OneKey Founder: IBIT May Already Be a Potential Target for North Korean Hackers; Risks of Its Highly Concentrated BTC Custody Cannot Be Ignored

October 30: OneKey founder Yishi said in an analysis that he suspects IBIT is already on North Korea's potential target list. In the February 2025 Bybit hack, attackers compromised a Safe{Wallet} developer's Mac through a malicious project disguised as a legitimate Docker tool, gaining 17 days of access—enough to manipulate the transaction interface used by signers and cause them to unknowingly authorize the theft of $1.5 billion. Yishi noted that TRM Labs is highly confident the Binance incident is linked to TraderTraitor, an organization also linked to the Bybit and DMM Bitcoin thefts; Binance said there is no evidence that private keys were leaked, while TRM believes the attackers may have controlled the signing infrastructure.

Yishi said BlackRock's IBIT holds about 815,000 BTC, worth about $63 billion. Coinbase remains its active Bitcoin custodian; although Anchorage Digital has been designated as an additional custodian, the latest quarterly filing shows there are currently no plans to transfer the bitcoin. This high concentration of bitcoin with a single custodian is very risky. If a major theft occurs and the fund cannot recover the bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT shareholders. Yishi recommends diversifying assets into independent custody setups, keeping private keys offline, independently verifying transaction details on trusted device screens, and continuously reviewing the security architecture.