OneKey CEO Warns BlackRock's $63B Bitcoin (BTC) ETF Is a North Korean Target

IBIT Holds 815,000 BTC Behind One Custodian

Yishi Wang, founder and chief executive of Hong Kong-based open-source hardware wallet maker OneKey, warned on Friday that North Korean hacking groups may have picked their next target after Binance: BlackRock's iShares Bitcoin (BTC) Trust (IBIT), the largest ETF in the Bitcoin market. In a public post on X, Wang argued that scale alone makes the fund a magnet for attackers. IBIT holds 815,000 BTC worth nearly $63 billion, a pool that makes the fund a crypto whale many times over, and its assets sit with a single custodian, Coinbase, a concentration Wang called an extreme risk for one entity to carry. “No matter how large or well-capitalized a service provider may be, a major failure in its security infrastructure could put the entire fund at risk,” he wrote. The dominance is the core of his argument: no other spot Bitcoin vehicle comes close to that scale, so a successful hit would land on the single largest institutional pool of the asset in existence. The warning landed while the industry was still absorbing Thursday's breach at Binance, the world's largest crypto exchange, a hack estimated at $6.3 billion, and the wider Bitcoin (BTC) market has been pricing the fallout; the Bitcoin (BTC) price slipped 5% over the past 24 hours. OneKey sells hardware wallets for self-custody, so the company has a commercial stake in the debate, but the holdings figure and the custody structure in Wang's post come from the fund's own disclosures, and security-focused voices across the sector spent the past day asking which venue the attackers would consider next.

The arithmetic in the post is specific. Wang calculates that an attack on IBIT of the scale Binance suffered would erase roughly 9.5% of the fund's assets, a loss of about $4 per share at the current valuation, spread across all investors. The Binance comparison cuts both ways. After Thursday's hack, Circle and Tether moved quickly to freeze more than $2.3 billion in stolen stablecoins, shrinking the attacker's haul; no centralized issuer can freeze stolen BTC, so funds taken from a Bitcoin fund would be far harder to recover. The insurance backstop is thinner than it looks. Coinbase discloses $320 million in crime insurance, but Wang notes the coverage is shared across the custodian's customers and the custody agreements cap liability at $100 million per cold storage address, which would leave IBIT holders absorbing the primary losses in a major incident. Convenience is what built the fund, and it is also the exposure: spot ETFs exist so institutions and individuals can hold the asset without managing keys, and ETF flows had recently flipped toward strong accumulation before the hack unsettled the market. Wang frames the problem as structural rather than specific to any provider: “The larger these pools grow, the more attractive they become to attackers, and a compromise at any critical link can have consequences that reach beyond a single institution.” His closing advice borrows a phrase from blockchain researcher Justin Drake: “There is no silver bullet in security and no permanent guarantee. Stay vigilant, verify continuously, and never mistake an incident-free record for proof of safety. Enter fortress mode.” The market context is measurable too: we tracked Bitcoin (BTC) sliding to a six-week low after the Binance hack.

What the Warning Does Not Count

The warning rests on a modeled scenario, not an observed campaign. Nothing in the public record shows an active attempt against IBIT, and the 9.5% figure is a projection built on the Binance loss rather than a measured exposure. What the numbers cannot count is the attacker side of the ledger: they describe how much value sits behind one custodian, but nothing about which capabilities North Korean groups are actually pointing at the fund today. The custodial dependency Wang flags is the same trade-off holders accept with Wrapped Bitcoin, and investors who prefer to HODL their own keys will read the post as an argument for exactly that. On the price side of the aftermath, our Bitcoin technical analysis tracks the levels the market is watching next.