BlockTower Capital founder Ari Paul has publicly accused Coinbase of losing roughly $25 million of his firm’s assets and concealing hacks totaling more than $1 billion across a dozen institutions, allegations Coinbase flatly denies. Paul says active litigation prevents him from publishing evidence supporting the claims, leaving the dispute unverifiable to outside parties.
The accusation has reignited a structural debate about Bitcoin custody governance at corporations. Michael Tanguma, CEO of Onramp, argues that corporate Bitcoin holdings lack the control frameworks standard in traditional banking.
“Corporate adoption of bitcoin will stall as long as companies hold it in custody that can’t show who controls the money, who approves its movement, or whether it’s still there,” Tanguma said.
The Governance Gap
Traditional corporate bank and brokerage accounts include named users, defined roles, approval rules on withdrawals, and audit trails. Bitcoin custody typically exists in one of two configurations: a single exchange login or a hardware wallet held by an individual. Neither arrangement provides the segregation of duties boards increasingly demand when holding material Bitcoin positions.
Boards are asking direct governance questions: who can move the asset, who approves movement, and what happens if the keyholder quits or dies. These questions have no standardized answers in the Bitcoin custody market.
A Deloitte survey of 200 CFOs at billion-dollar companies found price volatility and accounting/controls complexity were nearly equal barriers to Bitcoin adoption. Forty-two percent of CFOs cited complexity of accounting and controls as a barrier to adoption.
Historical Custody Failures
The governance vacuum has produced costly failures. When QuadrigaCX chief executive Gerald Cotten died in 2018, he held the only keys to customer wallets, resulting in $190 million in lost customer assets. In December 2021, Prime Trust discovered it could not open legacy wallets it held in custody. Eighteen months later, when Nevada moved to place Prime Trust into receivership, the company still could not access those wallets.
Coinbase itself disclosed a 2025 security breach in which criminals bribed support staff and stole customer data including names, addresses, and balance information. The company estimated the security breach cost approximately $400 million.
Multi-Signature Solutions Emerging
Bitcoin’s protocol natively supports multiple signatures, allowing keys to be held by independent regulated institutions rather than a single custodian or individual. Morgan Stanley designed custody for its proposed Bitcoin ETF using two custodians rather than one, demonstrating institutional appetite for distributed control arrangements.
Physical attacks on Bitcoin holders have also accelerated concerns about custody security. Jameson Lopp, who maintains a tracker of such incidents, has logged 360 known physical attacks on Bitcoin holders since 2014. In 2025, 86 physical attacks were recorded. Year-to-date through October 2026, more than 60 additional attacks have been logged.
Until custody arrangements can demonstrate clear governance controls, Tanguma argues, corporate adoption will remain constrained by the inability to verify asset control and movement.
