CryptoSlate
OneKey founder Yishi Wang warned that BlackRock’s iShares Bitcoin Trust, or IBIT, could be a target for North Korean hackers after US authorities attributed a $6 billion Binance hack to North Korea’s TraderTraitor operation. IBIT held about $62 billion in net assets and roughly 815,000 BTC as of Oct. 29, equal to about 3.9% of Bitcoin’s maximum supply.
Why it matters
Coinbase is IBIT’s primary Bitcoin custodian. A CryptoSlate snapshot put funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets. BlackRock has also appointed Anchorage Digital as an additional custodian, but its June 30 filing said the fund had no current plans to move Bitcoin away from Coinbase.
The concern is not limited to private keys or online wallets. In the 2025 Bybit hack, attackers reportedly compromised a developer’s computer and manipulated the transaction interface used by authorized signers. The incident showed how a compromised approval process can enable a malicious transfer even when assets are held in cold storage.
Market impact
Coinbase said it adjusted its cold storage systems as a precaution after the Binance breach and maintained that its infrastructure remained secure. There is no evidence that IBIT or Coinbase’s custody systems have been compromised, and Wang’s warning does not establish an active attack on the fund.
The potential exposure also depends on the limits of recovery. Coinbase’s commercial crime insurance is shared among customers, while its custody agreement generally caps liability at $100 million per cold storage address, subject to exceptions. Bitcoin has no issuer-level mechanism to freeze stolen coins, leaving investors reliant on tracing, insurance and any custodian compensation.
Frequently asked questions
-
How much Bitcoin did IBIT hold in its Oct. 29 holdings file?
IBIT listed roughly 815,000 BTC, representing about 3.9% of Bitcoin’s maximum supply.
-
Why does the Bybit hack raise concerns about cold storage?
Attackers manipulated the transaction interface used by authorized signers, showing that compromised approval systems can enable transfers without extracting private keys.
-
Who is IBIT’s primary Bitcoin custodian?
Coinbase is IBIT’s primary custodian. BlackRock has also appointed Anchorage Digital as an additional custodian.
-
Has BlackRock said it plans to move IBIT’s Bitcoin from Coinbase?
BlackRock’s June 30 filing said IBIT had no current plans to transfer Bitcoin away from Coinbase.
-
What limits could affect recovery if Bitcoin is stolen from custody?
Coinbase’s commercial crime insurance is shared among its customers, and its custody agreement generally limits liability to $100 million per cold storage address, subject to exceptions. Bitcoin has no issuer-level mechanism to freeze stolen coins.
TheBlock
CoinTelegraph
Lookonchain
WuBlockchain
CoinDesk