BlockTower Capital founder Ari Paul accused Coinbase of losing roughly $25 million of his firm's assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase denies the allegations, while Paul says active litigation prevents him from publishing his evidence. The dispute has left outsiders unable to independently determine what happened.
Why it matters
The central issue is broader than the allegations. Companies holding Bitcoin need to know who can move the asset, who approves withdrawals and whether the balance still exists. Bank and brokerage accounts typically provide named users, role-based permissions and audit trails. Corporate custody arrangements often reduce those controls to a single exchange login or a hardware wallet controlled by one person.
Past failures show the risk. QuadrigaCX lost roughly $190 million in customer assets after its CEO died holding the only keys. Prime Trust later discovered it could not open legacy wallets. A Deloitte survey of 200 CFOs at billion-dollar companies found accounting and controls were a 42% barrier to Bitcoin adoption, nearly matching price volatility.
Market impact
The security surface is expanding as physical attacks, phishing and AI-enabled social engineering target holders and finance teams. Proof-of-reserves reports can show an asset snapshot, but they do not establish who can move funds or whether controls will survive the departure of a key employee or institution.
The proposed alternative is distributed custody using multiple signatures, independent regulated institutions, named roles, approval policies and auditable withdrawal records. Morgan Stanley's proposed Bitcoin ETF custody design named two custodians, signaling that single-custodian risk is becoming an institutional concern. Until companies can verify their own holdings and controls, the Coinbase dispute will remain a warning for corporate Bitcoin adoption.
Frequently asked questions
-
What did Ari Paul allege about Coinbase?
Paul accused Coinbase of losing roughly $25 million of BlockTower's assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase denies the allegations.
-
Why is the dispute important for corporate Bitcoin adoption?
It highlights whether companies can independently verify who controls their Bitcoin, who approves movements and whether the assets remain in custody.
-
What controls do companies typically expect from bank accounts?
Companies generally expect named users, defined roles, withdrawal approval rules and an audit trail that can be reviewed by controllers and auditors.
-
What past custody failures are cited in the story?
QuadrigaCX lost roughly $190 million after its CEO died holding the only keys. Prime Trust later discovered it could not open legacy wallets.
-
How could institutional Bitcoin custody reduce single-point risk?
Multisignature arrangements can distribute keys across independent institutions while adding named roles, approval policies and auditable withdrawal records.
CoinDesk