What to Know

  • BlockTower Capital founder Ari Paul publicly accused Coinbase of losing roughly $25 million of his firm’s assets and concealing hacks totaling more than $1 billion across a dozen institutions.
  • Coinbase has flatly denied the allegations, while Paul has said active litigation prevents him from publishing evidence.
  • The dispute has sharpened a broader question for corporate Bitcoin holders: who can independently verify assets and controls when custody is handled by a single institution.
  • Boards evaluating Bitcoin exposure are asking who can move the asset, who approves transfers and what happens if a key person leaves, is phished or dies.
  • QuadrigaCX’s chief executive died in 2018 while holding the only keys, with roughly $190 million in customer assets affected, as later documented by the Ontario Securities Commission.
  • Prime Trust discovered in December 2021 that it could not open legacy wallets and still could not do so 18 months later when Nevada moved to put it into receivership.
  • A Deloitte survey of 200 CFOs at billion-dollar companies found accounting and controls complexity at 42%, within a point of price volatility, as a barrier to Bitcoin adoption.
  • Jameson Lopp’s public tracker logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year.
  • Coinbase estimated that a customer data breach last year could cost $400 million after criminals bribed support staff and obtained names, addresses and balance information.
  • Some market participants argue that multi-signature custody with independent regulated institutions could reduce reliance on any single person or custodian.

Coinbase Allegations Expose a Verification Problem

The public dispute between BlockTower Capital founder Ari Paul and Coinbase has become more than a fight over one set of allegations. Paul has accused Coinbase of losing roughly $25 million of his firm’s assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase has denied the claims, and Paul has said litigation prevents him from publishing evidence. That leaves the wider market in an uncomfortable position: observers cannot independently determine which account is accurate.

For Bitcoin, that uncertainty is especially damaging because the asset was built around the idea that users should not have to rely solely on trust. Yet when a custodian holds assets behind internal systems, dashboards and legal contracts, outsiders often lack the tools to verify the condition of those assets or the rules governing their movement. The result is a credibility contest, not the transparent settlement layer that many Bitcoin advocates say should distinguish the asset from legacy finance.

For corporate holders, the issue is not only whether one allegation is true or false. The larger concern is whether their own custody arrangements could produce the same blind spot. If a board cannot see who controls Bitcoin, who must approve a withdrawal and whether the asset remains where it is supposed to be, then Bitcoin becomes a governance challenge rather than a straightforward treasury allocation.

Boards Want Bank-Style Controls for a Bearer Asset

Companies are accustomed to bank and brokerage accounts that come with defined users, role-based permissions, approval rules and audit trails. A controller can usually tell an auditor who had authority over an account, when a transfer was requested, who approved it and where the money went. Those controls are familiar, documented and expected.

Bitcoin custody does not automatically provide that structure. In many cases, businesses face a choice between keeping assets through a single exchange login or placing responsibility around hardware wallets and private keys. Both approaches can create operational risks that corporate boards are increasingly unwilling to ignore.

The questions are direct. Who can move the Bitcoin? Who approves that movement? What happens if the person with access resigns, becomes unreachable, is phished or dies? These are not abstract concerns. QuadrigaCX’s chief executive died in 2018 while holding the only keys, and roughly $190 million in customer assets were affected, as the Ontario Securities Commission later documented. Prime Trust discovered in December 2021 that it could not open its own legacy wallets and still could not do so 18 months later when Nevada moved to put it into receivership.

Those examples have become reference points for directors and finance teams reviewing digital asset policies. A company may be willing to tolerate Bitcoin price volatility as an investment risk, but uncertainty around internal controls can be harder to defend. In a Deloitte survey of 200 CFOs at billion-dollar companies, complexity around accounting and controls registered at 42% as a barrier, within a point of price volatility. That suggests the asset itself is not always the hardest part of the decision.

Physical and Digital Threats Are Growing Together

The custody debate is becoming more urgent because the threat environment has widened. Bitcoin is a bearer-style digital asset, meaning control of the relevant credentials can translate directly into control of the funds. That creates risks not only for companies but also for employees, executives and service providers associated with those holdings.

Jameson Lopp’s public tracker logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year. The figures underscore why stolen information about crypto holders can have consequences beyond account security. When criminals know names, addresses and balance information, the risk can move from the screen into the physical world.

Coinbase itself made that risk more visible last year when criminals bribed support staff and stole customer data, including names, addresses and balance information. The company estimated that the breach could cost $400 million. Security researchers described the incident as a wake-up call because exposed account data can increase the risk of coercion against asset holders.

Digital attacks are also becoming more sophisticated. Artificial intelligence has made cloned voices, deceptive messages and tailored social engineering more convincing. Finance teams may face calls that sound like executives, emails that closely resemble internal instructions and phishing campaigns that improve over time. A business that holds Bitcoin through a single point of access may be concentrating those risks on a narrow operational surface.

Why Common Custody Models Leave Gaps

Market participants often describe the current custody landscape as a trade-off between convenience and control. Self-custody can remove reliance on a third-party custodian, but it may concentrate practical responsibility on a small group of people. That creates difficult procedures around hiring, departures, access changes and emergency recovery.

Exchange custody offers simplicity. A company can deal with one counterparty, one contract and one integration. For many finance teams, that is operationally attractive. But it also means the client may hold neither the keys nor a complete independent view of what is happening behind the custodian’s systems.

Audits, trust charters and SOC reports can provide comfort around a custodian’s processes, but they do not necessarily give each client named users, withdrawal approval rules or real-time verification of specific assets. Proof-of-reserves attestations can show a snapshot of assets, but they do not by themselves explain who can move funds tomorrow, what approval process applies or whether a particular client has enforceable operational visibility.

The shutdown of BitMEX after 11 years served as a reminder that crypto institutions can change, close or restructure. Corporate treasury policies are typically designed to survive personnel changes and vendor disruptions. A custody model that depends heavily on one institution therefore invites the same question boards ask in other contexts: what happens if the counterparty fails, disappears or can no longer operate as expected?

Multi-Signature Custody Gains Attention

Some chart watchers and custody specialists point to multi-signature arrangements as a more durable path for corporate Bitcoin holdings. Bitcoin’s protocol can support multiple signatures, allowing funds to be controlled through a structure where no single keyholder can unilaterally move the asset. In a corporate setting, keys can be generated and held by independent regulated institutions, while the company retains legal title and defines approval policies.

In that model, governance can begin to resemble the controls boards already understand. Named users can be assigned roles. Withdrawals can require approvals. Activity can be logged in a way that finance teams and auditors can review. Most importantly, no single person or institution would necessarily have the ability to lose, move or misrepresent the asset alone.

Institutional interest in splitting custody has already appeared at the top of the market. When Morgan Stanley designed custody for its proposed Bitcoin ETF, it named two custodians rather than one. That structure suggests single-custodian dependence has become a live concern for large financial institutions. Still, splitting custody is only part of the answer. The stronger test is whether the owner can verify what it holds without depending entirely on any custodian’s statement.

Bitcoin can make that kind of verification possible, but only if custody systems are designed to use the asset’s transparency rather than recreate traditional opacity. If a company cannot independently validate its position or understand the approval process for moving funds, it remains exposed to the same trust problem that Bitcoin was meant to reduce.

Corporate Adoption Depends on Governance, Not Just Price

Bitcoin’s future on corporate balance sheets will not be determined only by market cycles. Governance may be just as important. Treasury teams and boards need procedures that withstand staff turnover, cyberattacks, legal disputes and custodian failures. They also need to demonstrate to auditors and shareholders that controls are clear, documented and enforceable.

Single-custodian arrangements will likely remain popular because they are convenient. They reduce vendor complexity, simplify contracting and offer familiar account management. But convenience is only persuasive when the simplified system can still be checked. If the trade-off is that the client loses visibility into who controls assets or whether funds are intact, the risk may eventually surface as a board-level disclosure issue.

The Coinbase dispute has therefore become a stress test for the industry’s custody assumptions. Whether the allegations are ultimately proven or rejected, the market has already seen the weakness of a system where outsiders cannot independently settle major questions about client assets. For Bitcoin to move deeper into corporate finance, custody must answer the same questions companies ask about every other financial account, plus one more: what survives the departure or failure of any single person or institution?

Until that answer is clear, some companies may continue to hesitate. Bitcoin can be held on a balance sheet, but the governance framework around that holding must be strong enough for directors, controllers, auditors and risk committees. The next phase of institutional adoption may depend less on access to Bitcoin and more on custody systems that make trust optional, verification practical and single points of failure unacceptable.

Frequently Asked Questions (FAQs)

What are the Coinbase allegations about?

BlockTower Capital founder Ari Paul publicly accused Coinbase of losing roughly $25 million of his firm’s assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase has flatly denied the allegations, and Paul has said active litigation prevents him from publishing evidence.

Why does this matter for corporate Bitcoin adoption?

The dispute highlights a larger governance issue. Companies need to know who controls Bitcoin, who approves transfers and whether assets can be independently verified. Without that visibility, boards may hesitate to approve Bitcoin holdings.

What questions are boards asking about Bitcoin custody?

Boards are asking who can move the asset, who must approve movement, what audit trail exists and what happens if a key person quits, is phished or dies. These questions mirror the controls companies already expect from bank and brokerage accounts.

Why is single-custodian Bitcoin custody controversial?

Single-custodian arrangements are convenient, but they can concentrate trust in one institution. Clients may not hold the keys or have an independent way to verify assets, approval rules and internal controls.

How does self-custody create corporate risk?

Self-custody can reduce reliance on an outside custodian, but it may concentrate operational responsibility on one person or a small group. That creates challenges around employee departures, key management, phishing and emergency access.

What role can multi-signature custody play?

Multi-signature custody can require more than one key to move Bitcoin. For companies, that can allow independent institutions and internal approvers to share control so no single party can unilaterally move or lose the asset.

What did the Deloitte CFO survey show?

A Deloitte survey of 200 CFOs at billion-dollar companies found that accounting and controls complexity was cited at 42% as a barrier to Bitcoin adoption, within a point of price volatility. That suggests governance concerns are nearly as important as market risk for some companies.

Why are physical security risks part of the custody debate?

Bitcoin holders can become physical targets if sensitive information is exposed. Jameson Lopp’s public tracker logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year.

What is the main takeaway for companies holding Bitcoin?

Companies need custody arrangements that clearly show who controls assets, who approves transfers and how holdings can be verified. If those questions cannot be answered, Bitcoin on a balance sheet remains a governance risk as well as a market position.