ABAB News Logo
Back to Flash News

OneKey Founder Yishi: Suspects IBIT Has Already Been Added to North Korea’s Potential Target List

OneKey founder Yishi posted on social media around October 30, 2026, saying that he suspects BlackRock’s spot Bitcoin ETF IBIT may already have been added to North Korea’s potential target list. Citing the February 2025 Bybit incident, Yishi said that attackers infiltrated a Safe{Wallet} developer’s Mac computer by posing as a malicious project disguised as a legitimate Docker-related tool, lurked for about 17 days, and then manipulated the trading interface used by signers, causing the signer to unknowingly approve the theft of about $1.5 billion in assets from a cold wallet.

Yishi said that IBIT is the world’s largest Bitcoin ETF, holding about 815,000 BTC worth about $63 billion. Coinbase remains its active Bitcoin custodian; although Anchorage Digital has been designated as an additional custodian, the fund’s latest quarterly filing shows that there is currently no plan to transfer Bitcoin to that platform. Yishi pointed out that concentrating Bitcoin of such a scale in a single custodian carries high risk; a theft of about $60 billion would wipe out about 9.5% of IBIT’s assets, equivalent to a loss of about $4 per share at current valuations.

Yishi further said that BlackRock has not separately insured the Bitcoin held by IBIT. The business crime insurance disclosed by Coinbase covers $320 million and is shared by its clients; the custody agreement stipulates a liability cap of $100 million per cold storage address. If a major theft occurs and the fund cannot recover the Bitcoin or obtain sufficient compensation, the remaining losses will ultimately be borne by IBIT shareholders. Yishi also mentioned that Binance successfully froze part of the stolen stablecoins in the relevant incident, while Bitcoin lacks a similar mechanism, making recovery more difficult. The above content is all Yishi’s personal analysis and opinions, and OpenAI, BlackRock, or Coinbase have not issued any official confirmation or response on this matter.

Original sources:

  1. Title: OneKey Founder: IBIT May Already Be a Potential Target for North Korean Hackers; Risks of Its Highly Concentrated BTC Custody Cannot Be Ignored Publisher: PANews Publication date: 2026-10-30 URL: https://www.panews.io/articles/01a18b6e-784c-74d7-b258-c15c17bb87a4 Source type: media report Verification status: Full page read in this session, verification date 2026-10-30 Supporting content: Yishi’s suspicion that IBIT has already been added to North Korea’s potential target list, details of the Bybit incident, IBIT holdings and custody arrangements, and statements related to insurance and liability caps

  2. Title: ByBit / Safe{Wallet}: how Lazarus stole $1.5B by flipping a flag from operation=0 to operation=1 Publisher: IRONHACKERS (citing forensic reports from Sygnia and others) Publication date: 2025-02-24 URL: https://ironhackers.es/en/bybit-hack-lazarus-safewallet/ Source type: media report Verification status: Read the attack chain and timeline-related passages in this session, verification date 2026-10-30 Supporting content: Safe developer’s Mac was infiltrated through a malicious Docker project, about 17 days of lurking, and interface manipulation led to about $1.5 billion being stolen (does not prove IBIT was targeted in this case)

  3. Title: BlackRock Taps Anchorage Digital as Bitcoin, Ethereum ETF Custodian Publisher: Decrypt Publication date: 2025-04-08 URL: https://decrypt.co/313880/blackrock-anchorage-bitcoin-ethereum-etf-custodian Source type: media report Verification status: Read the explanation regarding Anchorage being designated as an additional custodian and no immediate transfer plan in this session, verification date 2026-10-30 Supporting content: Anchorage Digital’s historical arrangement as an additional custodian for IBIT and the absence of a transfer plan at the time (does not prove the current latest filing status)

  4. Title: How Much Bitcoin Does BlackRock IBIT Own? Publisher: Bitbo Publication date: updated continuously through 2026-10-29 URL: https://bitbo.io/treasuries/blackrock-ibit/ Source type: data site Verification status: Read the holdings figure and update date in this session, verification date 2026-10-30 Supporting content: background data showing IBIT holdings at roughly the 810,000 BTC level recently (the approximate figure is broadly consistent with Yishi’s statement)

ABAB AI Insight

Yishi is the founder of hardware wallet company OneKey and has long focused on self-custody and signing security. His latest view uses the February 2025 Bybit incident as a reference point: the FBI and multiple security firms attributed the roughly $1.5 billion theft to North Korea-linked TraderTraitor, related to the Lazarus Group. The attackers did not crack the cold wallet private keys; instead, they compromised a Safe{Wallet} developer’s Mac, hijacked AWS session tokens, and injected targeted JavaScript into the signing interface, causing Bybit signers to approve transactions that appeared legitimate but in fact pointed to the attackers’ addresses. This shows that even if private keys are offline, a compromised interface can still enable theft.

IBIT’s custody structure had already added Anchorage Digital as an additional custodian in April 2025, but Coinbase Custody Trust Company remained the primary active custodian, and the filing at that time explicitly stated that there was no immediate transfer plan. Recent public tracking data shows that IBIT holdings are around 810,000 BTC (roughly a $60 billion scale, depending on price fluctuations), making it the largest U.S. spot Bitcoin ETF. Such concentration is not unusual in the industry — most spot Bitcoin ETFs still mainly rely on a small number of qualified custodians — but the absolute scale held by a single custodian far exceeds most exchange hot wallets.

North Korea-linked hackers have in recent years shifted from frequent small-scale attacks to fewer high-value targets. Data from Chainalysis, TRM and others shows that Bybit alone accounted for a significant share of its total crypto thefts in 2025, and the FBI publicly warned in 2024 that North Korean hackers were conducting pre-operations research on companies related to crypto ETFs. Yishi’s comparison between IBIT and Bybit centers on this point: if attackers can influence a custodian’s signing or approval process in a similar way rather than directly stealing private keys, then offline cold storage by itself does not provide complete protection.

If this view holds, it would change the actual risk-bearing structure for IBIT shareholders: business crime insurance and per-address liability caps cover only limited amounts, and are usually shared by the custodian’s clients; unrecovered losses are ultimately borne by fund unit holders. Unlike exchanges, Bitcoin itself lacks an on-chain freezing mechanism. What to watch next is whether BlackRock’s subsequent filings disclose actual transfer progress to Anchorage or other custodians, and whether Coinbase or BlackRock provide more detailed public disclosure about IBIT’s insurance coverage.

ABAB News · Cognitive Law

  1. Offline private keys cannot prevent a tampered signing interface from completing a theft.

  2. When the largest ETF is concentrated with a single custodian, both attack payoff and impact expand in tandem.

  3. Under insurance caps and no freezing mechanism, unrecovered losses are ultimately borne by fund unit holders.