The PlanB Transfer: An ETF Exit Audited Against Its Own Security Claims

Hook

On October 12, a man whose entire intellectual brand was built on the phrase "not your keys, not your coins" announced he no longer holds his own keys. PlanB — the pseudonymous Dutch analyst behind the Stock-to-Flow model, the handle @100trillionUSD — confirmed he moved his Bitcoin into a spot ETF during 2025. He reported zero regrets. His stated reason was not yield, not tax efficiency, not institutional access. It was fear. He cited two hardware wallet security events: an entropy problem that Coldcard had previously disclosed, and unauthorized hardware implants found in some Ledger units.

That is the entire disclosure. No timestamps. No affected firmware versions. No CVE identifiers. No remediation status. No statement on whether the flaws persist today. Just two named products, one vague threat model, and a migration from self-custody to a custodial wrapper.

I have spent enough hours inside rollup aggregation logic to know what an unverified claim looks like. This one has the shape of a security argument and the substance of a vibe.

Context

To evaluate PlanB's migration fairly, you have to separate two things he conflated: the security properties of self-custody as a mechanism, and the security properties of a specific vendor's implementation of that mechanism.

Self-custody is a trust model, not a product. It says: the private key never leaves your control, therefore no third party can move your coins without your signature. That model is mathematically sound. The problem is that the model's soundness is only as good as the entropy that generates the seed, the silicon that stores it, and the firmware that signs with it. Coldcard and Ledger are two implementations of the model — and implementations fail.

Coldcard's "entropy problem" almost certainly refers to the class of RNG and seed-generation weaknesses disclosed around 2023, where insufficient randomness in key generation could narrow the search space for a brute-force attack on a mnemonic. For a long-term holder, that is not a bug — it is an existential flaw. A seed that looks like 256 bits but behaves like 40 bits is a seed that an adversary with modest compute can crack offline.

Ledger's "unauthorized hardware implant" is where PlanB's phrasing becomes forensic evidence of its own imprecision. Three distinct incidents get collapsed under that phrase: the 2023 Ledger Recover controversy, in which firmware-level key-shard export capability triggered a community revolt; the December 2023 Ledger Connect Kit supply-chain attack, where a compromised JavaScript dependency drained connected wallets; and the older, ongoing risk of physical supply-chain tampering by resellers. These are not the same event. One is a firmware design decision. One is a software dependency compromise. One is a logistics problem. Bundling them into a single "implant" narrative is not analysis. It is stitching.

Now place the ETF on the other side of the ledger. US spot Bitcoin ETFs were approved in January 2024 and have since become the dominant regulated access route to the asset. The structure is a trust: authorized participants create and redeem shares, the trust holds Bitcoin through a custodian, and retail holders receive a share, not a UTXO. When you buy that share, you are not buying a coin. You are buying a claim on a trust that bought a coin. The distinction is not semantic; it is the entire security model.

Core

Here is the mechanical reality of what PlanB did.

When you hold Bitcoin in self-custody, you hold a UTXO — an unspent transaction output — controlled by a key you possess. When you hold a spot ETF share, you hold a claim on a trust that holds Bitcoin through a custodian. The custodian holds the UTXOs. You hold a share. Swap one for the other and you have not upgraded your security; you have relocated your failure surface.

| Dimension | Self-Custody (Hardware) | Spot ETF | |---|---|---| | Key control | Full | None (custodian holds) | | Counterparty risk | None | Custodian + broker + regulator | | Single point of failure | Your operation / device flaw | Custodian systemic risk | | Inheritance planning | Complex (self-designed) | Simple (brokerage account) | | On-chain usability | DeFi, transfers, Lightning | Compliance-hours trading only | | KYC / compliance | None | Mandatory |

Read that table and the trade becomes legible. PlanB did not find a more secure system. He swapped operational and device risk for institutional, regulatory, and counterparty risk. The failure surface did not shrink. It moved. Scalability is a trade-off, not a promise — and custody is the same. You are always choosing which trust you cannot audit.

I made this exact mistake of framing once, in reverse. During my 2019 ZK-Snark audit of ZKSwap's early beta, I found three critical state-mismatch vulnerabilities in their rollup aggregation logic that the founding team had missed. The lesson was not "code is unsafe." The lesson was that a sound mathematical model does not protect you from a broken implementation of it — and, crucially, that you can only assert a vulnerability if you can point to the specific line where the invariant breaks. "The entropy is weak" without a version number is not a finding. It is a rumor with a security vocabulary.

Apply the same standard to PlanB's two cited events. If Coldcard's entropy flaw is real and unpatched, it is a critical finding affecting a specific firmware range — name it. If Ledger units shipped with unauthorized implants through a reseller channel, that is a supply-chain integrity failure — name the channel, the batch, the detection method. Without those parameters, the claim is unfalsifiable, and an unfalsifiable security claim is worse than no claim at all, because it launders fear into a decision.

Now the economic layer. Every satoshi that moves from self-custody into an ETF moves from a liquid, on-chain, censorship-resistant state into a custodied, frozen, compliance-gated state. Retail ETF shares are not redeemable in kind — in-kind redemption is restricted to authorized participants. The result is a "paper Bitcoin" exposure that does not settle on-chain. The chain is fast; the settlement is slow — and in this case, the settlement never touches the chain at all.

This matters for the network, not just the individual. Custody concentrates. Most US spot Bitcoin ETFs route through a small number of custodians, with Coinbase Custody handling a dominant share. Concentration is a systemic variable: one custodian's operational failure, insolvency, or regulatory seizure becomes a correlated shock across every share holder simultaneously. When I led the 2022 comparison of Optimistic versus ZK-Rollup finality times, the headline finding was not which chain was faster — it was that performance and trust assumptions trade against each other in ways teams routinely under-report. ETF custody does the same thing at the asset level: it buys convenience with concentration, and it does not disclose the price.

PlanB's framing — "managing Bitcoin like stocks and bonds is more convenient, no need to handle private keys" — is a textbook utility-function reordering. He traded on-chain usability and censorship resistance for convenience and peace of mind. That is a legitimate personal preference. It is not a security upgrade. Proofs verify truth, but context verifies intent — and the context here is a man optimizing for his own sleep, not for the protocol's robustness.

Contrarian

The contrarian read is not "PlanB betrayed Bitcoin." It is that PlanB's argument is defensive, not gain-oriented — and defensive arguments dressed as technical ones deserve the most scrutiny.

Notice what the argument does structurally. It converts a personal risk-tolerance decision into a general safety claim. "I moved to an ETF because hardware wallets are unsafe" implies the hardware wallet class is unsafe. But Coldcard and Ledger are implementations, not the class. Multi-signature setups, air-gapped signers, MPC wallets, and threshold schemes exist precisely because single-device custody has always carried a single point of failure. The correct response to a Coldcard entropy flaw is not "abandon self-custody." It is "diversify your signing surface."

This is the same error pattern I documented in the 2025 AI-agent protocol review. I identified an oracle data-feed flaw that allowed manipulation by AI models with sufficient compute — the "AI-Oracle attack vector." The naive conclusion would have been "oracles are broken." The correct conclusion was "this oracle's data provenance is unverified, so weight it differently." PlanB is making the naive conclusion. He is generalizing from two named incidents to an entire custody philosophy, and he is doing it without disclosing whether either incident has been remediated. In the dark, zero knowledge is just a guess — and a guess is not a foundation for moving real capital.

There is also a reputational layer the market underweights. PlanB's Stock-to-Flow model predicted Bitcoin above $100K on a schedule that failed decisively. His credibility is a depreciated asset. When a depreciated-credibility KOL announces a philosophy reversal, the announcement functions less as analysis and more as rebranding — a pivot from "extremist evangelist" to "pragmatic allocator" timed to the institutional era. That does not make the underlying security concerns false. It makes the messenger unreliable, and readers should discount accordingly. The "zero regrets" line is itself a tell: regret is only worth denying when a decision faced real criticism, and this one did.

Complexity hides risk; simplicity reveals it. The simple truth is this: PlanB's migration reduces his personal operational burden and increases his exposure to institutions he does not control. He has not eliminated trust. He has relocated it to parties whose failure modes he cannot audit.

Takeaway

The forecast is not about one analyst's portfolio. It is about the direction of the failure surface.

Watch three signals over the next two quarters. First, whether Coinkite (Coldcard's parent) or Ledger publishes a concrete remediation record — firmware versions, affected batches, detection tooling. If they do, PlanB's security rationale weakens to a preference. If they stay silent, the trust erosion is real and the self-custody tooling sector has a problem it cannot PR its way out of. Second, custody concentration metrics — if ETF holdings continue to funnel through a shrinking set of custodians, the network's correlated-failure risk rises even as its headline adoption rises. Third, whether multi-signature and MPC wallet adoption accelerates as the "third path" that neither PlanB nor the ETF issuers are discussing.

The question readers should sit with is not "should I follow PlanB?" It is "which trust have I actually chosen, and can I name the line where it breaks?" If you cannot name the line, you are not holding a position. You are holding a hope.