AnswersPublished22 sources
Why did OneKey founder and CEO Yishi Wang warn on October 30, 2026, that BlackRock’s iShares Bitcoin Trust (IBIT) could be on North Korean hackers’ shortlist, and how does that concern relate to the October 29 Binance theft of more than $6 billion, the FBI’s October 31 attributio
Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked. Reports of his October 30 comments describe IBIT’s roughly 815,000 BTC, held principally through Coinbase, as a potentially lucrative...
Published byImages generated with GPT Image 2
Research answer
Key takeaways
- Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked.
- Reports of his October 30 comments describe IBIT’s roughly 815,000 BTC, held principally through Coinbase, as a potentially lucrative target for the attackers behind Binance’s theft.
- [9][10][12] Why Binance and Bybit prompted the warning Scale and attribution: The FBI’s October 31 notice attributed the theft of more than $6 billion from Binance on or about October 29 to North Korea; reporting identified the activity as
- [1][14] The approval process can be the weak point: Binance reportedly linked the incident to a compromised DevOps engineer’s laptop, while another account described attackers making Binance’s withdrawal infrastructure sign transfers to att
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: Why did OneKey founder and CEO Yishi Wang warn on October 30, 2026, that BlackRock’s iShares Bitcoin Trust (IBIT) could be on North Korean h. Article summary: Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked.. Topic tags: general web, workflow, security, regulation, startups. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait
Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked. Reports of his October 30 comments describe IBIT’s roughly 815,000 BTC, held principally through Coinbase, as a potentially lucrative target for the attackers behind Binance’s theft. 9
10
12
Why Binance and Bybit prompted the warning
- Scale and attribution: The FBI’s October 31 notice attributed the theft of more than $6 billion from Binance on or about October 29 to North Korea; reporting identified the activity as TraderTraitor and linked it to the earlier $1.5 billion Bybit hack.
1
14
- The approval process can be the weak point: Binance reportedly linked the incident to a compromised DevOps engineer’s laptop, while another account described attackers making Binance’s withdrawal infrastructure sign transfers to attacker-controlled addresses.
5
3 Wang’s broader argument was that attackers can infiltrate signing or approval systems without necessarily stealing private keys directly.
8
- Operational recovery is separate from recovering stolen coins: Binance suspended withdrawals and subsequently began reopening them in phases on November 1.
6
16 An available news-feed headline reported replacement of approximately 90% of stolen funds, but another headline reported 95%, so these should be treated as evolving reported figures rather than a verified final recovery total.
2
Why IBIT’s custody arrangements matter
- Concentration creates a large potential loss exposure: Available reports put IBIT at approximately $62 billion in assets and roughly 815,000 BTC; other contemporaneous reports valued the holdings nearer $63–$63.7 billion.
7
9
12 A Binance-sized loss would therefore represent approximately one-tenth of that asset base—not a prediction that such a loss will occur.
- Adding a custodian does not necessarily diversify existing holdings: Reporting says Coinbase remained IBIT’s active custodian, with Anchorage Digital added but no current plan to transfer Bitcoin there.
- The warning remains speculative: The supplied evidence does not establish that IBIT or Coinbase’s custody systems were compromised or actively targeted. Insufficient evidence supports treating Wang’s “shortlist” language as intelligence about a confirmed attack plan.
What shareholders should take from it
- Insurance is not automatically a full guarantee: Wang was reported as saying IBIT’s Bitcoin was not separately insured.
- The risk mechanism is plausible, but details remain unverified: The available evidence supports Wang’s concern about compromised signing approvals, but does not independently establish the specific manipulated Bybit interface described in the question.
- Conditional financial consequence: If stolen Bitcoin could not be recovered and insurance or custodian compensation covered only part of the loss, the remaining shortfall could reduce the trust’s assets and shareholders’ value. Tracing an asset is not, by itself, the same as recovering it.
Evidence limits
I don’t know, from the supplied excerpts, whether the additional Binance breaches, conversion mainly into Ethereum, Coinbase’s blocking of transfers and precautionary cold-storage changes, or its custody share exceeding 80% of US Bitcoin ETF assets are substantiated. The excerpts also do not verify the Bitcoin freezing comparison or the exact insurance and liability terms; those details should not be presented as confirmed here.
The supported conclusion is narrower: Wang highlighted a potentially high-value target and an approval-system vulnerability, while the available evidence does not show that IBIT faces a confirmed attack. 8
9
10
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Why did OneKey founder and CEO Yishi Wang warn on October 30, 2026, that BlackRock’s iShares Bitcoin Trust (IBIT) could be on North Korean hackers’ shortlist, and how does that concern relate to the October 29 Binance theft of more than $6 billion, the FBI’s October 31 attributio"?
Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked.
What are the key points to validate first?
Wang’s warning was about the attractiveness of a large, concentrated Bitcoin holding and the possibility of compromising transaction approvals—not evidence that IBIT had been hacked. Reports of his October 30 comments describe IBIT’s roughly 815,000 BTC, held principally through Coinbase, as a potentially lucrative target for the attackers behind Binance’s theft.
What should I do next in practice?
[9][10][12] Why Binance and Bybit prompted the warning Scale and attribution: The FBI’s October 31 notice attributed the theft of more than $6 billion from Binance on or about October 29 to North Korea; reporting identified the activity as
Sources
99bitcoins.comBTC USD Holds $78K After ETF Exit and an IBIT Hack Warning