Key Takeaways
- • OneKey founder Yishi Wang warned that North Korean hackers could target BlackRock's iShares Bitcoin Trust (IBIT), which held roughly $62 billion in net assets as of Oct. 30 and about 815,000 BTC per its Oct. 29 holdings file.
- • The warning followed a $6 billion Binance hack that US authorities attributed to North Korea's TraderTraitor operation, with Binance and Coinbase both adjusting custody and transfer controls.
- • Coinbase is IBIT's primary Bitcoin custodian; its custody agreement generally caps liability at $100 million per cold storage address, and its commercial crime insurance is shared among customers rather than reserved for IBIT.
- • Wang's concern is not evidence of an actual attack: there is no indication that IBIT or Coinbase's custody systems have been compromised.
Summary
OneKey founder Yishi Wang has warned that North Korean hackers could target BlackRock's iShares Bitcoin Trust (IBIT), the world's largest spot Bitcoin ETF, according to CryptoSlate. Wang's comments followed a $6 billion Binance hack that US authorities attributed to North Korea's TraderTraitor operation. "I suspect IBIT is already on North Korea's shortlist," Wang said.
Coinbase serves as the primary Bitcoin custodian for IBIT. CryptoSlate's April 8 snapshot placed funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets. In an Oct. 29 statement, Coinbase Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution, while maintaining that its infrastructure remained secure.
Wang pointed to prior North Korean tactics, particularly the February 2025 Bybit hack of roughly $1.5 billion. According to a Sygnia forensic investigation, attackers compromised a Safe{Wallet} developer's computer and manipulated the transaction interface used by Bybit's authorized signers, without needing to extract private keys. TRM Labs found that the Binance attackers executed coordinated transfers across 10 blockchains, and assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance initially identified a compromised employee laptop as a possible entry point before disclosing additional breach points, and said investigators found no evidence of leaked private keys.
According to BlackRock's fund data, IBIT held approximately $62 billion in net assets as of Oct. 30, representing nearly 4% of Bitcoin's maximum supply. BlackRock's June 30 quarterly filing said the fund has no current plans to transfer Bitcoin away from Coinbase, although it has appointed Anchorage Digital as an additional custodian. Wang argued that this concentration creates significant exposure if critical custody infrastructure were compromised.
The financial protections are limited. BlackRock's annual filing shows Coinbase's commercial crime insurance is shared among its customers, and the custody agreement generally limits Coinbase's liability to $100 million per cold storage address, subject to exceptions. Unlike stablecoins, Bitcoin has no centralized freeze mechanism, so IBIT shareholders could face losses not fully recovered through blockchain tracing, insurance, or custodian compensation. The article stresses that there is no evidence IBIT or Coinbase has been compromised, and that Wang's warning does not establish active North Korean targeting of the fund.
Coinbase serves as the primary Bitcoin custodian for IBIT. CryptoSlate's April 8 snapshot placed funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets. In an Oct. 29 statement, Coinbase Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution, while maintaining that its infrastructure remained secure.
Wang pointed to prior North Korean tactics, particularly the February 2025 Bybit hack of roughly $1.5 billion. According to a Sygnia forensic investigation, attackers compromised a Safe{Wallet} developer's computer and manipulated the transaction interface used by Bybit's authorized signers, without needing to extract private keys. TRM Labs found that the Binance attackers executed coordinated transfers across 10 blockchains, and assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance initially identified a compromised employee laptop as a possible entry point before disclosing additional breach points, and said investigators found no evidence of leaked private keys.
According to BlackRock's fund data, IBIT held approximately $62 billion in net assets as of Oct. 30, representing nearly 4% of Bitcoin's maximum supply. BlackRock's June 30 quarterly filing said the fund has no current plans to transfer Bitcoin away from Coinbase, although it has appointed Anchorage Digital as an additional custodian. Wang argued that this concentration creates significant exposure if critical custody infrastructure were compromised.
The financial protections are limited. BlackRock's annual filing shows Coinbase's commercial crime insurance is shared among its customers, and the custody agreement generally limits Coinbase's liability to $100 million per cold storage address, subject to exceptions. Unlike stablecoins, Bitcoin has no centralized freeze mechanism, so IBIT shareholders could face losses not fully recovered through blockchain tracing, insurance, or custodian compensation. The article stresses that there is no evidence IBIT or Coinbase has been compromised, and that Wang's warning does not establish active North Korean targeting of the fund.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.