North Korean hackers could target BlackRock's $62 billion Bitcoin exchange-traded fund, according to Yishi Wang, the founder of cryptocurrency wallet maker OneKey. His warning came after a $6 billion hack of Binance that United States authorities linked to North Korea's TraderTraitor group. Coinbase, the fund's primary custodian, said it had adjusted its cold storage systems as a precaution.

"I suspect [the fund] is already on North Korea's shortlist," Wang said in a post published on Oct. 30, 2026.

The comments place renewed attention on Coinbase, the exchange that serves as the main Bitcoin custodian for BlackRock's iShares Bitcoin Trust (IBIT), the world's largest spot Bitcoin ETF. A CryptoSlate snapshot from April 8 found that funds naming Coinbase in a custody role held more than 80% of US Bitcoin ETF assets — a figure that underscores the custodian's central role in the market for US spot Bitcoin products.

Wang laid out his reasoning in a post on X:

I suspect IBIT is already on North Korea's shortlist. In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer's Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving…

— Yishi (@ohyishi) October 30, 2026

Coinbase Adjusts Cold Storage After Binance Breach

In an Oct. 29 statement, Coinbase Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to wallets compromised in the Binance incident. He added that Coinbase had adjusted its cold storage systems out of an abundance of caution, and the company said its infrastructure remained secure.

Wang's concern is grounded in the methods North Korean hacking groups have used in previous attacks. TraderTraitor is the label US authorities apply to North Korean-linked cyber activity aimed at cryptocurrency companies, a pattern behind some of the largest thefts the industry has recorded. In February 2025, attackers stole about $1.5 billion from the exchange Bybit, at the time the largest cryptocurrency theft on record; the Binance breach, at roughly $6 billion, is several times larger. In the Bybit incident, hackers broke into a Safe{Wallet} developer's computer using malicious software disguised as ordinary development tools. A forensic investigation by Sygnia found that they altered the screen Bybit's signers used to approve transactions. The signers were tricked into approving a transfer from a cold wallet, and the attackers did not need to steal private keys because they controlled the approval process.

Blockchain analytics firm TRM Labs found that the attackers behind the Binance breach made coordinated transfers across 10 blockchains, with some transactions using pre-signed authorizations on Ethereum. TRM said the attack likely involved compromised hot-wallet signing systems. Binance first attributed the breach to a compromised employee laptop before disclosing additional breach points, and the exchange said investigators found no evidence of leaked private keys.

How Much Bitcoin the Fund Holds

BlackRock's own data shows the fund held about $62 billion in net assets as of Oct. 30. Its Oct. 29 holdings file listed roughly 815,000 BTC, or approximately 3.9% of Bitcoin's maximum supply. BlackRock has also added Anchorage Digital as another custodian for the trust, though the firm's June 30 quarterly filing said the fund has no current plans to move Bitcoin away from Coinbase. Any future change to that arrangement would become visible through the trust's periodic filings and holdings disclosures.

There is no evidence that the fund or Coinbase's custody systems have been compromised, and Wang's warning does not indicate that North Korean hackers are actively targeting the fund.

BlackRock's annual filing shows that Coinbase holds commercial crime insurance that is shared among all of its customers; the coverage is not reserved exclusively for the fund. Under the custody agreement, Coinbase's liability is generally limited to $100 million per cold storage address, with some contractual exceptions — a limit that is small relative to the fund's roughly $62 billion in net assets.

Unlike stablecoins, which issuers can freeze, Bitcoin has no central mechanism that can be used to block stolen coins. That means shareholders could face losses that tracing, insurance, or custodian payments may not fully cover.

At the time of the report, Bitcoin traded at about $77,874, down 0.22% over the previous 24 hours and 7.92% over the past 30 days.