OneKey Founder Warns BlackRock 62 Billion USD Bitcoin ETF Could Be North Korea Next Target Why Custody Concentration Keeps Him Up at Night

The founder of crypto hardware wallet maker OneKey has issued a stark warning that BlackRock’s iShares Bitcoin Trust, the largest spot Bitcoin exchange-traded fund in the world, may already be in the crosshairs of North Korean state-sponsored hackers. The claim, made by OneKey chief Yishi Wang on social media, lands less than a week after United States authorities formally attributed the record-breaking 6 billion USD Binance hack to Pyongyang’s TraderTraitor operation.

A 62 Billion USD Target Sitting in One Place

Wang did not mince words. “I suspect IBIT is already on North Korea’s shortlist,” he wrote, pointing to the fund’s enormous and visible concentration of Bitcoin. According to BlackRock’s own fund data, IBIT held approximately 62 billion USD in net assets as of October 30, with its latest holdings file listing roughly 815,000 BTC. That staggering figure represents nearly 4 percent of Bitcoin’s maximum future supply, all sitting under institutional custody.

The warning turns a fresh spotlight on Coinbase, which serves as the primary Bitcoin custodian for IBIT. An April analysis by CryptoSlate found that funds naming Coinbase in a custody role accounted for more than 80 percent of all United States Bitcoin ETF assets. In plain terms, if something went wrong inside Coinbase’s custody stack, the blast radius would cover most of the American spot ETF market, not just one fund.

Coinbase has not been idle since the Binance catastrophe. In an October 29 statement, Chief Security Officer Jeff Lunglhofer said the exchange was already blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution. The company maintains that its infrastructure remains secure, and it is important to stress that there is no evidence whatsoever that IBIT or Coinbase custody systems have been compromised. Wang’s warning is a risk assessment, not a report of a breach.

Why Cold Storage Is Not a Magic Shield

The uncomfortable lesson of the past two years is that “cold” does not mean untouchable. The February 2025 Bybit hack, which cost roughly 1.5 billion USD, did not involve stolen private keys at all. According to forensic investigators at Sygnia, the attackers compromised a developer machine at wallet interface provider Safe through malicious software disguised as legitimate tooling, then manipulated the transaction screen that Bybit’s authorized signers saw. The signers believed they were approving a routine transfer. They were signing a heist.

The Binance breach followed a similar chilling pattern. Blockchain analytics firm TRM Labs, which documented the 6.36 billion USD theft, found that attackers executed coordinated transfers across ten different blockchains, including transactions involving pre-signed authorizations on Ethereum. TRM assessed that the attack likely involved compromised hot-wallet signing infrastructure. Binance initially pointed to a compromised employee laptop before disclosing additional breach points, while insisting investigators found no evidence of leaked private keys.

The pattern is the point. Modern crypto heists increasingly target the humans, machines, and approval workflows that surround private keys rather than the keys themselves. Institutional custody arrangements, for all their audits and compliance certificates, still depend on software, hardware, and transaction approval systems that can be compromised.

What Happens if the Worst Occurs

For everyday investors, the scariest part of the IBIT scenario is the recovery math. BlackRock’s annual filing shows that Coinbase maintains commercial crime insurance that is shared among all of its custody customers, rather than a dedicated policy reserved exclusively for IBIT. The custody agreement also generally limits Coinbase’s liability to 100 million USD per cold storage address, subject to contractual exceptions. Against a hypothetical multibillion-dollar loss, those numbers are a drop in the ocean.

There is another structural problem. Unlike stablecoins, which issuers can freeze at the token level the moment stolen funds hit a blacklisted wallet, Bitcoin has no centralized kill switch. Once BTC moves, no issuer, foundation, or court can claw it back unilaterally. The industry has already watched Tether and Circle freeze 2.6 billion USD in suspected Binance hack funds, a lever that simply does not exist for Bitcoin held in an ETF wrapper.

BlackRock has taken at least one diversification step, appointing Anchorage Digital as an additional custodian. But its June 30 quarterly filing states plainly that the fund has no current plans to move its Bitcoin away from Coinbase. Concentration, for now, remains the design.

The Bottom Line for Investors

None of this means IBIT holders should panic. No breach has occurred, Coinbase has acted quickly on precautionary measures, and the FBI’s public attribution of the Binance hack has pushed the entire institutional custody industry into defensive overdrive. But Wang’s warning articulates something the market has been forced to learn the hard way this month: the single greatest systemic risk in crypto is no longer a shady offshore exchange. It is the possibility that the most trusted names in institutional finance are holding record amounts of Bitcoin behind infrastructure whose weakest link is a compromised laptop, a poisoned approval screen, or a rogue employee workstation.

For anyone holding Bitcoin through an ETF rather than self-custody, the trade-off has always been convenience for counterparty trust. This week, the price of that trust got a public stress test. Watch custody disclosures in the coming quarterly filings, because if the shortlist warning is ever proven right, the answer to “who insures my ETF Bitcoin” will matter more than any price chart.

Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.