Yishi Wang, founder of crypto wallet manufacturer OneKey, has warned that BlackRock’s $62 billion iShares Bitcoin Trust could become a target for North Korean hacking groups. The alert follows a high-profile $6 billion hack at Binance, which US authorities attributed to North Korea’s TraderTraitor cybercrime group.
Security alarms after Binance breach
Wang stated, “I suspect [the fund] is already on North Korea’s shortlist.” His remarks have brought renewed scrutiny to how BlackRock, the world’s largest asset manager, safeguards its sizable digital holdings.
Coinbase, a leading US-based crypto exchange, serves as the primary Bitcoin custodian for BlackRock’s spot ETF. A CryptoSlate report from April showed that more than 80% of US Bitcoin ETF assets are managed by funds using Coinbase as their custodian.
I suspect IBIT is already on North Korea’s shortlist. In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s computer using malicious software that mimicked legitimate tools, maintaining access for over two weeks before orchestrating the theft.
In response to the recent Binance attack, Coinbase Chief Security Officer Jeff Lunglhofer said the company is proactively blocking transfers to affected Binance wallets and has adjusted its cold storage procedures as a precaution. Lunglhofer emphasized that Coinbase’s infrastructure remains secure despite the incidents affecting other exchanges.
North Korean hacking methods raise concerns
Wang’s concerns were influenced by the tools and tactics employed by North Korean attackers in previous incidents. The Bybit hack in February 2025 saw hackers use deceptive software to infiltrate the computer of a Safe{Wallet} developer, ultimately stealing approximately $1.5 billion from the exchange. Investigators from cybersecurity firm Sygnia found that the attackers manipulated the interface Bybit signers used to authorize transactions, allowing the theft of funds from cold storage without directly accessing private keys.
In the Binance breach, blockchain analytics company TRM Labs discovered that hackers coordinated asset transfers across multiple chains using pre-signed authorizations, particularly on Ethereum. The analysis suggested that compromised hot-wallet signing systems played a central role. Despite initial findings pointing to a single employee’s laptop, Binance later disclosed multiple vulnerabilities but clarified that private keys were not leaked.
Mini dictionary: TraderTraitor, identified by US authorities as a North Korean hacking group, specializes in sophisticated cyberattacks targeting cryptocurrency platforms. The group often exploits software supply chains and employs phishing tactics to access sensitive infrastructure.
Asset exposure and protection measures
As of October 30, BlackRock reported that its Bitcoin ETF held $62 billion in net assets, representing about 815,000 BTC or roughly 3.9% of Bitcoin’s total maximum supply. Anchorage Digital, a regulated crypto custodian, was recently added as an additional custodian partner. Yet, BlackRock’s regulatory filing dated June 30 stated that the firm does not currently intend to transfer any Bitcoin away from Coinbase.
| Asset | Current Holdings | % of Bitcoin Max Supply | Main Custodian |
|---|---|---|---|
| iShares Bitcoin Trust | 815,000 BTC | 3.9% | Coinbase |
No evidence has surfaced so far that either Coinbase’s custody systems or the ETF itself has been compromised. Wang’s comments remain a warning and do not confirm that North Korean hackers have launched any attack on the fund.
BlackRock’s annual disclosures state that Coinbase’s commercial crime insurance applies to all clients and is not reserved for the Bitcoin ETF alone. The custody agreement usually caps Coinbase’s liability at $100 million per cold storage address, with certain exceptions spelled out in contracts.
Unlike stablecoins, which can be frozen by their issuers in the event of suspicious activity, Bitcoin lacks a mechanism for centrally blocking transactions. This exposes ETF shareholders to potential losses in the event of a large-scale hack, as insurance, tracing, or custodial compensation may not fully recover lost assets.
Bitcoin traded near $77,874 at the time of the report, reflecting a 0.22% decline over the past day and a 7.92% decrease in the past 30 days.
