coindesk.com
Hackers managed to pull off the biggest crypto heist ever last week, stealing about $6.3 billion from Binance, the world's largest crypto exchange, in mere minutes.
The haul spanned multiple blockchains and included bitcoin BTC$77,718.68, ether ETH$2,287.06, XRP and billions of dollars worth of stablecoins. Binance said about $3 billion of the affected assets had since been frozen and pledged to cover the losses with its own funds.
Both U.S. law enforcement, including the Federal Bureau of Investigation, and a slew of blockchain intelligence firms and the FBI have attributed the attack to TraderTraitor, a North Korean hacking unit.
This was another brutal reminder of the security problems that have plagued crypto this year, with over $8 billion in assets stolen so far, according to Chainalysis.
But as more of traditional finance moves onto the same technology rails, it also raises a question that matters well beyond bitcoin: What happens when the asset stolen next time is a tokenized U.S. Treasury fund, private-credit position or stock?
Read all of CoinDesk's coverage of the Binance hack here.
Control and recourse
Banks and asset managers increasingly make the case for tokenization based on the same features that made crypto attractive in the first place: assets can move around the clock, settle quickly and be used across trading, lending and collateral markets.
The trade-off is that tokenized assets can inherit some of the same infrastructure risks.
“Key compromise, contract bugs and bridge exploits don't care what a token represents,” Salman Banaei, general counsel at RWA-focused platform Plume, told me.
What happens after a theft, however, can look very different.
The Binance hack offered a useful demonstration with stablecoins. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion of stolen tokens within hours, according to TRM Labs. The attacker, meanwhile, was still holding roughly $2.4 billion of bitcoin and ether that no issuer could simply freeze.
Tokenized securities can come with similar administrative controls, but also with legal ownership rights tied to the underlying asset.
Adam Popat, CEO of tokenization technology firm SettleMint, said a stolen token does not necessarily erase the rightful owner's claim to the stock, fund or bond behind it. Depending on how the security is structured, an issuer can freeze transfers, invalidate stolen tokens and reissue them to the verified owner.
“The rightful owner retains that claim even when someone else controls the token,” Popat said.
Joris Delanoue, CEO of transfer agent Fairmint, put the distinction more simply.
“The underlying technology may be the same, but the ownership model is fundamentally different,” he said. “A stolen key should not erase your shareholder rights.”
