OneKey founder: Suspects BlackRock's IBIT has been targeted by North Korean hackers, large concentration of Bitcoin with a single custodian makes it difficult to mitigate risks.

BlockBeats news, October 30: Yishi, founder of OneKey, posted on social media that he suspects BlackRock's spot Bitcoin ETF, IBIT, has been added to North Korea's target list.

Yishi stated that the attackers behind the Bybit hack previously breached a Safe{Wallet} developer's Mac through a malicious project disguised as a legitimate Docker-related tool. They had been lurking for 17 days before carrying out the theft, giving them ample time to manipulate the transaction interface used by Bybit's signers. The signers believed they were approving a legitimate transaction. However, they unknowingly authorized the theft of $1.5 billion from cold wallets. Even with private keys kept offline, signers can still approve a theft through a compromised interface.

BlackRock's IBIT is the world's largest Bitcoin ETF, holding approximately 815,000 BTC, valued at about $63 billion. Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been designated as an additional custodian, the fund's latest quarterly filing shows there are currently no plans to transfer any Bitcoin to that platform.

Concentrating such a massive amount of Bitcoin in the hands of a single custodian is extremely rare. Regardless of how large or well-funded the provider is, a serious failure in its security infrastructure could put the entire fund at risk. A $6 billion theft would wipe out approximately 9.5% of IBIT's assets, equivalent to a loss of about $4 per share at current valuations.

Binance successfully froze some of the stolen stablecoins. But Bitcoin has no such mechanism, making stolen BTC extremely difficult to recover. BlackRock does not carry separate insurance on the Bitcoin held by the fund. Coinbase discloses $320 million in commercial crime insurance coverage, shared among its clients. Its custody agreement also stipulates a liability cap of $100 million per cold storage address, with any recovery subject to contractual terms, liability determinations, and other conditions. If a major theft occurs and the fund cannot recover the Bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT's shareholders.

Bitcoin ETFs have made holding Bitcoin much easier, and this convenience has tangible value. But as more capital flows into these products, massive amounts of Bitcoin are being concentrated in the hands of a few custodians and the infrastructure they rely on. The larger these pools of capital, the more attractive they become to attackers. The consequences of any critical node being compromised could extend far beyond a single institution.