OneKey founder warns BlackRock’s Bitcoin ETF could be a North Korean target
North Korean hackers could target BlackRock's $62 billion Bitcoin ETF, according to OneKey founder Yishi Wang, following the $6 billion Binance hack attributed to North Korea's TraderTraitor operation.
The warning puts fresh attention on Coinbase, which serves as the primary Bitcoin custodian for BlackRock's iShares Bitcoin Trust (IBIT). CryptoSlate's April 8 snapshot put funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets.
Coinbase has already made precautionary changes to its offline storage infrastructure following the Binance breach. In an Oct. 29 statement, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution.
I suspect IBIT is already on North Korea's shortlist
Security vulnerabilities
Wang's concern stems from techniques used in previous cryptocurrency thefts, particularly the February 2025 Bybit hack resulting in $1.5 billion in losses. Attackers compromised a Safe{Wallet} developer's computer through malicious software disguised as legitimate development tooling.
According to Sygnia's forensic investigation, attackers manipulated the transaction interface used by Bybit's authorized signers, deceiving them into approving a malicious transfer from a cold wallet without extracting private keys.
TRM Labs found that Binance attackers executed coordinated transfers across 10 blockchains, including transactions involving pre-signed authorizations on Ethereum. Binance identified a compromised employee laptop as a possible entry point.
Concentration risks
BlackRock's fund data shows IBIT held approximately $62 billion in net assets as of Oct. 30, with roughly 815,000 BTC representing nearly 4% of Bitcoin's maximum supply. This creates a particularly consequential concentration of cryptocurrency under institutional custody.
Although BlackRock appointed Anchorage Digital as an additional custodian, its June 30 filing said the fund has no current plans to transfer Bitcoin away from Coinbase. Wang argued this concentration creates significant exposure because a compromise affecting critical custody infrastructure could threaten assets held for investors.
BlackRock's annual filing shows Coinbase maintains commercial crime insurance shared among customers, with liability generally limited to $100 million per cold storage address. Unlike stablecoins, Bitcoin has no centralized mechanism for restricting stolen assets, leaving IBIT shareholders potentially exposed to losses that may not be fully recovered.
Related
