Bitcoin ETF Security Concerns After FBI’s Warning on North Korean Hackers
North Korean Hackers Targeting Crypto ETFs
The United States Federal Bureau of Investigation (FBI) has issued a warning that North Korean hackers are targeting cryptocurrency exchange-traded funds (ETFs). These hackers are reportedly focusing on the billions of dollars in Bitcoin (BTC) and Ethereum (ETH) held by ETF custodians.
The Hacker Threat
North Korean hacker groups, such as the Lazarus Group, are well-known in the cryptocurrency industry. They have been linked to multiple hacks on prominent exchanges and blockchain protocols. Now, there is growing concern that these groups could target crypto ETFs by attacking their underlying assets.
ETF Security Measures
In traditional stock market ETFs, a solid system tracks and replicates the underlying asset’s price. However, for a spot crypto ETF, fund managers must provide custody of the digital assets themselves or through a third party. This creates significant “honeypots” that are hard for hackers to ignore.
BTC and ETH ETF Vulnerability
Recent data shows that the total cumulative flows of spot Bitcoin ETFs have surpassed $15 billion since July 2024. Despite this massive investment, many of these funds remain uninsured.
Potential Consequences of a Hack
Jameson Lopp, co-founder and chief security officer of Casa, suggests that if a Bitcoin or Ether ETF were hacked, it could lead to a significant market crash. A successful hack would likely cause the ETF’s value to drop to zero and trigger a market-wide sell-off as investors panic.
Coinbase’s Security Approach
Taylor Monahan, lead security researcher at MetaMask, explains that Coinbase, the main custodian for crypto-backed ETFs in the U.S., operates with a “get hacked, but don’t get rekt” strategy. This means they accept the likelihood of being hacked but aim to prevent catastrophic losses through robust security measures.
Insurance Challenges
Lopp points out that most ETF investors may not fully understand the risks, particularly that their assets are essentially uninsured. For example, BlackRock’s iShares Bitcoin Trust ETF has a $320 million insurance policy through Coinbase. However, Coinbase custodies $269 billion in digital assets, meaning the insurance only covers 0.12% of the assets under management (AUM).
Andrew Rossow, a digital media attorney, adds that the custodian’s insurance policy is a shared policy, covering all Coinbase customers collectively. This could leave ETF investors exposed to financial risks if a significant loss occurs.
SIPC Insurance Limitations
Crypto ETFs qualify for Securities Investor Protection Corp (SIPC) insurance, which provides $500,000 of insurance per customer. However, SIPC does not insure the underlying assets like Bitcoin. Instead, it ensures that the security, whether digital or paper, remains the customer’s property.
Centralization Risks
The U.S. crypto custodial sector is highly centralized, with Coinbase being the primary custodian for most ETFs. This centralization poses a systemic risk if a compromise occurs. Steven Walbroehl from Halbron suggests that no clear security standards exist for crypto custody, leaving the industry to trust custodians’ security measures.
Self-Custody as a Solution
Among crypto ETF managers, Fidelity is unique in self-securing its funds’ digital assets. Lopp argues that all ETFs should adopt self-custody to improve their security posture and avoid relying on third parties.
By understanding these risks and potential vulnerabilities, investors can better navigate the complex landscape of cryptocurrency ETFs. Although the allure of high returns is strong, it’s crucial to remain aware of the underlying security concerns, especially with entities like North Korean hackers actively targeting these assets.
