BTC USD Holds $78,000 As OneKey’s Founder Warns North Korean Hackers May Already Have BlackRock’s IBIT on Their List

Bitcoin (BTC USD) traded at $78,210 on Monday, November 2, after US spot Bitcoin ETFs shed $643.3 million on Friday, their biggest one-day outflow since June 25, as investors pulled back from the Binance hack and a wallet maker warned the funds themselves could be next.

The funds blinked. The price didn’t.

Friday’s redemptions wiped out the $440.7 million that had come in over the previous four sessions and left October $515.9 million in the red. BlackRock’s IBIT lost $233.7 million and Fidelity’s FBTC $201 million. Yet Bitcoin has climbed back from $76,326 and printed three higher lows since.

The louder story is the warning. OneKey founder Yishi Wang wrote that IBIT, with about 815,000 BTC at one custodian, is the kind of target the hackers behind Binance would want.

So is the ETF Bitcoin safe, and can BTC USD keep climbing?

Market Cap

24h
7d
30d
1y
All Time

How Bad Were Friday’s Bitcoin ETF Outflows?

Bad for one day, small for the funds. Five ETFs sold and the rest sat flat, by SoSoValue’s count:

• IBIT (BlackRock): -$233.7 million
• FBTC (Fidelity): -$201.0 million
• ARKB (ARK 21Shares): -$129.6 million
• GBTC (Grayscale): -$53.3 million
• BITB (Bitwise): -$25.7 million

That still left the funds holding $98.14 billion. Laevitas analyst Rick Maeda said the outflow was under 1% of assets and called it “simply a de-risking day, and not capitulation.”

October has seen this twice already. Heavy two-day outflows on October 7 and 8, then October 22 and 23, were followed by inflows within a session or two.

The week ended $202.6 million down. October ended $515.9 million down, and those two numbers are now the bar for a November turn.

Could Hackers Really Target a Bitcoin ETF?

No one has attacked one, but the warning rests on how Binance and Bybit were robbed. “I suspect IBIT is already on North Korea’s shortlist,” OneKey founder Yishi Wang wrote on Friday, in a post seen 192,000 times.

I suspect IBIT is already on North Korea’s shortlist.

In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving…

— Yishi (@ohyishi) October 30, 2026

His case runs in three steps:

• The method. The group behind Bybit sat inside a Safe{Wallet} developer’s Mac for 17 days in 2025, then tricked signers into approving a $1.5 billion theft from cold storage. TRM Labs ties the Binance hack to the same North Korean group, TraderTraitor, and Binance has pointed to a compromised DevOps engineer’s laptop. The keys never have to leave cold storage if the approval screen lies.
• The concentration. IBIT holds roughly 815,000 BTC, about $63.7 billion at today’s price, and Coinbase is its active custodian. Anchorage Digital is a backup, but Wang says the fund’s filing shows no plan to move coins there.
• The cushion. A Binance-sized $6 billion theft would be about 9.5% of IBIT, or around $4 a share. Wang notes BlackRock doesn’t insure the coins separately, and Coinbase’s $320 million crime policy is shared across all its customers.

Coinbase pushed back before the warning landed. Its security chief Jeff Lunglhofer posted on Thursday that “Coinbase is safe,” adding that it was blocking sends to the hacked Binance wallets and had made “adjustments to our cold storage systems solely out of an abundance of caution.”

No authority has named IBIT as a target, and Wang sells hardware wallets, so self-custody is his business. Still, the numbers in his post are the fund’s own.

DISCOVER: Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack

BTC USD Price Analysis: Can Bitcoin Clear $79,158?

Not yet, but it is getting closer. On the 4-hour chart, BTC USD has made higher lows at $77,114 on Saturday, $77,517 on Sunday, and $77,927 on Monday since the $76,326 bottom on October 30.

The ceiling is close. Monday’s push stalled at $78,878, just under the 4-hour 50 EMA (exponential moving average) at $79,158. The 200 EMA sits higher at $80,875, and both are still sloping down from the high.

Key levels:

• Resistance: $78,878, Monday’s high, then $79,158 (4H 50 EMA) and $80,875 (4H 200 EMA)
• Support: $77,114, Saturday’s low, then $76,326, the post-hack bottom

The ETF tape decides which. Another day of nine-figure outflows would make $76,326 the level that matters again.

DISCOVER: 10+ Next Crypto to 100X In 2026