Binance's Malaysia comeback bid faces fresh scrutiny after US$6.3bil breach

KUALA LUMPUR: Binance's attempt to reestablish a presence in Malaysia might encounter stricter regulatory oversight due to a recent $6.3 billion (RM25.6 billion) security breach, reigniting doubts about the cryptocurrency exchange's capability to safeguard customer assets. Industry insiders pointed out that the incident raises questions regarding Binance's cybersecurity measures, operational stability, and risk management capabilities, which could further complicate its quest for regulatory clearance in Malaysia.

The world's largest cryptocurrency exchange affirmed it had been collaborating with the Securities Commission (SC) and Bank Negara Malaysia over the past 10 months to examine a licensed pathway for offering its products and services in the country. On October 31, a Binance representative reportedly stated that discussions centered on the feasibility and framework of a licensed business model, but refrained from disclosing the precise license sought.

Hann Liew, founder and CEO of Halogen Capital, expressed that the timing posed a challenge as Binance sought registration as a registered market operator for digital asset exchanges. He noted that the magnitude of the security breach would draw regulators' attention to operational resilience and systemic risks, prompting the SC and Bank Negara to investigate the incident's origin, remedial actions, and safeguards for local customer assets.

Both the SC and Bank Negara are anticipated to conduct comprehensive investigations into the incident's root cause, review post-mortem remediation and process enhancements, and demand absolute assurance that Malaysian customer assets and infrastructure are entirely isolated from offshore operational vulnerabilities. Liew emphasized that regulators would heavily weigh the exchange's cybersecurity and compliance history, stressing that digital asset custody and security are among the most crucial considerations in the industry.

Anything falling short of global best practices will no longer be deemed sufficient. In addition to cybersecurity, Liew anticipated regulators would scrutinize Binance's integrity, internal control processes, and financial robustness, particularly given evidence suggesting that human error and social engineering contributed to the breach.

He highlighted the significance of independent third-party post-mortems and audits, evidence of corrective measures, and the segregation of customer assets in Malaysia as critical factors before approval would be granted. KDX's CEO, Chan Wei Chi, stated that while the security breach is just one facet of the SC's comprehensive evaluation, Binance must still prove its ability to meet other regulatory demands.

These include having adequate local staff, governance structures, and sufficient capital to back its Malaysian operations. Chan suggested that regulators should give considerable importance to the exchange's global security record, as operators are responsible for protecting customers' assets. He cautioned that Malaysian digital asset exchanges have thus far avoided major security breaches by employing cautious strategies in their operations and asset protection.

Chan advised the SC to assess Binance's operational culture and determine whether it leans towards risk-taking or a conservative approach. If Binance seeks a license in Malaysia, he argued, it must demonstrate its capacity to comply with local regulations while adopting a more conservative stance in its operations. He cautioned that Binance's global standing would not automatically guarantee regulatory approval, asserting that its operating practices would need to be evaluated against the standards expected of local exchanges.

Chan also noted that Binance's security breach and regulatory history could undermine its ability to gain the trust of Malaysian investors. The company's expansion had largely transpired outside regulatory scrutiny, he added. Binance has emerged as the largest player, but it reached this position without having to answer to regulators, operating on its own terms and prioritizing commercial growth above other factors.

The CEO emphasized that the exchange will need to exhibit its commitment to adhering to local requirements and meeting the benchmarks set by existing Malaysian operators. The latest incident could further complicate Binance's regulatory hurdles in Malaysia, where the SC had previously barred the exchange from operating in July 2021 for illegally running a digital asset exchange without registration.

Although Binance was removed from the SC's Investor Alert List in 2024, it was reinstated on October 8 of the same year. The security breach, which took place on October 29 and amounted to approximately $6.3 billion in cryptocurrency assets, was attributed to TraderTraitor, a North Korean state-sponsored hacking group. In response, Binance temporarily halted withdrawals while investigating the breach and cooperating with law enforcement agencies and industry partners to trace and freeze the stolen assets.

Approximately $3 billion was reportedly frozen on-chain, and Binance pledged to cover affected customers' losses utilizing its corporate treasury and Secure Asset Fund for Users. The exchange stated that it had replenished roughly 95% of the affected assets and began restoring withdrawals in stages. Liew noted that Binance had taken measures to restore investor confidence by compensating affected parties using its corporate balance sheet, but its enduring credibility would hinge on advancements in security protocols and internal procedures.

The ultimate question remaining is whether Binance is prepared to conform to and respect Malaysia's regulatory expectations.