The recent hack of Binance, resulting in an estimated US$6.3 billion loss, serves as a stark reminder for Singapore investors that no cryptocurrency platform is immune to cyber threats. Binance, which is not licensed in Singapore, has pledged to cover all losses, but such promises are not legally binding guarantees. Smaller platforms may lack the resources to compensate users in similar incidents, highlighting the importance of understanding where one's crypto is held and the legal protections available.
Legal recovery in such cases hinges on whether the crypto is held on trust. A 2020 Singapore Court of Appeal ruling in Quoine v B2C2 emphasized that merely keeping customers' assets separate from the exchange's own is insufficient to establish a trust. Without a trust, customers typically have only a contractual claim and rank as unsecured creditors if the platform collapses. Following the 2024 hack of WazirX, users recovered about 85.5 per cent of their losses under a Singapore court-approved scheme.
Singapore courts have also demonstrated their ability to help recover stolen crypto. In ByBit v Ho Kai Xin (2023), the High Court ruled that crypto is property in law, allowing ByBit to trace and reclaim diverted USDT tokens. However, court orders are only effective if respected by those involved. If North Korean hackers are responsible for the Binance hack, recovery efforts will depend on token issuers like Tether and Circle, which froze over US$2.3 billion of their tokens shortly after the attack, and international police cooperation.
To mitigate risks, investors should verify if a platform is licensed, check whether assets are held on trust, and understand where disputes are resolved. Experts advise keeping only trading amounts on exchanges, spreading holdings across platforms, and storing long-term holdings in offline hardware wallets. Additionally, securing email accounts with unique passwords and authenticator apps is crucial, as criminals can hijack emails to reset crypto passwords. Companies should also ensure that no single person or device can move large sums and that directors act with reasonable diligence under the Companies Act.