OneKey founder Yishi Wang warned that North Korean hackers could add BlackRock’s iShares Bitcoin Trust (IBIT) to their target list. Wang’s comment follows the $6 billion Binance hack that U.S. authorities linked to North Korea’s TraderTraitor operation.
Custody arrangements and recent security actions
IBIT, the world’s largest spot Bitcoin exchange‑traded fund, lists Coinbase as its primary Bitcoin custodian. A CryptoSlate snapshot from April 8 indicated that more than 80 % of U.S. Bitcoin ETF assets rely on Coinbase for custody.
After the Binance breach, Coinbase announced precautionary changes to its offline storage infrastructure. In a statement dated Oct. 29, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold‑storage systems, while maintaining that its overall infrastructure remained secure.
Recent theft techniques that raise concerns
Wang cited previous attacks that exploited transaction‑approval processes rather than private‑key theft. The February 2025 Bybit hack, which resulted in about $1.5 billion in losses, involved malicious software compromising a developer’s computer and manipulating the transaction interface used by authorized signers.
Similarly, the Binance breach involved coordinated transfers across multiple blockchains, with analysts suggesting compromised hot‑wallet signing infrastructure. Binance identified a compromised employee laptop as a possible entry point but reported no evidence of leaked private keys.
Scale of BlackRock’s Bitcoin holdings
According to BlackRock’s fund data, IBIT held roughly $62 billion in net assets as of Oct. 30, representing about 815,000 BTC—nearly 4 % of Bitcoin’s total supply. The fund also appointed Anchorage Digital as an additional custodian, though a June 30 filing indicated no plans to move Bitcoin away from Coinbase.
Potential exposure and insurance limits
The concentration of assets under a single custodial arrangement raises concerns about exposure if critical infrastructure were compromised. BlackRock’s filing shows that Coinbase provides commercial crime insurance shared among its customers, with liability generally limited to $100 million per cold‑storage address, subject to contractual exceptions.
Because Bitcoin lacks a centralized mechanism to freeze stolen tokens, any loss could be difficult to recover through blockchain tracing, insurance claims, or custodian compensation.
