TLDR
- Crypto wallet developer OneKey’s founder Yishi Wang flagged BlackRock’s massive Bitcoin ETF as a likely target for North Korean cybercriminals.
- Wang’s alert came in the aftermath of Binance’s $6 billion security breach, attributed by U.S. officials to North Korea’s TraderTraitor hacking collective.
- Custodian Coinbase announced precautionary modifications to its cold storage infrastructure in response to the threat landscape.
- As of October 29, BlackRock’s fund managed approximately 815,000 BTC, representing nearly 3.9% of Bitcoin’s total capped supply.
- No security breaches affecting the ETF or Coinbase’s custodial infrastructure have been detected to date.
BlackRock’s $62 billion Bitcoin exchange-traded fund may already be in the crosshairs of North Korean state-sponsored hackers, according to a security warning from Yishi Wang, the creator of hardware wallet company OneKey.
“I suspect [the fund] is already on North Korea’s shortlist,” Wang stated. His alert came on the heels of the massive $6 billion Binance security breach, which American law enforcement agencies traced back to North Korea’s TraderTraitor hacking operation.
Wang’s remarks have intensified scrutiny on Coinbase, which serves as the primary custodian of Bitcoin holdings for BlackRock’s iShares Bitcoin Trust—currently the largest spot Bitcoin ETF globally.
Data compiled by CryptoSlate in an April 8 analysis revealed that funds listing Coinbase in a custodial capacity controlled over 80% of total assets across U.S. Bitcoin ETFs.
Coinbase Implements Cold Storage Changes Following Binance Attack
On October 29, Coinbase Chief Security Officer Jeff Lunglhofer released a statement confirming the exchange was preventing transfers to wallets compromised in the Binance incident. He further disclosed that Coinbase had modified its cold storage architecture as a preventive measure.
The firm emphasized that its security infrastructure continues to operate without compromise.
Wang’s concerns stem from tactics previously deployed by North Korean cyber operatives. In February 2025, threat actors extracted approximately $1.5 billion from the cryptocurrency exchange Bybit.
During that incident, hackers infiltrated a Safe{Wallet} developer’s workstation through malicious code embedded within seemingly legitimate development utilities. Forensic analysis conducted by cybersecurity firm Sygnia revealed the attackers manipulated the interface used by Bybit’s authorized signers when validating transactions.
The authorized signers were deceived into green-lighting a withdrawal from cold storage. The perpetrators circumvented the need to steal private keys by hijacking the transaction approval workflow itself.
Blockchain intelligence provider TRM Labs determined that the Binance attackers executed synchronized asset movements across 10 different blockchain networks. Several transactions leveraged pre-authorized signatures on the Ethereum network.
TRM’s assessment suggested the attack likely exploited vulnerabilities in hot-wallet authorization systems. Binance initially attributed the breach to a compromised employee device, before subsequently revealing additional points of penetration. The platform maintained that forensic teams discovered no indication of private key exposure.
Bitcoin Holdings in BlackRock’s ETF
According to BlackRock’s official figures, the fund managed approximately $62 billion in net assets as of October 30. The fund’s October 29 holdings document disclosed roughly 815,000 BTC under management, equivalent to about 3.9% of Bitcoin’s hard-capped maximum supply.
BlackRock has brought on Anchorage Digital as an additional custody provider. Nevertheless, the fund’s June 30 quarterly disclosure indicated no immediate intentions to redistribute Bitcoin holdings away from Coinbase.
Currently, no evidence exists suggesting the fund or Coinbase’s custody systems have suffered any security compromise. Wang’s advisory likewise does not confirm active targeting by North Korean hackers.
BlackRock’s annual regulatory filing reveals that Coinbase maintains commercial crime insurance coverage pooled across its entire client base. This protection is not exclusively allocated to the Bitcoin ETF.
The custody terms typically cap Coinbase’s financial responsibility at $100 million per individual cold storage address, subject to certain contractual provisions.
Unlike stablecoins—which issuers can freeze on-chain—Bitcoin lacks any centralized mechanism to immobilize stolen tokens. Consequently, fund shareholders could potentially absorb losses that blockchain tracing, insurance payouts, or custodian compensation might not completely offset.
Bitcoin was trading around $77,874 at the time of publication, reflecting a 0.22% decline over the previous 24 hours and a 7.92% decrease across the preceding 30 days.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
