OneKey founder warns BlackRock’s Bitcoin ETF could be a North Korean target
North Korean hackers could target BlackRock's $62 billion Bitcoin exchange-traded fund (ETF), crypto wallet maker OneKey founder Yishi Wang warned. “I suspect IBIT is already on North Korea's shortlist,” Wang said, following the $6 billion Binance hack that US authorities attributed to North Korea's TraderTraitor operation. The warning puts fresh attention on Coinbase, which serves… Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
North Korean hackers could target BlackRock's $62 billion Bitcoin exchange-traded fund (ETF), crypto wallet maker OneKey founder Yishi Wang warned.
“I suspect IBIT is already on North Korea's shortlist,” Wang said, following the $6 billion Binance hack that US authorities attributed to North Korea's TraderTraitor operation.
The warning puts fresh attention on Coinbase, which serves as the primary Bitcoin custodian for BlackRock's iShares Bitcoin Trust (IBIT), the world's largest spot Bitcoin ETF. CryptoSlate’s April 8 snapshot put funds naming Coinbase in a custody role at more than 80% of US Bitcoin ETF assets.
Coinbase has already made precautionary changes to its offline storage infrastructure following the Binance breach. In an Oct. 29 statement, Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution.
The company maintained that its infrastructure remained secure.
Wang's concern stems from the techniques North Korean attackers have used in previous cryptocurrency thefts, particularly the February 2025 Bybit hack, which resulted in approximately $1.5 billion in losses.
During that operation, hackers compromised a Safe{Wallet} developer's computer through malicious software disguised as legitimate development tooling.
According to a forensic investigation by Sygnia, the attackers manipulated the transaction interface used by Bybit's authorized signers, deceiving them into approving a malicious transfer from a cold wallet.
The attackers did not need to extract the private keys to execute the theft because they had compromised the process through which legitimate transactions were approved.
Similar concerns have emerged following the Binance breach.
Blockchain analytics firm TRM Labs found that the attackers executed coordinated transfers across 10 blockchains, including transactions involving pre-signed authorizations on Ethereum.