世界最大のビットコインETF、北朝鮮の標的か｜9.7兆円に警告

ハードウェアウォレットを手がけるOneKeyの創業者Yishi Wang氏は、ブラックロックの現物ビットコインETF「IBIT」が北朝鮮のハッカーに狙われる可能性があると警告しました。米当局が北朝鮮の「TraderTraitor」によるものとした60億ドル規模のバイナンスへのハッキングを受けた発言です。

I suspect IBIT is already on North Korea’s shortlist.

In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving them enough time to manipulate the transaction interface used by Bybit’s signers. The signers believed they were approving a legitimate transaction. Instead, they unknowingly authorized the theft of $1.5 billion from a cold wallet.

The keys could stay offline while the signers approved a theft through a compromised interface.

TRM Labs attributes the recent Binance incident with high confidence to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop as the entry point. Binance says there’s no evidence that private keys were leaked, while TRM’s analysis suggests the attackers may have gained control of the signing infrastructure. If confirmed, the attackers could have moved funds through a compromised approval process without extracting the keys.

Now imagine the same thing happening to IBIT.

BlackRock’s IBIT is the world’s largest Bitcoin ETF, holding roughly 815,000 BTC worth around $63 billion. Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been appointed as an additional custodian, the fund’s latest quarterly filing says there are currently no plans to transfer any Bitcoin there.

That’s an extraordinary concentration of Bitcoin under one custodian. Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk.

A $6 billion theft would wipe out roughly 9.5% of IBIT’s assets, equivalent to around $4 per share at current valuations.

Binance managed to freeze some stolen stablecoins. Bitcoin has no such mechanism, making stolen BTC far harder to recover.

BlackRock doesn’t separately insure the Bitcoin held by the fund. Coinbase has disclosed $320 million in commercial crime insurance coverage, shared across its customers. Its custody agreement also limits liability to $100 million per cold storage address, with any recovery subject to contractual terms, liability determinations, and other conditions.

If a major theft occurred and the fund couldn’t recover the Bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT shareholders.

Bitcoin ETFs have made owning Bitcoin much more accessible, and there’s real value in that convenience. But as more capital flows into these products, enormous amounts of Bitcoin are also being concentrated among a handful of custodians and the infrastructure they depend on.

The larger these pools become, the more attractive they are to attackers. A compromise at any critical point could have consequences far beyond a single institution.

And that’s why security has no finish line.

Even the most sophisticated cold storage setup still depends on hardware, software, supply chains, signing workflows, and the people operating them. Keeping private keys offline is essential, but it doesn’t eliminate the risks surrounding the transaction approval process.

Spread your assets across independent custody setups. Keep your private keys offline. Verify transaction details on a trusted device screen, independently of the computer initiating the transaction. Continuously review your security architecture, and build it around the assumption that some part of your infrastructure will eventually be compromised.

There are no silver bullets in security, and no permanent guarantees. Stay vigilant, keep verifying, and never mistake a clean track record for proof that you’re safe.

Bunker mode.

— Yishi (@ohyishi) October 30, 2026

Wang氏は、IBITがすでに北朝鮮の標的候補に入っているのではないかとの見方を示しています。IBITの主要なカストディアン（資産保管機関）はコインベースが務めています。

ブラックロックのデータによると、IBITの純資産は10月30日時点で約620億ドル（約9.7兆円に相当）でした。10月29日時点の保有量は約81万5000BTCでビットコインの最大供給量の約4%に相当します。コインベースの最高セキュリティ責任者Jeff Lunglhofer氏は10月29日、バイナンスの侵害されたウォレットへの送金を遮断し、念のためコールドストレージ（オフライン保管）の仕組みを調整したと表明しました。

Wang氏の懸念の背景には約15億ドルが流出した2025年2月のバイビットへのハッキングがあります。Sygniaの調査ではSafe{Wallet}の開発者の端末が侵害され、署名者が使う取引画面が改ざんされたとされます。秘密鍵を盗まなくても承認の過程を乗っ取れば資金を動かせることを示した事例です。ただし、IBITやコインベースの管理システムが侵害された証拠はなく、Wang氏の警告も北朝鮮が実際にIBITを狙っていることを示すものではない点に注意が必要です。

ブラックロックの年次報告書によると、コインベースの犯罪保険は顧客間で共有されるもので、IBIT専用ではないとされます。保管契約ではコインベースの責任は原則としてコールドストレージのアドレス1つ当たり1億ドルに制限されています。

発行体が凍結できるステーブルコインと異なり、ビットコインには盗難資産を一元的に止める仕組みが存在しないため、損失の回収は追跡や保険に頼る面が大きくなります。機関投資家向けカストディの集中リスクが今後一段と注目を集めそうです。