2 min read
Add as a preferred source on Google

OneKey CEO Raises Hypothetical North Korea Risk to BlackRock’s Bitcoin ETF

Wang’s Oct. 30 post offered no evidence of an active effort against IBIT. The FBI attributed the Binance theft to North Korea on Oct. 31.

Mentioned assets
A sealed steel cabinet sits behind a glass partition / TokenPost.ai
A sealed steel cabinet sits behind a glass partition / TokenPost.ai

OneKey founder and CEO Yishi Wang raised a hypothetical cyber risk to BlackRock’s iShares Bitcoin Trust ETF (IBIT), which holds Bitcoin (BTC), on Oct. 30, a day before the FBI attributed a Binance theft to North Korea.

At 1:42 a.m. ET (5:42 a.m. UTC) that day, Wang wrote, “I suspect IBIT is already on North Korea’s shortlist.” His post expressed suspicion and presented no evidence of an active effort against the fund.

On Oct. 31, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about Oct. 29 and identified the activity as TraderTraitor. The incident’s estimated impact was about $6.3 billion, with roughly $3 billion frozen on-chain. The impact estimate and frozen amount measure different things; neither establishes how much stolen crypto was recovered or the final net loss.

Binance’s initial investigation pointed to a possibly compromised DevOps engineer’s laptop and found no evidence of wallet private-key leaks.

As of June 30, Coinbase Custody Trust Company safeguarded IBIT’s bitcoin, with Anchorage Digital Bank as an additional custodian. BlackRock then had no plans to move the bitcoin to Anchorage. IBIT held 734,261 BTC, valued at $43.40 billion, that day. IBIT’s net assets were $64.69 billion as of Oct. 26.

On Oct. 29, Coinbase was blocking transfers to compromised Binance wallets and had adjusted its cold-storage systems as a precaution. Those actions were not specific to a threat against IBIT.

The way transactions are approved can matter alongside where keys are stored. The FBI attributed about $1.5 billion in the 2025 Bybit theft to TraderTraitor. Attackers used malicious code to change Safe{Wallet}’s interface, showing authorized signers valid transaction details as they approved a fraudulent transfer. That incident illustrates a possible attack route but does not establish a weakness in IBIT’s custody arrangements.

Wang had previously warned that unrecovered theft losses could fall on IBIT shareholders in an earlier warning on potential shareholder losses.

Simon Yoon

Reporter

Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to info@tokenpost.com.

Loading…