Key Notes
- OneKey founder Yishi warns of a hypothetical IBIT custody threat without reporting a breach.
- Official October 29 holdings show roughly 815,000 BTC, with Coinbase named as custodian in the latest quarterly filing.
- Shared insurance and contractual recovery limits could leave shareholders exposed to uncompensated losses.
OneKey founder Yishi says BlackRock’s iShares Bitcoin Trust ETF could become an attractive target for North Korean hackers, warning that keeping private keys offline does not eliminate the risk of a compromised transaction-approval process.
His October 30 post is a warning about a possible future attack. It presents no evidence that IBIT has been breached or that a specific operation against the fund is underway. CoinScreamer first covered the statement in its OneKey custody warning brief.
Why Signing Systems Matter
Yishi’s central argument is that an attacker may not need to extract private keys if they can compromise the software or approval process that causes an authorized signer to approve a malicious transfer. He points to the Bybit theft and the unfolding Binance investigation as reasons to examine the entire signing workflow.
The distinction matters in the Binance hack reconstruction: a transaction can carry a valid signature while reflecting an attacker’s instructions. That does not mean Bitcoin’s cryptography has been broken. Nor does the Ethereum EIP-7702 delegation mechanism examined in that investigation operate on Bitcoin.
TRM’s high-confidence North Korea attribution concerns the Binance incident. It is separate from Yishi’s prediction about who might target IBIT next.
What IBIT Actually Holds
The fund’s official October 29 holdings file lists 814,873.62030 BTC, supporting his rounded estimate of 815,000 BTC. Yishi valued the pool at about $63 billion; that is his approximate snapshot, rather than a fixed valuation.
BlackRock’s fund page reports $65.78 billion in net assets and 1.4392 billion shares outstanding as of October 29. The difference illustrates why the dollar size of the same Bitcoin holdings changes with prices and valuation timing.
IBIT’s June 30 quarterly report names Coinbase Custody as the Bitcoin custodian and Anchorage Digital as an additional custodian. At that filing date, the sponsor said it had no plans to move Bitcoin to Anchorage. An additional appointment therefore did not, by itself, establish that custody was already split between the two providers.
Insurance Is Not a Fund-Wide Guarantee
The 2025 annual report describes segregated vault wallets, offline keys and controls preventing one employee from accessing complete private keys. It also says neither the trust nor its sponsor insures the fund’s Bitcoin.
Coinbase’s commercial crime coverage is shared across customers and may be unavailable or insufficient for a particular loss. Yishi cited a $320 million limit, a figure Coinbase disclosed in its 2021 Novi announcement. The annual report reviewed here does not state that dollar limit, so it should not be treated as independently confirmed current coverage.
The filing also describes a $100 million liability cap per cold-storage address, alongside other contractual limits and exceptions. That is a liability provision, not an insurance allocation or an automatic payout. Recoveries would depend on the incident, applicable terms and available compensation. An unrecovered, uncompensated loss could reduce the fund’s value and leave shareholders bearing the shortfall.
What a Hypothetical $6 Billion Loss Would Mean
Using Yishi’s $63 billion estimate, a $6 billion loss would equal about 9.5% of assets. Using BlackRock’s October 29 net assets instead gives roughly 9.1%; dividing $6 billion by the reported share count gives about $4.17 per share. These are illustrative calculations before recovery or compensation, with other factors held constant. They are not reported losses or price forecasts.
Bitcoin also has no token issuer that can blacklist an address in the way stablecoin issuers can. That makes the USDT freeze response an imperfect comparison for a Bitcoin custodian. It does not make stolen BTC untraceable or rule out recovery through seizures or cooperating intermediaries.
Yishi’s broader concern is concentration: pooling large holdings behind a small number of custody providers makes the people, devices and approval systems around those holdings especially consequential. His post calls for independent transaction verification and custody diversification, while offering no audit of IBIT’s actual security defenses.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
