The Coinbase allegations expose Bitcoin's corporate governance gap

Corporate adoption of bitcoin will stall as long as companies can't show who controls the money, who approves its movement, or whether it's still there, argues Onramp CEO Michael Tanguma.

BlockTower Capital founder Ari Paul publicly accused Coinbase of losing roughly $25 million of his firm's assets and concealing hacks totaling more than $1 billion across a dozen institutions. Coinbase flatly denies it, Paul says active litigation prevents him from publishing his evidence, and the industry has spent the weeks since arguing about who is telling the truth.

The argument misses the most uncomfortable fact in the story: nobody outside the two parties involved can check. That is a strange place to land for an industry built on an asset designed so that no one would have to take anyone's word for anything. A custodian holding assets for much of the market stands accused of billion-dollar concealment, and the only tools available for evaluating the claim are the accuser's credibility and the custodian's word. The lesson for every company holding bitcoin, or deciding whether to, is that bitcoin on a balance sheet presents a controls problem, and until a custody arrangement can answer the same questions a board asks about the company’s bank and brokerage accounts, who can move the money and who signs off, stories like this one will stay unanswerable.

Every other account a company touches comes with governance as a default. A corporate bank account has named users, defined roles, approval rules on withdrawals and an audit trail that a controller can hand to an auditor. A brokerage account has the same. The moment a business buys bitcoin, all of that disappears into one of two places: a single exchange login or a hardware wallet in somebody's drawer.

Boards have noticed, and they’re asking questions. Who can move the asset? Who approves the movement? What happens when the person holding the credentials quits, gets phished, or dies? These are not hypotheticals. QuadrigaCX’s chief executive died in 2018, holding the only keys, and roughly $190 million in customer assets went with him, as the Ontario Securities Commission later documented. Prime Trust discovered in December 2021 that it could not open its own legacy wallets, and still could not 18 months later when Nevada moved to put it into receivership. Across most of the industry, the honest answer to all these questions is a shrug. Companies that wanted bitcoin on the balance sheet have walked away at exactly this point. When Deloitte asked 200 CFOs at billion-dollar companies what was holding them back, the complexity of accounting and controls came in at 42%, within a point of price volatility. The asset was rarely the hard part.

The problem is more acute now than at any point in Bitcoin's history, because the threat landscape is compounding from two directions. Bitcoin turns holders into physical targets, and that hasn't waited for a new price high. Jameson Lopp's public tracker now logs more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year. Coinbase made the risk concrete last year when criminals bribed its support staff and stole customer data, including names, addresses and balance information. The company estimated the breach could cost $400 million; security researchers called it a wake-up call because stolen account data exposes holders to real-world coercion.

On the digital side, artificial intelligence has industrialized the attack: cloned voices on the phone with the finance team, phishing emails indistinguishable from the chief executive's, social engineering that improves monthly. A business holding a bearer asset on a single credential carries that entire surface area on behalf of its employees and owners, for an asset where losses are often permanent.

The industry's existing answers all concentrate risk instead of distributing it. Self-custody concentrates it on one person, which is why corporate self-custody collapses into key ceremonies at every hire and departure and a controller praying the keyholder never leaves angry. Exchange custody concentrates it on one company, with the client holding neither the keys nor any way to see behind the login. Audits, trust charters and SOC reports test the custodian's own books and processes. None of them gives the client named users, approval rules on withdrawals, or a way to confirm the asset is there without asking. The shutdown of BitMEX after 11 years was a reminder of how routinely single institutions simply end. Proof-of-reserves attestations, the industry's favorite half measure, show a snapshot of assets without showing controls, and say nothing about who can move what tomorrow.

The durable fix uses properties bitcoin already has. Multiple signatures are native to the protocol, which means keys can be generated and held by independent regulated institutions, with no single institution able to move or lose the asset, the company holding legal title, named users with defined roles, approval policies on every withdrawal, and an audit trail a board can actually read.

Institutions are already moving in this direction. When Morgan Stanley designed custody for its proposed bitcoin ETF, it named two custodians rather than one, a sign that relying on a single custodian is now a live concern at the top of the market. But splitting custody only goes halfway. The real test is whether the owner can see for itself what it holds, without taking any custodian's word for it. Bitcoin makes that possible, and a custody setup that doesn't take advantage of it leaves the owner exactly where Coinbase's clients are today, waiting for someone to tell them the truth.

The fair objection is that single-custodian arrangements exist for good reasons. They're simple: one counterparty to vet, one contract, one integration, and for many companies that simplicity is worth a lot. Spreading custody across independent institutions is harder than it sounds, requiring coordination, shared standards and operational discipline the industry spent its first 15 years avoiding.

Both points are true, and neither weakens the case. Simplicity is only an advantage if what's being simplified can be checked. A single custodian that can't show its clients what it holds hasn't removed complexity; it has hidden it. The cost of that only shows up when a question like the one facing Coinbase lands, and nobody outside can answer it. A financial system in which a billion-dollar question about client assets can't be settled from the outside has failed at the exact thing bitcoin was invented to fix. Building something better than a single point of trust is hard, and it's also the industry's actual job.

Corporate adoption of bitcoin will stall as long as companies hold it in custody that can't show who controls the money, who approves its movement, or whether it's still there, which is exactly the gap the Coinbase allegations exposed. Boards do not need to become bitcoin experts to force the change; they only need to ask what they already ask of every other account, and add one more question: what survives the departure of any single person or institution. Any custody arrangement that cannot answer those questions clearly is a risk disclosure waiting to be written. A decade from now, the industry will look back with astonishment that it invented a radically new form of money and spent years custodying it behind a single login. The sooner custody is built so that no single party can lose, move, or lie about what it holds, the sooner the question hanging over the industry becomes impossible to ask.

Note: The views expressed in this column are those of the author and do not necessarily reflect those of CoinDesk, Inc. or its owners and affiliates.

Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.