OneKey Founder Warns IBIT Could Be Next on North Korea’s Hacker Target List
TREE NEWS reports: Yishi, founder of crypto hardware wallet maker OneKey, has raised alarms that BlackRock’s spot Bitcoin ETF (IBIT) may already be on North Korea’s cyber targeting list, citing the highly concentrated custody of its BTC holdings as a risk that cannot be ignored.
In a detailed analysis, Yishi pointed to the February 2025 Bybit hack, in which attackers compromised a Safe{Wallet} developer’s Mac computer by disguising malware as a legitimate Docker tool. The breach gave the attackers 17 days of access—enough time to manipulate the transaction interface used by signers, tricking them into authorizing the theft of $1.5 billion without their knowledge.
Yishi noted that TRM Labs is highly confident the Bybit incident is linked to TraderTraitor, the same North Korean state-sponsored group tied to the Binance hack and the DMM Bitcoin theft. While Binance has said there is no evidence of private key leakage, TRM believes attackers may have controlled the signing infrastructure itself.
The Custody Concentration Problem
The core of Yishi’s concern is that IBIT’s Bitcoin is held in a highly concentrated manner, making it an attractive target for sophisticated state actors. Unlike decentralized self-custody, where funds are spread across millions of individual wallets, a single ETF custodian holds billions of dollars in BTC under one roof.
This creates a single point of failure that nation-state hackers could exploit through supply chain attacks, insider threats, or social engineering. The Bybit case demonstrates that even multi-signature setups and hardware wallets are vulnerable when the signing interface itself is compromised.
Industry Implications
The warning underscores a broader tension in crypto’s institutional adoption: as traditional finance embraces Bitcoin through ETFs, the assets become concentrated in a way that contradicts the decentralized ethos of the technology. Custodians and ETF issuers must now defend against advanced persistent threats that rival those faced by banks and defense contractors.
For investors, the message is clear: ETF exposure offers convenience but introduces counterparty and custody risks that differ fundamentally from holding keys oneself. The industry may need to adopt stricter supply chain security standards, hardware attestation, and air-gapped signing procedures to protect the growing pool of institutional Bitcoin.
Looking Ahead
As Bitcoin ETFs accumulate ever-larger holdings, they will increasingly attract the attention of well-resourced adversaries. The question is no longer whether state-sponsored hackers will target these custody arrangements, but when—and whether the industry’s security practices can evolve fast enough to stop them.
