Martin Chan | Consultant, TITUS · November 2026
At about 4.05 am Hong Kong time on 30 October 2026, funds began moving from five Binance hot wallets. In its initial report, Binance said an attacker had gained access to an internal signing service and used it to initiate transfers outside the usual withdrawal process. Binance put the value of the assets affected at about US$6.34 billion. The investigation was ongoing when it published those findings. Binance’s 3 November incident report
For a Hong Kong licensed virtual asset trading platform, the first check is whether the person or system approving a withdrawal can independently verify what will go on-chain. Then work through what happens if that check fails. Who sees the first unexplained transfer, who can stop withdrawals at 4 am, and who tells the Securities and Futures Commission (SFC)? For brokers, the questions include what they can see in an omnibus account and how quickly they can get the platform to act.
Who the SFC rules apply to
The SFC’s Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines) set the custody and cybersecurity standards for licensed platform operators and their associated entities. The SFC’s August 2025 custody circular sets minimum standards, identifies examples of good practice and brings compliance with the circular into the annual external compliance and technology assessment. The SFC will consider whether a failure to follow the Guidelines reflects adversely on fitness and properness. VATP Guidelines, para. 1.8 and Parts X and XII · SFC custody circular · TITUS guide to ongoing VATP obligations
The SFC’s February 2026 withdrawal safeguards apply to licensed corporations that provide virtual asset dealing through an omnibus account with an SFC-licensed platform and allow clients to withdraw virtual assets. The SFC’s July 2026 circular addresses phishing and hacking of client accounts at internet brokers, as defined in that circular, and SFC-licensed virtual asset service providers. Its June circular on AI-enabled cyberattacks is addressed more broadly to licensed corporations, SFC-licensed virtual asset service providers and their associated entities. SFC omnibus broker circular, paras. 19–20 · SFC phishing and hacking circular · SFC AI cybersecurity circular
For firms tracking the proposed standalone licensing regimes, the Government said on 4 November 2026 that it planned to introduce a bill by year end covering virtual asset dealing, advisory, management and custody services. The SFC has said its platform custody standards will form core expectations for future virtual asset custodian service providers. Government reply to LegCo · SFC custody circular
Check what the wallet is about to sign
A withdrawal can look right on a screen and still send funds to the wrong address. The SFC’s custody circular describes incidents involving compromised third-party wallet software, access to approval devices and signers approving forged transactions. For cold-wallet operations, it calls for dedicated approval devices, independent integrity checks and safeguards against blind signing. Paragraph 10.10 of the VATP Guidelines also calls for safeguards against changes to the destination address before the transaction is signed and broadcast. SFC custody circular, section III · VATP Guidelines, paras. 10.7 and 10.10
Follow one withdrawal from the client’s instruction to the payload the wallet signs. In a test environment, change the destination or try to exceed the approved value or transfer-rate limit. See which system rejects the altered instruction. For hot wallets, check that the signing service or an independent control can reject unauthorised destinations, amounts and transaction types even if the upstream service has been compromised. For cold wallets, the SFC calls for reassessing potential attack routes before material changes to systems, processes or authorised personnel. SFC custody circular, para. 8
Include transactions that grant permissions on-chain. Binance said attackers used its signing service to delegate execution rights over an Ethereum hot wallet. The permissions were already on-chain when Binance suspended withdrawals, so the team had to revoke them separately. Ask the wallet team to demonstrate how it would find and revoke a permission that survives a shutdown of the withdrawal service. Binance’s 3 November incident report
Keep approval systems separate from everyday work
In Binance’s initial account, one engineer ran a malicious coding assignment on a work computer after a fake job interview. The FBI has previously warned that attackers use recruitment or investment approaches to persuade employees in the crypto industry to run code. Give engineers a way to report suspicious approaches to security and keep outside coding exercises off devices with access to production. Binance’s 3 November incident report · FBI warning on recruitment-related social engineering
Work on the assumption that a device or privileged account may already be compromised. Limit what each account can do and segment the network so access to an engineer’s laptop gives an intruder as little reach as possible. Require a second person to approve changes that can move client assets or expand access to production. The SFC’s AI cybersecurity circular discusses these controls, and paragraph 12.12(f) of the VATP Guidelines calls for anti-malware and endpoint detection and response on critical system servers and workstations. SFC AI cybersecurity circular · VATP Guidelines, para. 12.12(f)
Check cold storage and compensation at peak balances
Under the VATP Guidelines, a licensed platform and its associated entity should keep 98% of client virtual assets in cold storage, subject to limited exceptions the SFC permits case by case. The operator should have an SFC-approved compensation arrangement covering potential losses of 50% of client virtual assets in cold storage and 100% in hot and other storage held by its associated entity. The Guidelines call for daily monitoring of whether the arrangement remains sufficient. VATP Guidelines, paras. 10.6(c) and 10.22–10.24
Take the busiest withdrawal window in the past month and check what the arrangement would have covered at that point. If it relies on insurance, read the exclusions for social engineering, misuse of authorised systems and state-backed activity. The VATP Guidelines call for platforms to hold client assets on trust through their associated entity. Compare the policy, client terms and trust documents with the way assets are actually held. In Re Gatecoin, the Hong Kong Court of First Instance held that cryptocurrency is property capable of being held on trust. For clients bound by the exchange’s later terms, the court found that those terms showed an absence of intention to create a trust. Re Gatecoin Ltd (in liquidation) [2023] HKCFI 914 · VATP Guidelines, para. 10.1
Decide who can suspend withdrawals after hours
The SFC custody circular calls for real-time reconciliation of on-chain client assets against the platform ledger, prompt alerts on unexpected discrepancies and round-the-clock monitoring, including holidays. Omnibus brokers that allow virtual asset withdrawals should also monitor continuously, with escalation and suspension procedures that work outside office hours. Agree in advance how the broker can ask the platform to block a suspicious withdrawal or apply a limit to a newly approved wallet. SFC custody circular, section V · SFC omnibus broker circular, para. 20
If a licensed platform suspends client virtual asset withdrawals, the decision should be fair and transparent. The platform should inform the SFC and all its clients without delay. Give the overnight team a named decision-maker and a backup. Decide how the team will handle deposits still arriving at a wallet it suspects has been compromised, and test whether shutting down the application leaves any active route for moving funds on-chain. VATP Guidelines, para. 10.10(e)
When to notify the SFC after a hack
A licensed platform operator and its associated entity, where applicable, should notify the SFC immediately of a material service interruption or other significant issue affecting the platform or its systems, or a material failure, error or defect in trading, custody, accounting, clearing or settlement systems or equipment. The operator and associated entity, where applicable, should submit the incident report without undue delay. VATP Guidelines, paras. 12.14 and 16.7(b)–(c)
The July 2026 circular separately tells internet brokers and SFC-licensed virtual asset service providers to report hacking incidents immediately and investigate the root cause. For the initial notice, record what is known, which systems are affected and what the team has done to contain the incident. SFC phishing and hacking circular, paras. 17–18
Designated critical infrastructure operators have a separate statutory duty under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653). For reportable computer-system security incidents, they must notify the Commissioner within 12 hours of becoming aware of a serious incident or within 48 hours for other incidents, and submit a written report within 14 days of becoming aware of the incident. An incident is serious if it has disrupted, is disrupting or is likely to disrupt a core function of the critical infrastructure. Commissioner’s guidance on operator obligations
When stolen crypto reaches your platform
After attributing the Binance theft to North Korea, the FBI published wallet addresses linked to the incident. If a credible alert identifies an address your firm has dealt with, check the transaction history and escalate the findings to your money laundering reporting officer. The SFC expects licensed firms conducting virtual asset activities to screen transactions and associated wallets before transacting for clients and to follow up on links to suspicious or illicit activity. FBI alert on the Binance theft · SFC layering circular, para. 17
The duty to report to the Joint Financial Intelligence Unit (JFIU) arises when a person knows or suspects that property is the proceeds of, was used in connection with, or is intended for use in connection with an indictable offence or drug trafficking, or that it is terrorist property. The person must report as soon as it is reasonable to do so. A credible report from a researcher or overseas agency can inform that assessment. Coordinate client communications with legal and compliance to avoid tipping off. JFIU statutory reporting overview · JFIU guidance on reporting and tipping off
Check sanctions separately. Hong Kong’s North Korea sanctions regulation restricts dealing with assets owned or controlled by designated parties or making assets available to them or for their benefit, subject to licensing. An attribution to North Korea is a reason to examine ownership, control and who benefits from the proposed transaction. Cap. 537AE, s. 8 · UN Security Council Consolidated List
Freezing a token on-chain depends on the token, the issuer’s controls and the legal basis. The Hong Kong Monetary Authority identifies blacklisting addresses and promptly freezing stablecoins in response to requests from regulators or law enforcement, or to court orders, as measures available to licensed stablecoin issuers. A platform that identifies a suspect deposit should establish whom it can contact at the issuer and preserve the transaction details needed for that referral. HKMA stablecoin issuer AML/CFT guideline, paras. 5.10–5.12
A board checklist for the next tabletop exercise
- Trace a test withdrawal through the vendor software and signing system. Ask the team to show where an altered transaction gets rejected.
- Simulate a compromised engineer’s device. Check what the account can reach and whether the logs let the team reconstruct the intrusion.
- Compare peak wallet balances with the compensation arrangement, then check the policy exclusions and the client terms against the way assets are held.
- Run an after-hours drill with the broker or custody vendor. Time the first alert, the withdrawal suspension decision, containment on-chain and the initial SFC notice.
- Give the team a credible report linking a deposit to a theft. Ask it to document the screening result, the JFIU and sanctions decisions, and any contact with the issuer.
- Record who owns each fix and when it will be retested. Keep the results with the evidence for the platform’s annual external assessment.
Start the exercise with a single unexplained transfer at 4 am. Let the overnight team work from the alerts, permissions and contact numbers it actually has.
TITUS Solicitors advises virtual asset firms on Hong Kong regulatory and compliance matters. If your firm is reviewing its custody arrangements or working out what to report after a hack, speak to our virtual asset lawyers.
This article is for general information only. Regulatory references as at 9 November 2026.