OneKey founder: IBIT may have become a potential target for North Korean hackers, and its highly concentrated BTC custody risk cannot be ignored.

PANews October 30 news: OneKey founder Yishi analyzed that he suspects IBIT is already on North Korea's potential target list. In the February 2025 Bybit hack, attackers compromised the Mac computer of a Safe{Wallet} developer through a malicious project disguised as a legitimate Docker tool, gaining 17 days of access, enough to manipulate the transaction interface used by signers, causing signers to unknowingly authorize the theft of $1.5 billion. Yishi pointed out that TRM Labs is highly confident that the Binance incident is related to TraderTraitor, an organization also linked to the Bybit and DMM Bitcoin thefts; Binance said there is no evidence of private key leakage, while TRM believes attackers may have controlled the signing infrastructure.

Yishi said that BlackRock's IBIT holds about 815,000 BTC, worth about $63 billion, and Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been designated as an additional custodian, the latest quarterly filing shows there are currently no plans to transfer Bitcoin. This highly concentrated Bitcoin exposure to a single custodian is very risky. If a major theft occurs and the fund cannot recover the Bitcoin or obtain sufficient compensation, the remaining losses will ultimately be borne by IBIT shareholders. Yishi recommends diversifying assets into independent custody setups, keeping private keys offline, independently verifying transaction details on trusted device screens, and continuously reviewing the security architecture.