Yishi Wang, founder of crypto wallet maker OneKey, warned that North Korean hackers could target BlackRock’s iShares Bitcoin Trust (IBIT), the world’s largest spot Bitcoin exchange-traded fund, citing vulnerabilities in custody infrastructure exposed by recent breaches at major crypto exchanges.
“I suspect IBIT is already on North Korea’s shortlist,” Wang said, following the $6 billion Binance hack that US authorities attributed to North Korea’s TraderTraitor operation. IBIT held 815,000 BTC, or 3.9% of Bitcoin’s maximum supply, as of October 29, with net assets of $62 billion as of October 30.
Coinbase serves as the primary Bitcoin custodian for IBIT. As of April 8, 80% of US Bitcoin ETF assets were held by funds naming Coinbase in their custody arrangements. BlackRock appointed Anchorage Digital as an additional custodian, though the company has no current plans to transfer Bitcoin away from Coinbase as of its June 30 quarterly filing.
Recent Breach Patterns
Wang’s warning drew from attack methods documented in recent exchange breaches. The February 2025 Bybit hack, which cost $1.5 billion, involved attackers compromising a SafeWallet developer’s computer through malicious software disguised as legitimate development tooling. Attackers then manipulated the transaction interface used by authorized signers, deceiving them into approving a malicious transfer from cold wallet storage without extracting private keys.
The Binance breach involved coordinated transfers across 10 blockchains, including pre-signed authorizations on Ethereum. TRM Labs, a blockchain analytics firm, assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance identified a compromised employee laptop as a possible entry point but found no evidence of leaked private keys.
Custody Infrastructure and Insurance
On October 29, Coinbase announced precautionary adjustments to its cold storage systems. The exchange maintained that its infrastructure remained secure despite these changes. Jeff Lunglhofer, Coinbase’s Chief Security Officer, did not provide specific details on the adjustments in public statements reviewed.
Coinbase maintains commercial crime insurance shared among its customers rather than coverage reserved exclusively for IBIT. Coinbase’s liability limit per cold storage address stands at $100 million. Bitcoin has no centralized mechanism for restricting stolen assets, unlike stablecoins, which could complicate recovery efforts if a theft occurred.
Current Status
No evidence has emerged that IBIT or Coinbase’s custody systems have been compromised. Wang’s warning does not establish that North Korean hackers are actively targeting the fund. Sygnia, a forensic investigation firm, and TRM Labs have been involved in analyzing the Binance breach mechanics, but neither has issued public assessments of IBIT-specific risks.
BlackRock and Coinbase have not publicly responded to Wang’s warning as of available reports.
