Coinbase Adjusts Cold Storage After $6 Billion Binance Hack

TLDR

• OneKey founder Yishi Wang warned that BlackRock’s $62 billion Bitcoin ETF could be targeted by North Korean hackers.
• The warning followed the $6 billion Binance hack, which US authorities linked to North Korea’s TraderTraitor group.
• Coinbase, the fund’s main custodian, said it adjusted its cold storage systems as a precaution.
• The fund held about 815,000 BTC as of Oct. 29, roughly 3.9% of Bitcoin’s maximum supply.
• There is no evidence that the fund or Coinbase’s custody systems have been compromised.

North Korean hackers could target BlackRock’s $62 billion Bitcoin exchange-traded fund, according to Yishi Wang, founder of crypto wallet maker OneKey.

“I suspect [the fund] is already on North Korea’s shortlist,” Wang said. His warning followed the $6 billion Binance hack, which US authorities linked to North Korea’s TraderTraitor operation.

The comments put attention on Coinbase. The exchange is the main Bitcoin custodian for BlackRock’s iShares Bitcoin Trust, the world’s largest spot Bitcoin ETF.

A CryptoSlate snapshot from April 8 found that funds naming Coinbase in a custody role held more than 80% of US Bitcoin ETF assets.

Coinbase Adjusts Cold Storage After Binance Breach

In an Oct. 29 statement, Coinbase Chief Security Officer Jeff Lunglhofer said the exchange was blocking transfers to compromised Binance wallets. He added that Coinbase had adjusted its cold storage systems out of an abundance of caution.

The company said its infrastructure remained secure.

Wang’s concern is based on methods North Korean hackers have used before. In February 2025, attackers stole about $1.5 billion from the exchange Bybit.

In that attack, hackers broke into a Safe{Wallet} developer’s computer using malicious software disguised as normal development tools. A forensic investigation by Sygnia found they changed the screen Bybit’s signers used to approve transactions.

The signers were tricked into approving a transfer from a cold wallet. The attackers did not need to steal private keys because they controlled the approval process.

Blockchain analytics firm TRM Labs found that the Binance attackers made coordinated transfers across 10 blockchains. Some transactions used pre-signed authorizations on Ethereum.

TRM said the attack likely involved compromised hot-wallet signing systems. Binance first pointed to a compromised employee laptop, then disclosed more breach points. The exchange said investigators found no evidence of leaked private keys.

How Much Bitcoin the Fund Holds

BlackRock’s data shows the fund held about $62 billion in net assets as of Oct. 30. Its Oct. 29 holdings file listed roughly 815,000 BTC, or about 3.9% of Bitcoin’s maximum supply.

BlackRock has added Anchorage Digital as another custodian. However, its June 30 quarterly filing said the fund has no current plans to move Bitcoin away from Coinbase.

There is no evidence that the fund or Coinbase’s custody systems have been compromised. Wang’s warning also does not show that North Korean hackers are actively targeting the fund.

BlackRock’s annual filing shows that Coinbase holds commercial crime insurance shared among all its customers. The coverage is not reserved only for the fund.

The custody agreement generally limits Coinbase’s liability to $100 million per cold storage address, with some contractual exceptions.

Unlike stablecoins, which issuers can freeze, Bitcoin has no central way to block stolen coins. That means shareholders could face losses that tracing, insurance or custodian payments may not fully cover.

Bitcoin traded at about $77,874 at the time of the report, down 0.22% over 24 hours and 7.92% over 30 days.

The post Coinbase Adjusts Cold Storage After $6 Billion Binance Hack appeared first on Blockonomi.