Industry leaders at Hong Kong’s Fintech Week are searching for solutions to crypto crime in the wake of Binance’s historic hack, with over US$3 billion in stolen assets still in the hands of alleged North Korean hackers.
“You have to be able to treat every end point and every server as a possible place that might be compromised and work on the principle that it might be compromised,” said Tim Way, global head of banking initiatives at digital asset infrastructure firm Fireblocks, during an interview on Monday.
He highlighted unauthorised signatures as one potential security failure and stressed the importance of catching them, because “once it’s gone to the blockchain, it’s hard to unpick it”.
Hackers – whom the US government and various analytics firms identified as a North Korean state-sponsored group – likely exploited an engineer’s compromised laptop to make unauthorised withdrawals resulting in the historic US$6.43 billion cryptocurrency heist, according to Binance.
Binance customers pulled US$3.64 billion in assets when the cryptocurrency exchange resumed operations on Sunday.
“I don’t necessarily think there is a widespread trust issue,” said Way, but added that “folks are putting more focus on … understanding what the security controls are of who they invest in.”
The rapid speed with which artificial intelligence was enabling vulnerabilities to be found and exploited in the digital asset space – and the software space more broadly – made a “multilayered approach to security and risk management … absolutely essential,” Way said.
“The most important [takeaway for regulators] is that on public blockchain and permissionless tokens like Ethereum, you cannot freeze [stolen assets] like you can with stablecoin,” said Yixuan Huang, senior solutions director at blockchain regulatory technology company RigSec.
Before stablecoin issuers like Tether and Circle froze some of the stolen stablecoins, the hackers converted around US$786 million to ETH, the native cryptocurrency on the Ethereum blockchain, according to blockchain analytics firm Elliptic.
“Passive signing should be updated to intent-verified signing” – which would verify not only “who can sign” but also “what can be signed” – to help strengthen security, according to Huang. AI could easily falsify the “who” part, but not the “what” part, she added.
“Blind signing” was a key factor in the Bybit heist in 2025 – which cost the Dubai-based trading company around US$1.5 billion in tokens – because the “malicious intent behind the transactions” was not identified, Huang said.
She also pointed to hardware solutions as a high-security alternative, since it was comparatively “easier for AI to find vulnerabilities in software”, but added that meeting regulatory requirements would take longer.
Senior city officials kicked off Hong Kong’s FinTech Week x StartmeupHK 2026 on Monday with keynote speeches on Hong Kong’s leadership in developing an innovative and secure fintech ecosystem.
