OneKey founder flags BlackRock Bitcoin ETF as possible North Korea target

What happened

OneKey founder Yishi Wang has warned that BlackRock's iShares Bitcoin Trust could become a target for North Korean hackers, saying he suspects the fund is already on the country's shortlist. CryptoSlate reported that the warning followed a $6 billion Binance breach that US authorities attributed to North Korea's TraderTraitor operation. The comment drew attention to Coinbase, which serves as the primary Bitcoin custodian for IBIT, the world's largest spot Bitcoin ETF.

Coinbase had already announced precautionary changes. In an Oct. 29 statement, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution. Coinbase maintained that its infrastructure remained secure. CryptoSlate also noted that an April 8 snapshot it compiled found funds naming Coinbase as custodian held more than 80% of US Bitcoin ETF assets.

IBIT's scale is central to the concern. BlackRock fund data showed about $62 billion in net assets as of Oct. 30, and an Oct. 29 holdings file listed roughly 815,000 BTC, nearly 4% of Bitcoin's maximum supply. BlackRock has added Anchorage Digital as another custodian, but its June 30 quarterly filing said the fund had no current plans to move Bitcoin away from Coinbase. There is no evidence that IBIT or Coinbase's custody systems have been compromised, and Wang's warning does not establish that North Korean hackers are actively targeting the fund.

Why it matters

The warning highlights a custody concentration issue for institutional Bitcoin products. Even assets held in offline storage depend on software, hardware and transaction-approval systems, and the reports point to past attacks that exploited those layers rather than private keys alone. Because Bitcoin has no centralized mechanism for freezing stolen assets, unlike stablecoins that issuers can freeze, IBIT shareholders could be exposed to losses that might not be fully recovered through blockchain tracing, insurance claims or compensation from the custodian, according to CryptoSlate. The report also noted that Coinbase maintains commercial crime insurance shared among customers rather than reserved exclusively for IBIT, and that the custody agreement generally limits Coinbase's liability to $100 million per cold storage address, subject to contractual exceptions.

What the data shows

99Bitcoins reported that Bitcoin traded at $78,210 on Nov. 2 after US spot Bitcoin ETFs recorded $643.3 million in net outflows on Friday, their largest one-day outflow since June 25. The redemptions erased $440.7 million that had entered over the previous four sessions and left October $515.9 million in the red. BlackRock's IBIT lost $233.7 million and Fidelity's FBTC $201 million, while the ETFs still held $98.14 billion, according to SoSoValue data cited by 99Bitcoins. Laevitas analyst Rick Maeda said the outflow was under 1% of assets and described it as "simply a de-risking day, and not capitulation."

Background

The concern draws on techniques used in earlier crypto thefts. In the February 2025 Bybit hack, which resulted in about $1.5 billion in losses, attackers compromised a Safe{Wallet} developer's computer through malicious software disguised as legitimate development tooling, according to CryptoSlate. A Sygnia forensic investigation found that the attackers manipulated the transaction interface used by Bybit's authorized signers, deceiving them into approving a malicious transfer from a cold wallet. The attackers did not need to extract private keys because they had compromised the approval process.

After the Binance breach, blockchain analytics firm TRM Labs found coordinated transfers across 10 blockchains, including pre-signed authorizations on Ethereum, and assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance initially identified a compromised employee laptop as a possible entry point before disclosing additional breach points, and said investigators found no evidence of leaked private keys. CryptoSlate reported that these incidents have raised questions about institutional custody arrangements.

What is still unclear

The reports leave several questions open. Neither report says whether Wang's warning is based on specific intelligence about an active plot against IBIT; it links his concern to techniques used in prior attacks and to IBIT's size and custody arrangement. No authority has named IBIT as a target. 99Bitcoins also noted that Wang sells hardware wallets, making self-custody part of his business, a detail relevant to assessing the warning. CryptoSlate said there is no evidence of a compromise at IBIT or Coinbase.

What to watch

Attention is likely to remain on Coinbase's custody controls and on any disclosures from BlackRock or Coinbase about cold storage, insurance and liability arrangements. ETF flow data will also be watched after the reported outflows, along with any official attribution or statement about targeting. The reports do not indicate that a breach has occurred, so any change in that assessment would be significant.

Questions readers ask