Coinbase Dispute Exposes a Bitcoin Custody Problem Boards Can No Longer Ignore

A public fight over alleged Coinbase losses has exposed a problem bigger than the claims themselves: many companies still cannot independently prove who controls their Bitcoin, who can move it or what happens when something goes wrong.

BlockTower Capital founder Ari Paul alleged that Coinbase lost roughly $25 million belonging to his firm and concealed more than $1 billion in losses affecting multiple institutions. Paul has not released evidence supporting those allegations, saying legal proceedings limit what he can disclose.

Coinbase denies hiding hacks or losing $1 billion.

That unresolved dispute is the starting point for a broader custody argument laid out by CoinDesk. If outsiders cannot inspect the evidence, boards are pushed back toward the trust-based structure Bitcoin was designed to reduce.

The analysis compares corporate Bitcoin custody with ordinary bank and brokerage controls. Traditional accounts generally identify authorized users, approval thresholds and transaction records, while a crypto position can still depend on one exchange login, one hardware wallet or one employee who knows how the pieces fit together.

CoinDesk also points to the practical questions directors must answer before treating Bitcoin as a mature treasury asset. Who can move it, who approves that movement, what audit trail exists, and what happens if the credential holder quits, is compromised or dies?

Those are not technical side issues. They determine whether a board can verify the asset independently, test internal controls and respond to a loss without depending entirely on the custodian or one internal operator.

Coinbase “lost” $25m of my firm’s a couple years ago. Turned out they were actually covering up massive and repeated hacks. Still wouldn’t return our money. We traced this to at least a dozen other affected firms and over $1b covered up. That’s all I can say for now as…

— Ari Paul (@AriDavidPaul) September 28, 2026

The allegation must remain an allegation. Unchained found no public evidence establishing Paul’s figures and could not independently verify his account.

The outlet traced the dispute through customer complaints, Paul’s posts and Coinbase’s responses, including Paul’s statement that legal proceedings prevented a full public release. Coinbase declined to address individual clients and rejected the central claim.

We can't comment on any specific clients, but can share some general facts to clear up any incorrect speculation.

Coinbase is not hiding a series of hacks and we certainly didn’t lose $1B.

We advise our customers on maintaining the best security practices, including how they…

— Coinbase Support (@CoinbaseSupport) September 29, 2026

Coinbase also pointed to API-key security, noting that customers are responsible for protecting credentials that can connect outside trading systems to their accounts. That response identifies one of the hard questions without resolving the public dispute: did a loss originate inside the custodian, in a client’s credentials, or somewhere between the two?

For a corporate board, that uncertainty is not an abstract crypto debate. A conventional bank or brokerage account normally comes with named users, approval thresholds, transaction records and a process an auditor can test. A Bitcoin position can instead collapse into one exchange login, one hardware wallet or one employee who knows how the pieces fit together.

The minimum governance standard should be obvious. A company needs documented custody architecture, multiple-person approval for transfers, clear credential ownership, tested succession procedures, independent reconciliation and an incident-response plan that does not begin after money moves.

Protos summarized both sides of the original clash: Paul said his firm traced the problem across other institutions, while Coinbase rejected the idea that it had concealed a billion-dollar series of hacks. Without public evidence or a court record resolving the matter, neither the largest number nor the alleged cause should be presented as established fact.

Companies do not need to wait for the dispute to be settled, because the governance lesson holds either way.

If a board cannot answer who can move the Bitcoin, what evidence proves the balance, how access is revoked and how losses are investigated, the company does not have a mature treasury asset. It has a concentrated operational risk wearing a Bitcoin label.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.