A dispute between BlockTower Capital founder Ari Paul and Coinbase has exposed a broader weakness in how companies govern bitcoin holdings: in many arrangements, outsiders cannot easily establish who controls the assets, who can move them or whether they remain in custody.
Paul has publicly accused Coinbase of losing about $25 million belonging to his firm and concealing hacks involving more than $1 billion across 12 institutions. Coinbase has denied the allegations. Paul says ongoing litigation prevents him from releasing his evidence. According to CoinDesk, the dispute has therefore become a test of something larger than the claims themselves: whether corporate bitcoin custody can provide verifiable controls rather than relying on trust between two parties.
The governance questions behind corporate bitcoin
Traditional corporate accounts generally come with established controls. Bank and brokerage accounts can identify authorised users, assign roles, require approval for withdrawals and produce records for auditors. Bitcoin holdings may instead sit behind a single exchange login or in a hardware wallet controlled by one person.
That creates immediate questions for company boards: who can move the asset, who approves a transfer, and what happens if the person with the credentials leaves, is deceived or dies? The source material points to two past examples. QuadrigaCX’s chief executive died in 2018 while holding the only keys, and the Ontario Securities Commission later documented that approximately $190 million in customer assets was affected. Prime Trust found in December 2021 that it could not access legacy wallets, and the problem remained unresolved 18 months later as Nevada moved toward receivership.
The control burden has also appeared in research on corporate decision-making. Deloitte found that 42% of 200 chief financial officers at companies with more than $1 billion in revenue identified accounting and controls complexity as a barrier to adoption, a level close to the concern over price volatility. The implication is that operational governance, rather than the asset itself, can be a decisive obstacle.
Security threats add to the problem. Bitcoin holders can become physical targets, and Jameson Lopp’s public tracker records more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far in 2026. Coinbase also disclosed last year that criminals bribed support staff and obtained customer information, including names, addresses and balance data. The company estimated the incident could cost $400 million.
Digital attacks create another exposure. Artificial intelligence can help criminals imitate executives, clone voices and produce convincing phishing messages aimed at finance teams. For companies holding a bearer asset through one credential, a successful attack may result in a loss that cannot be reversed.
Why common custody arrangements leave gaps
Self-custody places responsibility on an individual or a small group, while exchange custody places it largely on one institution. Both approaches can concentrate risk. Audits, trust charters and SOC reports may examine a custodian’s processes and records, but they do not necessarily show a client which named users can authorise withdrawals, what approval rules apply or whether the client can independently verify the assets.
Proof-of-reserves reports have a similar limitation. They can show that assets existed at a particular time, but they do not by themselves establish who can move those assets later. The source material also cites BitMEX’s shutdown after 11 years as a reminder that a single institution can eventually cease operating.
A more distributed model can use bitcoin’s native multiple-signature functionality. Under such an arrangement, keys may be held by separate regulated institutions, with no single institution able to move the assets alone. A corporate owner could also require named users, defined permissions, approval policies for transfers and an audit trail suitable for board review.
The source material says Morgan Stanley used two custodians when designing custody for its proposed bitcoin exchange-traded fund, suggesting that dependence on a single custodian is an active concern at the institutional level. However, dividing custody is only part of the answer. The owner must still be able to verify what it holds without simply accepting a custodian’s statement.
Why this matters for adoption
Single-custodian structures are attractive because they offer one counterparty, one contract and one technical integration. Distributing custody can require more coordination, common standards and operational discipline. But simplicity can become concealed complexity if a company cannot independently answer basic questions about control and asset existence.
The Coinbase dispute remains contested: Coinbase rejects Paul’s accusations, while Paul says litigation prevents him from publishing supporting evidence. That means the public cannot currently resolve the claims using independently available information. For corporate bitcoin holders, that uncertainty is the central lesson.
Boards do not need to become specialists in cryptocurrency to examine the issue. They can apply the same questions used for other financial accounts: who can move the money, who approves the movement, what records are produced and what happens if one person or institution disappears? Until custody arrangements provide clear answers, corporate adoption may continue to face a governance problem as significant as volatility.
Moneyiar market picture
Moneyiar data at 08:32-08:33 on October 21, 2026, showed Bitcoin at $83,135.94, up 2.17% over 24 hours but down 0.72% over seven days. Ethereum was $2,452.58, up 2.86% in 24 hours and down 2.46% over seven days. Monad traded at $0.02217, up 6.20% daily and down 11.28% weekly, while Compound was $25.59, up 19.29% daily and 11.10% over seven days.
