Key Takeaways
- • OneKey wallet expert Yishi warned that BlackRock's iShares Bitcoin Trust (IBIT), holding about 815,000 BTC worth roughly $63 billion, faces systemic custody risk following a large-scale hack of Binance, according to Finway.
- • Yishi estimated that a theft of about $6 billion in IBIT assets would equal roughly 9.5% of the fund's holdings, or nearly $4 per share at current value.
- • BlackRock does not separately insure IBIT's bitcoin; Coinbase, the primary custodian, carries $320 million in insurance shared among all clients, and its custodial agreement caps liability at $100 million per cold storage address.
- • TRM Labs has high confidence linking the Binance attack to the TraderTraitor group, the same actor behind the 2025 Bybit hack, while Binance denies any leakage of private keys.
- • Yishi argues that attacks on transaction confirmation infrastructure, not just private key theft, pose the main threat, and recommends distributing assets across independent systems.
Summary
A cryptocurrency wallet expert from OneKey, writing under the pseudonym Yishi, has warned of significant risks to the iShares Bitcoin Trust (IBIT), the spot bitcoin ETF managed by BlackRock, in light of a recent large-scale hack of the Binance exchange. According to the expert, IBIT currently holds about 815,000 BTC worth approximately $63 billion, with Coinbase serving as the primary custodian. The report was carried by Finway.
Yishi argues that concentrating assets under a single custodian creates systemic risk. In his view, attackers do not necessarily need to steal private keys if they can compromise the transaction confirmation infrastructure. He suggested IBIT may already be on the target list of North Korean hacker groups.
To support this view, Yishi cited the February 2025 Bybit hack. Attackers gained access to a Safe{Wallet} developer's computer through malware disguised as a Docker tool and, over 17 days, altered the transaction signing interface. Bybit signers unknowingly approved a transaction that resulted in the theft of $1.5 billion from a cold wallet. Yishi said this shows that offline key storage does not guarantee security, since the risk remains at the confirmation stage. TRM Labs has high confidence in linking the recent Binance attack to the TraderTraitor group, which also previously stole 4,502.9 BTC from DMM Bitcoin. Binance's initial investigation pointed to a compromised DevOps engineer's laptop, though the exchange denies any leakage of private keys. TRM Labs does not rule out that the attackers gained control of the transaction signing infrastructure.
Yishi warns that a critical failure in infrastructure protection could cause the loss of a significant portion of IBIT's assets. He cites a probable theft of $6 billion, equal to about 9.5% of the fund's assets or nearly $4 per share. Unlike stablecoins, which Binance was partly able to freeze, stolen bitcoin is practically impossible to recover. BlackRock does not separately insure the bitcoin held in IBIT. Coinbase's insurance totals $320 million and is distributed among all its clients, and the custodial agreement limits liability to $100 million per cold storage address, with compensation dependent on contract terms and the definition of liability. Yishi stressed that if the fund cannot recover stolen bitcoin or obtain sufficient compensation, "the residual losses may ultimately fall on IBIT's shareholders."
He recommends against relying solely on cold storage, and advises distributing assets among independent systems, keeping private keys offline, and verifying transaction details on a separate device. He added that a clean security history does not guarantee protection against new attacks. The report also noted that Bitget recently suffered attacks with losses initially reported at $351.6 million, later revised to $387.5 million.
Yishi argues that concentrating assets under a single custodian creates systemic risk. In his view, attackers do not necessarily need to steal private keys if they can compromise the transaction confirmation infrastructure. He suggested IBIT may already be on the target list of North Korean hacker groups.
To support this view, Yishi cited the February 2025 Bybit hack. Attackers gained access to a Safe{Wallet} developer's computer through malware disguised as a Docker tool and, over 17 days, altered the transaction signing interface. Bybit signers unknowingly approved a transaction that resulted in the theft of $1.5 billion from a cold wallet. Yishi said this shows that offline key storage does not guarantee security, since the risk remains at the confirmation stage. TRM Labs has high confidence in linking the recent Binance attack to the TraderTraitor group, which also previously stole 4,502.9 BTC from DMM Bitcoin. Binance's initial investigation pointed to a compromised DevOps engineer's laptop, though the exchange denies any leakage of private keys. TRM Labs does not rule out that the attackers gained control of the transaction signing infrastructure.
Yishi warns that a critical failure in infrastructure protection could cause the loss of a significant portion of IBIT's assets. He cites a probable theft of $6 billion, equal to about 9.5% of the fund's assets or nearly $4 per share. Unlike stablecoins, which Binance was partly able to freeze, stolen bitcoin is practically impossible to recover. BlackRock does not separately insure the bitcoin held in IBIT. Coinbase's insurance totals $320 million and is distributed among all its clients, and the custodial agreement limits liability to $100 million per cold storage address, with compensation dependent on contract terms and the definition of liability. Yishi stressed that if the fund cannot recover stolen bitcoin or obtain sufficient compensation, "the residual losses may ultimately fall on IBIT's shareholders."
He recommends against relying solely on cold storage, and advises distributing assets among independent systems, keeping private keys offline, and verifying transaction details on a separate device. He added that a clean security history does not guarantee protection against new attacks. The report also noted that Bitget recently suffered attacks with losses initially reported at $351.6 million, later revised to $387.5 million.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.