BlackRock's largest spot Bitcoin ETF IBIT could become the next target of North Korean hacker groups. At stake are about 815,000 BTC worth roughly $63 billion, and virtually all of these coins are held by a single custodian — Coinbase.

It is precisely the concentration of assets with a single custodian that makes the fund an attractive target. The attackers have already repeatedly rehearsed the mechanics of such attacks on the Bybit and Binance exchanges, where compromising the transaction confirmation infrastructure allowed funds to be withdrawn without touching the cold keys themselves.

How cold storage is bypassed

A cold wallet is a device for storing cryptocurrency without internet access, and stealing keys directly from it is practically impossible. Therefore, attacks are not aimed at the keys, but at the people and programs through which transfers are confirmed.

This is how Bybit was hacked in February 2025. The attackers infected a developer's computer and remained undetected for 17 days, substituting the transaction confirmation interface. Exchange employees thought they were approving a routine transfer, but in reality they sent $1.5 billion to the hackers — while the keys remained offline the entire time.

The recent Binance hack looks similar. Analysts link it to the North Korean group TraderTraitor, which is also suspected in the attack on Bybit and the theft of 4,502.9 BTC from the Japanese exchange DMM Bitcoin. According to preliminary data, the hackers gained access through a DevOps engineer's laptop. The exchange stated that the keys were not leaked, but TRM Labs suggests that the attackers gained control over the signing system — meaning the money was again moved through a compromised approval process.

Now to IBIT. BlackRock's fund holds about 815,000 BTC worth approximately $63 billion, and all of it is held by Coinbase. A second custodian, Anchorage Digital, has already been appointed, but judging by the latest quarterly report, there are no plans to move Bitcoin there yet. If a serious security failure occurs at Coinbase, the entire fund would be at risk.

What investors need to know

It is estimated that the theft of, for example, $6 billion in cryptocurrency would cost the fund a loss of about 9.5% of assets, or roughly $4 per share.

Recovering the money would be nearly impossible. After the hack, Binance managed to freeze some of the stolen stablecoins, but with Bitcoin this will not work: its transactions cannot be reversed or blocked.

Insurance won't save it either. Here is what is known about the protection of the fund's assets:

  • BlackRock does not separately insure IBIT's Bitcoin;
  • Coinbase has $320 million in insurance, but it is shared across all clients;
  • under the agreement, Coinbase's liability is limited to $100 million per cold address;
  • payout depends on the terms of the contract and on who is found liable.

If the fund does not recover the coins and does not receive compensation, the losses will fall on shareholders. Bitcoin ETFs have made buying Bitcoin convenient, and that is a plus. But the more money flows into such funds, the more coins accumulate with a few custodians — and the larger the vault, the more interesting it is to hackers.

Security experts' recommendation: do not keep all assets in one place, store keys offline, and verify transfer details on a separate device's screen.

Cryptalist analysis: The IBIT case exposes a systemic vulnerability of the entire spot ETF industry — the hyper-concentration of assets with a limited number of custodians under limited contractual liability. For institutional investors, this means that custodian operational risk becomes a factor no less significant than the volatility of Bitcoin itself. Diversification of custodial infrastructure and stricter requirements for transaction signing processes are moving from optional improvements to mandatory conditions.