Concerns Grow Over Bitcoin ETFs Amid FBI Warnings About North Korean Cyber Threats

Recent reports indicate that North Korean hackers are actively targeting the substantial holdings of Bitcoin (BTC) and Ethereum (ETH) managed by crypto exchange-traded fund (ETF) custodians.

The FBI issued a warning on September 3, outlining that these cybercriminals aim to exploit companies involved with cryptocurrency-related ETFs. Despite the influx of capital into these funds, investors may be underestimating the risks associated with potential security breaches.

Notable hacking groups, such as the Lazarus Group, have gained notoriety within the cryptocurrency landscape, allegedly perpetrating various attacks against major exchanges and blockchain networks. Authorities express concern that these groups could set their sights on crypto-backed ETFs by targeting the assets they hold.

ETF fund managers are required to ensure the custody of the underlying digital assets to align with the total assets under management (AUM). The total cumulative investments in spot Bitcoin ETFs have surpassed $15 billion since July 2024, showing that these funds represent significant financial targets.

Potential Outcomes of a Cyber Attack on Bitcoin or Ether ETFs

According to Jameson Lopp, co-founder and chief security officer of Casa, if a Bitcoin or Ether ETF were to be hacked, it is probable that the ETF value would plummet to near-zero quickly, assuming trading wasn’t halted. This could be followed by a broader market decline as the compromised assets are liquidated. Moreover, a discovered vulnerability could trigger a significant exit from the market by investors holding shares in other ETFs due to heightened awareness of catastrophic loss risks.

Fortunately, it seems less likely that hackers could directly breach Coinbase, the primary custodian for crypto-backed ETFs. Taylor Monahan, lead security researcher at MetaMask, pointed out that Coinbase has an infrastructure designed to mitigate the impact of potential breaches.

Insurance Shortcomings in Bitcoin and Ether ETFs

Lopp raised concerns that many ETF investors may not fully grasp the uninsured nature of their assets. For instance, the custody insurance provided by Coinbase Global for BlackRock’s iShares Bitcoin Trust ETF, totaling $320 million, covers only 0.12% of the digital assets it manages, which amounts to $269 billion.

Andrew Rossow, a digital media attorney, explained that crypto ETFs’ backing assets may not necessarily be protected under the insurer’s policy. He emphasized that in the case of significant loss incidents, the insurance may be insufficient for all claims.

While crypto ETFs qualify for Securities Investor Protection Corporation (SIPC) insurance—offering up to $500,000 per customer—this protection does not extend to the underlying digital assets like Bitcoin. It instead secures the ETF shares from losses due to broker insolvency.

Centralization Risks in US Cryptocurrency Custody

The pursuit of leadership in Bitcoin and Ether ETFs has led to a predominance of issuers, yet Coinbase remains the primary custodian for most U.S. ETFs. A Coinbase representative stated that their established reputation and advanced technological infrastructure contribute to their status as the go-to custodian, raising concerns about the centralization of control over crypto assets.

As of early September, Coinbase was safeguarding over 808,619 BTC, indicating that a single entity holds a vast majority of the crypto assets associated with these ETFs. This concentration of custody introduces systemic risks, especially if compromised.

Luke Youngblood, co-founder of Moonwell, remarked that current security protocols related to crypto custody lack clear regulation, and without transparency, the adequacy of measures taken to protect assets remains uncertain. While diversifying custodial responsibilities might spread risk, it could also introduce other complications such as transfer difficulties.

Only Fidelity is noted for self-custody of its funds’ digital assets, with Lopp advocating that this practice should be standard among institutions establishing ETFs. He argues against outsourcing security measures to third-party custodians that lack transparency in their operations.

As the cryptocurrency landscape evolves, understanding insurance, custodian reliability, and centralized risk factors will be crucial for investors navigating Bitcoin and Ether ETFs.