North Korea May Already Have BlackRock's Bitcoin ETF on a Shortlist

North Korean hackers keep a shortlist of targets. BlackRock's $62 billion spot Bitcoin ETF may already be on it.

That's the read from Yishi Wang, founder of crypto wallet maker OneKey. "I suspect IBIT is already on North Korea's shortlist," he said, after US authorities attributed a $6 billion Binance hack to TraderTraitor, the Lazarus Group unit that Treasury sanctioned back in April 2022.

The timeline

IBIT launched in January 2024 and blew past $10 billion in assets faster than any ETF before it. Two years later it's sitting near $62 billion, and the bitcoin backing those shares sits with a custodian. Coinbase, specifically. The same firm holds the coins for most of the other spot Bitcoin funds too.

Then came the Binance hack, a $6 billion hole that US investigators pinned on TraderTraitor. Wang's comment followed within days. He wasn't describing a breach. He was describing a target list.

Here's what matters: nothing in the ETF wrapper changes what a private key is. The fund structure solved distribution and accounting. It didn't solve the humans who touch the keys.

What actually changed

Nothing broke this week. That's the point. Wang's warning is a positioning statement about where the next attack lands, not a report of one that already did.

But the concentration is real and it's uncomfortable. One custodian, a handful of cold storage sites, a small set of employees and contractors with access. The numbers tell the story: $62 billion in one fund, most of the spot ETF complex riding on the same custodian, all of it dependent on operational discipline rather than cryptographic guarantees.

And we've seen how this movie goes. Coinbase disclosed a data breach in 2025 where overseas support contractors were bribed to leak customer records. That wasn't a key compromise. It was people. TraderTraitor's whole method is people. Fake job offers, fake recruiters, malicious files sent to engineers on LinkedIn.

So ask the obvious question. If a nation-state can bribe a support rep or catfish a DevOps engineer, why would an ETF ticker ever slow them down?

From a risk perspective, the ETF boom quietly moved systemic custody risk from self-custody wallets into a single regulated venue. That's a tradeoff most IBIT holders never thought about. Frankly, most still aren't.

What to watch

Three things, in order.

First, Coinbase's custody attestations and its next quarterly filing. Watch for language shifts around insurance coverage and segregation of client assets. Second, whether BlackRock and the other issuers push for secondary custodians. Multi-custodian arrangements have been discussed for years. A credible warning from a well-known founder is exactly the kind of thing that turns talk into an RFP.

Third, in-kind redemptions. If the SEC lets authorized participants take bitcoin instead of cash, the flow of coins in and out of custody gets wider and harder to monitor. That's not automatically bad. But it changes the attack surface, and it's worth tracking the comment letters.

The reality is IBIT is a $62 billion honeypot with a single door. North Korea has spent a decade picking locks. The thesis that regulated custody is structurally safer than self-custody holds up against careless retail mistakes. It's far less convincing against a state actor with patience and payroll.

Nobody needs to sell their shares over this. But every IBIT holder should know whose hands are actually on the coins.