North Korean hackers could target BlackRock’s $62 billion Bitcoin exchange-traded fund (ETF), crypto wallet maker OneKey founder Yishi Wang warned.
“I suspect IBIT is already on North Korea’s shortlist,” Wang said, following the $6 billion Binance hack that US authorities attributed to North Korea’s TraderTraitor operation.
The warning puts fresh attention on Coinbase, which serves as the primary Bitcoin custodian for BlackRock’s iShares Bitcoin Trust (IBIT), the world’s largest spot Bitcoin ETF. CryptoSlate’s April 8 snapshot put funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets.
Coinbase has already made precautionary changes to its offline storage infrastructure following the Binance breach. In an Oct. 29 statement, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution.
The company maintained that its infrastructure remained secure.
Why BlackRock’s Bitcoin ETF could face significant risks
Wang’s concern stems from the techniques North Korean attackers have used in previous cryptocurrency thefts, particularly the February 2025 Bybit hack, which resulted in approximately $1.5 billion in losses.
During that operation, hackers compromised a Safe{Wallet} developer’s computer through malicious software disguised as legitimate development tooling.
According to a forensic investigation by Sygnia, the attackers manipulated the transaction interface used by Bybit’s authorized signers, deceiving them into approving a malicious transfer from a cold wallet.
The attackers did not need to extract the private keys to execute the theft because they had compromised the process through which legitimate transactions were approved.
Similar concerns have emerged following the Binance breach.
Blockchain analytics firm TRM Labs found that the attackers executed coordinated transfers across 10 blockchains, including transactions involving pre-signed authorizations on Ethereum.
TRM assessed that the attack likely involved compromised hot-wallet signing infrastructure.
Binance initially identified a compromised employee laptop as a possible entry point before disclosing additional breach points. The exchange maintained that investigators had found no evidence of leaked private keys.
These incidents have raised questions about the security of institutional custody arrangements, where offline storage can still depend on vulnerable software, hardware, and transaction approval systems.
According to BlackRock’s fund data, IBIT held approximately $62 billion in net assets as of Oct. 30. Its Oct. 29 holdings file listed roughly 815,000 BTC.
That represents nearly 4% of Bitcoin’s maximum supply, making the fund a particularly consequential concentration of cryptocurrency under institutional custody.
Although BlackRock has appointed Anchorage Digital as an additional custodian, its June 30 quarterly filing said the fund has no current plans to transfer Bitcoin away from Coinbase.
Wang argued that this concentration creates significant exposure because a compromise affecting critical custody infrastructure could threaten assets held on behalf of investors.
However, there is no evidence that IBIT or Coinbase’s custody systems have been compromised, and Wang’s warning does not establish that North Korean hackers are actively targeting the fund.
The potential financial consequences nevertheless extend to the insurance and liability protections covering the assets.
BlackRock’s annual filing shows that Coinbase maintains commercial crime insurance shared among its customers, rather than coverage reserved exclusively for IBIT.
The custody agreement also generally limits Coinbase’s liability to $100 million per cold storage address, subject to contractual exceptions and other provisions.
Unlike stablecoins, which issuers can freeze at the token level, Bitcoin has no equivalent centralized mechanism for restricting stolen assets.
That leaves IBIT shareholders potentially exposed to losses that may not be fully recovered through blockchain tracing, insurance claims, or compensation from its custodian.
