The Coinbase allegations expose Bitcoin's corporate governance gap

BlockTower Capital founder Ari Paul publicly accused Coinbase of losing roughly $25 million of his firm's assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase flatly denies it, Paul says active litigation prevents him from publishing his evidence, and the industry has spent the weeks since arguing about who is telling the truth.

The argument misses the most uncomfortable fact in the story: nobody outside the two parties involved can check. That is a strange place to land for an industry built on an asset designed so that no one would have to take anyone's word for anything. A custodian holding assets for much of the market stands accused of billion-dollar concealment, and the only tools available for evaluating the claim are the accuser's credibility and the custodian's word. The lesson for every company holding bitcoin, or deciding whether to, is that bitcoin on a balance sheet presents a controls problem, and until a custody arrangement can answer the same questions a board asks about the company’s bank and brokerage accounts, who can move the money and who signs off, stories like this one will stay unanswerable.

Every other account a company touches comes with governance as a default. A corporate bank account has named users, defined roles, approval rules on withdrawals and an audit trail that a controller can hand to an auditor. A brokerage account has the same. The moment a business buys bitcoin, all of that disappears into one of two places: a single exchange login or a hardware wallet in somebody's drawer.

Boards have noticed, and they’re asking questions. Who can move the asset? Who approves the movement? What happens when the person holding the credentials quits, gets phished, or dies? These are not hypotheticals. QuadrigaCX’s chief executive died in 2018, holding the only keys, and roughly $190 million in customer assets went with him, as the Ontario Securities Commission later documented. Prime Trust discovered in December 2021 that it could not open its own legacy wallets, and still could not 18 months later when Nevada moved to put it into receivership. Across most of the industry, the honest answer to all these questions is a shrug. Companies that wanted bitcoin on the balance sheet have walked away at exactly this point. When Deloitte asked 200 CFOs at billion-dollar companies what was holding them back, the complexity of accounting and controls came in at 42%, within a point of price volatility. The asset was rarely the hard part.

The problem is more acute now than at any point in Bitcoin's history, because the threat landscape is compounding from two directions. Bitcoin turns holders into physical targets, and that hasn't waited for a new price high. Jameson Lopp's public tracker now logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year. Coinbase made the risk concrete last year when criminals bribed its support staff and stole customer data, including names, addresses and balance information. The company estimated the breach could cost $400 million; security researchers called it a wake-up call because stolen account data exposes holders to real-world coercion.