The Coinbase allegations expose Bitcoin's corporate governance gap

Boards have noticed, and they’re asking questions. Who can move the asset? Who approves the movement? What happens when the person holding the credentials quits, gets phished, or dies? These are not hypotheticals. QuadrigaCX’s chief executive died in 2018, holding the only keys, and roughly $190 million in customer assets went with him, as the Ontario Securities Commission later documented. Prime Trust discovered in December 2021 that it could not open its own legacy wallets, and still could not 18 months later when Nevada moved to put it into receivership. Across most of the industry, the honest answer to all these questions is a shrug. Companies that wanted bitcoin on the balance sheet have walked away at exactly this point. When Deloitte asked 200 CFOs at billion-dollar companies what was holding them back, the complexity of accounting and controls came in at 42%, within a point of price volatility. The asset was rarely the hard part.

The problem is more acute now than at any point in Bitcoin's history, because the threat landscape is compounding from two directions. Bitcoin turns holders into physical targets, and that hasn't waited for a new price high. Jameson Lopp's public tracker now logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year. Coinbase made the risk concrete last year when criminals bribed its support staff and stole customer data, including names, addresses and balance information. The company estimated the breach could cost $400 million; security researchers called it a wake-up call because stolen account data exposes holders to real-world coercion.