BlackRock's Bitcoin ETF Targeted as Potential Target for North Korean Hackers

• The CEO of OneKey estimates that a large-scale attack could result in losses of USD 4 per share.
• An attack similar to that on Binance could compromise 9.5% of the fund's reserves.

BlackRock's fund could become an attractive target for North Korean hacker groups. The founder of OneKey issued the warning while assessing the security risks of concentrating large bitcoin reserves in a single custody infrastructure.

Yishi Wang's alert comes after the attack on Binance, whose impact was estimated at USD 6.3 billion according to information released on October 30, 2026. For the executive, funds with large reserves of digital assets may attract the interest of groups capable of exploiting vulnerabilities in the systems that protect those resources.

The center of his concern is the iShares Bitcoin Trust (IBIT), which, according to the figures he cited, held 815,000 BTC valued at nearly USD 63 billion. Coinbase is listed as the sole custodian of those reserves, a configuration that, in Wang's view, represents a concentration point that deserves special attention.

The founder of OneKey illustrated the potential consequences with a hypothetical scenario based on the Binance incident. A comparable magnitude attack against the fund could compromise 9.5% of its assets and translate into losses of USD 4 per share. This is not a recorded damage or a prediction, but an estimate used to gauge potential exposure.

The concern also relates to the possibilities of recovering assets after a theft. Wang contrasted what happened with the stablecoins stolen during the Binance attack: Circle and Tether jointly froze over USD 2.3 billion, thanks to their issuers being able to intervene on the tokens they manage, as explained by CriptoNoticias.

Bitcoin works differently. Without an issuing entity that can block its units, there is no equivalent mechanism to immobilize stolen BTC through a centralized decision. This could complicate the recovery of funds if an attacker manages to withdraw coins from a custody infrastructure and maintains control over them.

To this difficulty are added the limits of Coinbase's financial protections. The company has revealed coverage against crimes of USD 320 million, but Wang noted that this is distributed among its clients. Additionally, custody agreements establish liability limits of USD 100 million for each cold storage address.

For the executive, these amounts could prove insufficient in the event of a large-scale incident. In that scenario, ETF holders could absorb most of the losses that exceed the available coverages. However, the cited data does not allow for a prior determination of how a claim would be resolved or how much affected investors would receive.

Wang did not assert that there is an operation underway against the IBIT nor did he present evidence of a breach at Coinbase. His warning focuses on the fact that the size of the reserves, the dependence on a custodian, and the limitations of the coverages create an exposure that should not be ignored.

The founder of OneKey recommended maintaining constant vigilance over protective measures and avoiding the assumption that a history without incidents guarantees permanent security. His call to operate in "bunker mode" summarizes the caution that, in his view, sector participants should maintain.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.