BlackRock’s 815,000-Bitcoin ETF Raises a New Custody Question After the Binance Hack

A cold wallet is not automatically a safe wallet. That is the uncomfortable point hanging over the world’s largest spot Bitcoin ETF after the record Binance breach.

CryptoSlate reports that OneKey founder Yishi Wang has warned that BlackRock’s iShares Bitcoin Trust could become an attractive target for North Korean hackers because its scale concentrates an unusually large pool of Bitcoin behind one institutional custody operation. The warning is not evidence that IBIT or its custodian has been compromised, and Wang did not present proof of an active attack against either company.

It is a reminder that a concentrated pool of Bitcoin can be exposed through the systems and people used to approve transactions—even when the private keys themselves remain offline.

BlackRock’s holdings file dated Oct. 29 listed roughly 815,000 BTC in IBIT, close to 4% of Bitcoin’s fixed 21 million maximum supply.

The fund reported about $62 billion in net assets at the end of October.

That concentration is why a custody question that might look technical can quickly become a market-wide issue.

The report also points to BlackRock’s use of Coinbase as the fund’s primary Bitcoin custodian and to Anchorage Digital’s addition as a second custodian. BlackRock’s latest quarterly filing said it had no current plan to transfer IBIT’s Bitcoin away from Coinbase.

Coinbase says its systems remain safe

Coinbase is the primary Bitcoin custodian for IBIT. After the Binance attack, Coinbase chief security officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets and had made precautionary changes to its cold-storage systems. He also said Coinbase remained safe.

@coinbase is safe.

We are blocking sends to compromised Binance wallets and have made some adjustments to our cold storage systems solely out of an abundance of caution. Again.

@Coinbase is safe.

— Jeff Lunglhofer (Lunglhofer.eth) (@JLunglhofer) October 29, 2026

That precaution matters because the modern custody stack is larger than a set of private keys. It includes transaction-building software, signing interfaces, access controls, device security, employee procedures and the process used to verify what an authorized signer is actually approving.

The 2025 Bybit theft made that distinction painfully clear. Investigators found that attackers compromised a Safe{Wallet} developer’s machine and manipulated the transaction interface presented to legitimate signers.

The keys did not need to be extracted. The approval process itself became the attack surface.

Why IBIT’s scale changes the risk calculation

Wang’s warning focuses on that operational layer. His argument is not that Bitcoin’s cryptography has failed or that Coinbase has been breached.

It is that a sophisticated attacker can spend weeks studying the human and software dependencies around a large custody operation.

I suspect IBIT is already on North Korea’s shortlist.

In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving…

— Yishi (@ohyishi) October 30, 2026

BlackRock’s IBIT fund page identifies Coinbase Prime as a key service provider, while BlackRock has also added Anchorage Digital as an additional custodian. CryptoSlate notes, however, that BlackRock’s June quarterly filing said the fund had no current plan to move Bitcoin away from Coinbase.

The insurance picture adds another layer. Coinbase’s commercial crime coverage is shared across customers rather than reserved for IBIT, and the custody agreement generally limits liability per cold-storage address, subject to the contract’s exceptions.

Bitcoin also lacks a centralized issuer that can freeze stolen units after they move.

None of that means IBIT is in immediate danger. It means the ETF’s enormous success has created a concentration that deserves more than a simple “cold storage” label.

Investors should care about how transactions are assembled, who verifies them, how approval interfaces are protected and what recovery looks like if those controls fail.

For an ETF holding hundreds of thousands of Bitcoin, custody is not a back-office detail. It is part of the investment thesis.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.