Key Takeaways
- • OneKey crypto wallet representative Yishi warned that BlackRock's iShares Bitcoin Trust (IBIT), holding roughly 815,000 BTC worth about $63 billion, could face systemic theft risk through compromise of transaction-signing infrastructure rather than private key theft.
- • Coinbase remains IBIT's primary custodian; Anchorage Digital has been appointed as an additional custodian, but the fund's latest quarterly report says there are currently no plans to move bitcoin there.
- • A hypothetical $6 billion theft would equal about 9.5% of IBIT's assets, or roughly $4 per share at current valuations, with losses ultimately borne by shareholders because BlackRock does not separately insure the fund's bitcoin.
- • Coinbase has disclosed $320 million in commercial crime insurance shared across its customers, and its custody agreement caps liability at $100 million per cold storage address.
- • TRM Labs attributes the recent Binance incident with high confidence to North Korea's TraderTraitor group, which Yishi cites as a reason IBIT may already be on North Korean hackers' target list.
Summary
A representative of the OneKey crypto wallet, using the pseudonym Yishi, published a post on October 30, 2026 warning of security risks to BlackRock's iShares Bitcoin Trust (IBIT), the world's largest bitcoin ETF. According to the post, IBIT holds roughly 815,000 BTC worth around $63 billion, with Coinbase as its active bitcoin custodian. Yishi argued that such concentration creates systemic risk, noting that attackers do not necessarily need to extract private keys if they can compromise the transaction-signing infrastructure.
Yishi drew on recent incidents to support the argument. He recalled the February 2025 Bybit hack, in which attackers compromised a Safe{Wallet} developer's Mac through malware disguised as Docker tooling, had access for 17 days, and manipulated the transaction interface used by Bybit's signers, resulting in the theft of about $1.5 billion from a cold wallet. He also cited TRM Labs' high-confidence attribution of the recent Binance incident to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance's preliminary investigation points to a compromised DevOps engineer's laptop as the entry point; Binance says there is no evidence private keys were leaked, while TRM's analysis suggests attackers may have gained control of the signing infrastructure.
On IBIT specifically, Yishi noted that Anchorage Digital has been appointed as an additional custodian, but the fund's latest quarterly report states there are currently no plans to transfer bitcoin there. He cited a hypothetical $6 billion theft as an illustration, equal to roughly 9.5% of IBIT's assets or about $4 per share. Recovery is a further concern: Binance froze some stolen stablecoins, but bitcoin has no comparable freezing mechanism. BlackRock does not separately insure the fund's bitcoin. Coinbase has disclosed $320 million in commercial crime insurance shared across its customers, and its custody agreement limits liability to $100 million per cold storage address, with recovery subject to contractual terms and liability determinations. If a major theft occurred and losses were not recovered or compensated, the remaining losses would ultimately fall on IBIT shareholders.
Yishi's recommendations included spreading assets across independent custody setups, keeping private keys offline, and verifying transaction details on a trusted device screen separate from the initiating computer. The post also referenced the Bitget exchange attack last month, with losses initially totaling $351.6 million and later rising to $387.5 million.
Yishi drew on recent incidents to support the argument. He recalled the February 2025 Bybit hack, in which attackers compromised a Safe{Wallet} developer's Mac through malware disguised as Docker tooling, had access for 17 days, and manipulated the transaction interface used by Bybit's signers, resulting in the theft of about $1.5 billion from a cold wallet. He also cited TRM Labs' high-confidence attribution of the recent Binance incident to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance's preliminary investigation points to a compromised DevOps engineer's laptop as the entry point; Binance says there is no evidence private keys were leaked, while TRM's analysis suggests attackers may have gained control of the signing infrastructure.
On IBIT specifically, Yishi noted that Anchorage Digital has been appointed as an additional custodian, but the fund's latest quarterly report states there are currently no plans to transfer bitcoin there. He cited a hypothetical $6 billion theft as an illustration, equal to roughly 9.5% of IBIT's assets or about $4 per share. Recovery is a further concern: Binance froze some stolen stablecoins, but bitcoin has no comparable freezing mechanism. BlackRock does not separately insure the fund's bitcoin. Coinbase has disclosed $320 million in commercial crime insurance shared across its customers, and its custody agreement limits liability to $100 million per cold storage address, with recovery subject to contractual terms and liability determinations. If a major theft occurred and losses were not recovered or compensated, the remaining losses would ultimately fall on IBIT shareholders.
Yishi's recommendations included spreading assets across independent custody setups, keeping private keys offline, and verifying transaction details on a trusted device screen separate from the initiating computer. The post also referenced the Bitget exchange attack last month, with losses initially totaling $351.6 million and later rising to $387.5 million.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.