I suspect IBIT is already on North Korea’s shortlist. In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving them enough time to manipulate the transaction interface used by Bybit’s signers. The signers believed they were approving a legitimate transaction. Instead, they unknowingly authorized the theft of $1.5 billion from a cold wallet. The keys could stay offline while the signers approved a theft through a compromised interface. TRM Labs attributes the recent Binance incident with high confidence to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop as the entry point. Binance says there’s no evidence that private keys were leaked, while TRM’s analysis suggests the attackers may have gained control of the signing infrastructure. If confirmed, the attackers could have moved funds through a compromised approval process without extracting the keys. Now imagine the same thing happening to IBIT. BlackRock’s IBIT is the world’s largest Bitcoin ETF, holding roughly 815,000 BTC worth around $63 billion. Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been appointed as an additional custodian, the fund’s latest quarterly filing says there are currently no plans to transfer any Bitcoin there. That’s an extraordinary concentration of Bitcoin under one custodian. Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk. A $6 billion theft would wipe out roughly 9.5% of IBIT’s assets, equivalent to around $4 per share at current valuations. Binance managed to freeze some stolen stablecoins. Bitcoin has no such mechanism, making stolen BTC far harder to recover. BlackRock doesn’t separately insure the Bitcoin held by the fund. Coinbase has disclosed $320 million in commercial crime insurance coverage, shared across its customers. Its custody agreement also limits liability to $100 million per cold storage address, with any recovery subject to contractual terms, liability determinations, and other conditions. If a major theft occurred and the fund couldn’t recover the Bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT shareholders. Bitcoin ETFs have made owning Bitcoin much more accessible, and there’s real value in that convenience. But as more capital flows into these products, enormous amounts of Bitcoin are also being concentrated among a handful of custodians and the infrastructure they depend on. The larger these pools become, the more attractive they are to attackers. A compromise at any critical point could have consequences far beyond a single institution. And that’s why security has no finish line. Even the most sophisticated cold storage setup still depends on hardware, software, supply chains, signing workflows, and the people operating them. Keeping private keys offline is essential, but it doesn’t eliminate the risks surrounding the transaction approval process. Spread your assets across independent custody setups. Keep your private keys offline. Verify transaction details on a trusted device screen, independently of the computer initiating the transaction. Continuously review your security architecture, and build it around the assumption that some part of your infrastructure will eventually be compromised. There are no silver bullets in security, and no permanent guarantees. Stay vigilant, keep verifying, and never mistake a clean track record for proof that you’re safe. Bunker mode.