- OneKey founder Yishi Wang has warned that North Korean hackers could target BlackRock’s iShares Bitcoin Trust (IBIT), the largest spot Bitcoin ETF.
- The warning follows a $6 billion Binance hack that US authorities attributed to North Korea’s TraderTraitor operation.
- Coinbase, the fund’s primary custodian, has tightened its cold storage systems, but there is no evidence that IBIT or Coinbase’s custody systems have been compromised.
A founder of crypto wallet maker OneKey says North Korean hackers could set their sights on BlackRock’s Bitcoin exchange-traded fund, which held about $62 billion in net assets at the time of the reporting. The concern comes after the Binance breach, which US authorities linked to a North Korean hacking unit. The episode has renewed questions about how institutional Bitcoin custody is protected.
What Happened
Yishi Wang, founder of OneKey, said he suspected BlackRock’s iShares Bitcoin Trust, known as IBIT, was already on North Korea’s list of potential targets. His remarks came after the $6 billion Binance hack, which US authorities attributed to TraderTraitor, an operation tied to North Korea.
Coinbase acts as the main Bitcoin custodian for IBIT. Data cited by CryptoSlate in an earlier snapshot showed that funds naming Coinbase in a custody role held more than 80% of US Bitcoin ETF assets. That concentration is central to Wang’s argument.
Coinbase has already made precautionary changes following the Binance breach. In a statement, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems as a precaution. The company maintained that its infrastructure remained secure.
Why It Matters
Wang’s concern rests on how North Korean attackers have operated in earlier thefts, particularly the February 2025 Bybit hack, which caused losses of roughly $1.5 billion. In that case, according to a forensic investigation by Sygnia, attackers first compromised a developer’s computer at Safe{Wallet} using malicious software disguised as legitimate development tools. They then manipulated the transaction interface that Bybit’s authorized signers relied on, persuading them to approve a malicious transfer from a cold wallet.
The attackers did not need to extract private keys. By compromising the approval process, they were able to make illegitimate transactions look legitimate. Wang’s point is that custody arrangements can depend on software, hardware and approval systems that may be vulnerable, even when assets are held offline.
Blockchain analytics firm TRM Labs reported that the Binance attackers carried out coordinated transfers across 10 blockchains, including transactions involving pre-signed authorizations on Ethereum. TRM assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance initially pointed to a compromised employee laptop as a possible entry point before disclosing additional breach points, and said investigators had found no evidence of leaked private keys.
For IBIT shareholders, the scale matters. BlackRock’s fund data showed the trust held roughly 815,000 BTC, close to 4% of Bitcoin’s maximum supply. A compromise affecting critical custody infrastructure could, in principle, affect a large share of assets held on behalf of investors.
Market Context
Spot Bitcoin ETFs have made regulated exposure to the asset available to a wide range of investors, and custody has become a key part of their structure. BlackRock has appointed Anchorage Digital as an additional custodian. However, its most recent quarterly filing said the fund had no current plans to move Bitcoin away from Coinbase.
Insurance and liability terms are also part of the picture. BlackRock’s annual filing shows that Coinbase maintains commercial crime insurance shared among its customers, not coverage reserved solely for IBIT. The custody agreement generally limits Coinbase’s liability to $100 million per cold storage address, subject to contractual exceptions and other provisions.
Bitcoin also differs from stablecoins in one important respect. Stablecoin issuers can freeze tokens at the protocol or token level, while Bitcoin has no equivalent centralized mechanism for restricting stolen coins. Recovery therefore depends largely on blockchain tracing, insurance claims and compensation from custodians, and none of these is guaranteed to recover the full amount of a loss.
What to Watch Next
- Binance investigation updates: Further disclosures about the breach points, the attack method, and any confirmed link between the compromised systems and the wider TraderTraitor operation.
- Coinbase custody disclosures: Any further statements on changes to cold storage, transfer controls and whether the company identifies any impact on client assets.
- BlackRock filings: Changes to custodial arrangements, including whether the planned role of Anchorage Digital expands, and any updates to IBIT’s insurance or liability disclosures.
- Security research: Findings from firms such as Sygnia and TRM Labs that could show whether attacks on institutional custody are becoming more common.
Wang’s warning is a concern rather than a confirmed threat. There is no evidence that IBIT or Coinbase’s custody systems have been compromised, and no evidence that North Korean hackers are actively targeting the fund. Still, the case highlights a structural question for investors: how much protection offline storage offers when the approval processes around it can be attacked. Readers should follow official disclosures closely as the investigations continue.
Source: original report
