OneKey Founder Flags Potential North Korean Threat to BlackRock’s $62B Bitcoin ETF

OneKey founder Yishi Wang has warned that North Korean hackers could target BlackRock’s $62 billion Bitcoin ETF, suggesting the fund may already be on the regime’s radar.

Wang’s comments follow the $6 billion Binance breach that U.S. authorities linked to North Korea’s TraderTraitor operation. “I suspect IBIT is already on North Korea’s shortlist,” he said.

The alert refocuses scrutiny on Coinbase, the primary custodian for BlackRock’s iShares Bitcoin Trust (IBIT), the world’s largest spot Bitcoin ETF. Data from CryptoSlate indicates that over 80 % of U.S. Bitcoin ETF assets rely on Coinbase for custody.

Why BlackRock’s Bitcoin ETF Faces Heightened Risks

Wang bases his concern on tactics North Korean groups have employed in recent major heists, notably the February 2025 Bybit breach that cost roughly $1.5 billion.

In that incident, attackers compromised a Safe{Wallet} developer’s workstation using malware masquerading as legitimate development tools.

A forensic review by Sygnia showed that the hackers manipulated Bybit’s transaction interface, tricking authorized signers into approving a fraudulent transfer from a cold wallet. The theft was accomplished without needing to extract private keys, as the approval process itself was subverted.

Similar security questions have arisen after the Binance incident.

Blockchain analytics firm TRM Labs reported that the perpetrators conducted coordinated transfers across ten blockchains, including Ethereum transactions that involved pre‑signed authorizations.

TRM assessed that the attack likely involved compromised hot‑wallet signing infrastructure.

Binance initially pinpointed a breached employee laptop as a possible entry point before revealing additional compromise vectors. The exchange maintains that investigators found no evidence of leaked private keys.

These episodes underline concerns about the security of institutional custody solutions, where even offline storage can rely on vulnerable software, hardware, and transaction‑approval mechanisms.

BlackRock’s fund disclosures show that IBIT held about $62 billion in net assets as of October 30, representing roughly 815,000 BTC.

This equates to nearly 4 % of Bitcoin’s total supply, highlighting the concentration of crypto assets under institutional custody.

Although BlackRock has engaged Anchorage Digital as an additional custodian, quarterly filings indicate no current plans to move Bitcoin away from Coinbase.

Wang argues that such concentration amplifies exposure, as any breach of critical custody infrastructure could jeopardize assets held for investors.

Nevertheless, there is no concrete evidence that IBIT or Coinbase’s systems have been compromised, and Wang’s warning does not prove that North Korean actors are actively targeting the fund.

Potential fallout, however, extends to the insurance and liability coverage protecting the assets.

BlackRock’s annual filing notes that Coinbase’s commercial crime insurance is shared among its client base rather than being dedicated solely to IBIT.

The custody agreement typically caps Coinbase’s liability at $100 million per cold‑storage address, with exceptions outlined in the contract.

Unlike stablecoins, which can be frozen at the token level, Bitcoin lacks a centralized mechanism to restrict stolen coins.

Consequently, IBIT shareholders may face losses that cannot be fully recovered through blockchain tracing, insurance claims, or custodian compensation.

Source link