A representative of the OneKey crypto wallet who uses the pseudonym Yishi warned on October 30, 2026, about potential security risks facing BlackRock’s iShares Bitcoin Trust, or IBIT. The warning matters because a compromise of transaction-signing systems could expose the fund’s bitcoin to theft even if its private keys remain offline.

“I suspect IBIT is already on North Korea’s shortlist,” Yishi wrote in a post.

Signing infrastructure risks

Yishi cited the February 2025 Bybit hack as an example of how attackers could target transaction approvals. According to the post, the attackers compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling and retained access for 17 days.

Yishi said the attackers manipulated the transaction interface used by Bybit’s signers. The signers believed they were approving a legitimate transaction but instead authorized the theft of about $1.5 billion from a cold wallet.

The incident showed that keeping private keys offline does not remove every risk, Yishi said, because attackers may tamper with the interface or data used during transaction approval.

Yishi also cited TRM Labs’ analysis of a recent Binance incident. According to the post, TRM Labs attributed the incident with high confidence to TraderTraitor, a North Korean group also linked to the Bybit attack and the theft of 4,502.9 BTC from Japanese exchange DMM Bitcoin.

Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop as a possible entry point, Yishi wrote. Binance said it had found no evidence that private keys were leaked, while TRM Labs’ analysis suggested the attackers may have gained control of the signing infrastructure. If confirmed, that could mean the attackers moved funds through a compromised approval process without extracting the keys.

Potential consequences for IBIT shareholders

Yishi described IBIT as the world’s largest bitcoin exchange-traded fund and said it holds roughly 815,000 BTC worth about $63 billion. Coinbase remains the fund’s active bitcoin custodian. Although BlackRock appointed Anchorage Digital as an additional custodian, Yishi said the fund’s latest quarterly filing stated that there were no current plans to transfer bitcoin there.

Yishi said concentrating that amount of bitcoin with one custodian creates a risk that a critical failure in the provider’s security infrastructure could affect the fund. A hypothetical $6 billion theft would erase about 9.5% of IBIT’s assets, equivalent to roughly $4 per share at current valuations, according to the post.

Recovery options could also be limited. Yishi noted that Binance had managed to freeze some stolen stablecoins, while bitcoin has no comparable mechanism for blocking funds, making stolen BTC harder to recover.

BlackRock does not separately insure the bitcoin held by IBIT, according to the post. Coinbase has disclosed $320 million in commercial crime insurance shared across its customers. Its custody agreement also limits liability to $100 million per cold-storage address, with any recovery subject to contractual terms, liability determinations and other conditions.

If the fund could not recover stolen bitcoin or obtain sufficient compensation after a major theft, any remaining losses could ultimately fall on IBIT shareholders, Yishi said.

Yishi recommended distributing assets across independent custody systems, keeping private keys offline and verifying transaction details on a trusted device screen separate from the computer initiating the transaction. The post also called for continual reviews of security architecture based on the assumption that part of the infrastructure could eventually be compromised.

Source: Incrypted