What happened
Wang, who built OneKey into one of the more widely used self-custody wallet brands in Asia, told CryptoSlate he believes IBIT sits near the top of North Korea's target list. "I suspect IBIT is already on North Korea's shortlist," he said, per the report published Saturday. The remark came in the wake of a $6 billion compromise of Binance that US law enforcement and private incident responders tied to TraderTraitor, the DPRK-linked crew behind a string of 2024 and 2025 exchange and bridge thefts. Wang did not claim knowledge of an active intrusion against BlackRock, Coinbase, or any IBIT-adjacent infrastructure. His argument is positional: a single pool of custodied bitcoin that large, held under one roof, is the kind of target a state actor builds a multi-year operation around.
BlackRock's IBIT crossed $62 billion in assets this autumn, extending its lead over Fidelity's FBTC and the restructured GBTC. Coinbase Custody Trust Company serves as the primary bitcoin custodian under the ETF's prospectus, with cold-storage keys held through a mix of multi-party computation and hardware security modules. Coinbase has not commented publicly on Wang's remarks.
Why it matters
The IBIT structure concentrates bitcoin at a scale that didn't exist before January 2024. One issuer, one custodian, one operational chokepoint. That's the appeal to a state-level attacker and the risk a security researcher like Wang is pointing at. TraderTraitor's playbook, as described in US Treasury and FBI advisories over the past two years, leans on long-tail social engineering of exchange and infrastructure staff rather than smash-and-grab exploits. Those campaigns run for months. If Wang is right that IBIT is already in scope, the window for a successful intrusion isn't a weekend sprint.