of his money and covered up more than $1 billion in hacks across a dozen institutions. Coinbase says it never happened. And here’s the part nobody wants to say out loud: you have absolutely no way to check either of them.
That is not a Coinbase problem. That is the entire custody model, exposed in public, in real time.
What Actually Happened
Ari Paul, founder of BlockTower Capital, went public with an accusation that should have stopped the industry dead: that Coinbase lost roughly $25 million of his firm’s assets and concealed a hacking campaign totaling more than $1 billion spread across a dozen institutions. Coinbase flatly denies it. Paul says active litigation prevents him from publishing his evidence.
So the entire crypto commentariat spent weeks arguing about who is lying. Great. Very productive. Meanwhile the actual story sat there unexamined:
Nobody outside those two parties can verify anything.
Not you. Not the press. Not an auditor. Not a regulator with a spreadsheet. A custodian holding bitcoin for a huge slice of the market stands accused of billion-dollar concealment, and the only tools available for judging the claim are one man’s credibility and one company’s PR department.
This is an industry built on an asset specifically designed so that nobody would ever have to take anyone’s word for anything. And the largest custodian in America has reduced a billion-dollar question to "trust me, bro."
That’s not a scandal. That’s the business model.
The Vault Door Is Closed And You’re Outside It
Think about every other account your money sits in. A corporate bank account has named users. Defined roles. Approval rules on withdrawals. An audit trail a controller can hand to an auditor without breaking a sweat.
Now watch what happens the second a company buys bitcoin. All of that governance evaporates into one of two places: a single exchange login, or a hardware wallet in somebody’s desk drawer.
Boards have started asking the questions they should have asked in 2021. Who can move this asset? Who approves the movement? What happens when the person holding the credentials quits, gets phished, or dies?
We already know the answers, because we’ve watched them play out. QuadrigaCX’s CEO died in 2018 holding the only keys, and roughly $190 million in customer assets went with him into the ground. Prime Trust discovered in December 2021 that it couldn’t open its own legacy wallets. It still couldn’t, eighteen months later. And Mt. Gox creditors are now staring down a repayment deadline pushed to 2027 — a sixth extension, twelve years after the exchange collapsed.
When researchers surveyed billion-dollar companies about what was blocking them from putting bitcoin on the balance sheet, "complexity of accounting and controls" came in at 42% — within a single point of price volatility. The asset was never the hard part. The proving was.
Meanwhile, They Know Exactly Where You Live
The threat landscape is not theoretical anymore, and it’s compounding from both directions.
Jameson Lopp’s attack database now logs more than 360 known physical attacks on bitcoin holders since 2014 — including 86 in 2025 and more than 60 so far this year. Last year, a Coinbase data breach exposed customer names, addresses and balance information. Security researchers called it a wake-up call for the obvious reason: stolen account data turns a digital problem into a man with a wrench at your front door.
On the digital side, AI has industrialized the con. Cloned voices of your CFO on the phone. Phishing emails indistinguishable from the CEO’s. Social engineering that gets better every single month.
Now stack that against a bearer asset held behind one login, by one company, where losses are usually permanent and your only recovery mechanism is a support ticket.
Their Solutions All Do The Same Thing: Concentrate The Risk
Look at what the industry offers you.
Self-custody concentrates risk on one person — which is why corporate self-custody collapses into key ceremonies every time someone is hired or fired, and a controller quietly praying the keyholder never leaves angry. We watched that failure mode up close when a wallet provider generated seed phrases with math.random() and 1,400 wallets got drained.
Exchange custody concentrates risk on one company, where you hold neither keys nor any way to see behind the login. We’ve written about exactly this failure mode before — and it wasn’t hypothetical then either.
Audits, trust charters, SOC reports? They test the custodian’s own books and their own processes. None of them give you named users, approval rules on withdrawals, or a way to confirm the asset is actually there without asking the custodian. Proof-of-reserves attestations — the industry’s favorite half-measure — show a snapshot of assets while saying nothing about who can move what tomorrow.
Morgan Stanley, to its credit, designed custody for its proposed bitcoin ETF around more than one institution. That’s the tell. The people with the most money at stake have already concluded that a single custodian is a live risk.
So What Do You Actually Do About It?
You stop treating verification as somebody else’s job.
Multisig is native to Bitcoin. Keys can be generated and held by independent parties so that no single institution can move or lose the asset. Named users, defined roles, approval policies on every withdrawal, an audit trail a board can actually read. None of that requires permission from Coinbase, BlackRock, or anyone else.
And if you’re an individual, the answer is even simpler and it hasn’t changed in fifteen years: hold your own keys. A hardware wallet, a seed phrase you generated offline, and a backup plan that doesn’t depend on one human being staying alive and honest.
The uncomfortable lesson in the Ari Paul story isn’t that Coinbase is guilty. It’s that you would never know if they were. The same is true of every custodian you’ve ever trusted with a balance sheet entry that said "bitcoin."
You can buy bitcoin with zero counterparty risk on the holding side today. Bull Bitcoin with coupon code LOVEISBITCOIN gets you non-custodial purchases — coins land in your wallet, not on somebody’s IOU ledger. That’s the whole point. Not "we promise we have it." You have it.
The industry is going to spend the next decade rebuilding custody so that no single party can lose, move, or lie about what it holds. You don’t have to wait for them. The protocol already gives you the tools.
FAQ
Did Coinbase actually lose $25 million?
Coinbase denies it. Ari Paul says litigation prevents him from publishing his evidence. That’s the entire public record — which is exactly the problem described above.
Is this a reason to avoid Coinbase entirely?
It’s a reason to understand what you actually own when you "buy bitcoin" on an exchange: a claim on a company, not a coin in a wallet.
What is multisig and why does it matter?
Multiple keys, held by independent parties, all required to move funds. It’s how you get corporate-grade controls on a bearer asset without handing one company total power.
Do I need to be a company to use better custody?
No. A hardware wallet plus an offline-generated seed phrase covers 99% of individual holders. Multisig is the next step up.
Are ETFs safer than exchanges then?
Different wrapper, same dependency. You still don’t hold keys, and you still can’t verify the underlying holdings yourself.
Final Thoughts
The bitcoin world spent years screaming "not your keys, not your coins" at anyone who would listen, and then Wall Street showed up with a nicer interface and everyone forgot the sentence.
Here’s what this story really proves: a custodian can be accused of hiding a billion dollars in losses, deny it, and the market just… moves on — because there is no mechanism to settle the question from the outside. In a system built to eliminate trusted third parties, we rebuilt the trusted third party and gave it a login page.
You can’t audit what you don’t hold. You can’t prove what you can’t see. And you can’t get your coins back from a company that says the coins were never there.
So here’s the question: if Coinbase told you tomorrow that everything was fine, what evidence would you actually have that it is?
COINBASE IS ACCUSED OF HIDING $1 BILLION IN HACKS — AND YOUR ONLY RECOURSE IS TO TAKE THEIR WORD FOR IT
