Recent incidents at digital-asset platforms show how a third-party provider can become the way in, and how quickly stolen assets can move. For boards of MAS-regulated institutions, the question is whether the organisation can detect, respond and recover when controls fail.

Executive takeaways

  • MAS cyber hygiene and technology risk requirements set a floor. They do not prove resilience. Boards should ask for tested evidence, not policy attestations.
  • Third-party providers are part of the attack surface. In September 2026, an exchange said attackers entered through a vulnerability in a third-party security product.
  • For institutions subject to MAS's Technology Risk Management Notices, a relevant incident must be reported to MAS within one hour of discovery. The response plan should name who makes that call and who tells the board.
  • Boards should know who gives them an independent, business-level view of cyber risk, and when they last received it.

What happened

At the end of October 2026, Binance disclosed a security incident with an estimated total impact of about US$6.3 billion. In its 30 October statement, Binance said it had worked with blockchain partners to freeze affected assets, with roughly US$3 billion frozen on-chain at that point. TRM Labs described it as the largest crypto theft on record. The previous largest was the approximately US$1.5 billion taken from Bybit in February 2025.

A month earlier, on 24 September 2026, Bitget detected unauthorised transfers from some of its hot and warm wallets. It later put the total at about US$388 million. Bitget has said that a third-party security product it used contained a previously unknown vulnerability, which the attacker exploited to steal internal credentials and send forged withdrawal commands to its wallet system. It said private keys were not compromised and cold wallets were unaffected. Bitget suspended withdrawals and restored them in stages from 28 September.

Investigations into both incidents are continuing, and this article draws no conclusion about any firm's controls.

The Singapore baseline

  • Cyber hygiene. MAS Notices on Cyber Hygiene make six measures legally binding for the institutions they cover: securing administrative accounts, applying security patches, maintaining written security standards, network perimeter defence, malware protection and multi-factor authentication.
  • Incident reporting. Institutions subject to MAS's Notices on Technology Risk Management must notify MAS of a relevant incident as soon as possible, and no later than one hour after discovery. A root-cause and impact analysis follows within 14 days.
  • Board oversight. The MAS Technology Risk Management Guidelines (January 2021) set out guidance; in supervising an institution, MAS considers how far the institution observes their spirit. They expect the board and senior management to include members able to understand technology risk, and a CIO and CISO with the requisite expertise.
  • Personal data. Under the PDPA, a notifiable data breach must be reported to the PDPC no later than three calendar days after the organisation assesses it as notifiable.
  • Third parties. In March 2026, MAS consulted on Guidelines on Third-Party Risk Management. These would extend expectations to third-party arrangements beyond outsourcing. As at 3 November 2026, they had not been finalised.

What it means for boards

Size is not protection. Smaller institutions hold the same kinds of assets and data, often with leaner security and response teams.

The perimeter includes providers. Wallet and custody software, monitoring and analytics scripts, cloud platforms and outsourced operations can all reach client sessions, keys or data. An institution's own controls can be sound while a provider leaves it exposed.

For digital-asset businesses, the window is short. In the Binance incident, blockchain analytics firm TRM Labs reported that most of the funds moved within about 20 minutes. At any institution, three things determine how much one compromise can reach: the share of assets held in hot wallets, the controls over signing and withdrawals, and the speed of freezing and tracing.

Three questions every board should ask

1. Have we got the fundamentals right, and can management show it? 

Ask management:

  • When were our cyber hygiene controls last independently tested, and which exceptions remain open?
  • How many critical vulnerabilities are past our own remediation target, and why?
  • Who holds privileged access, including authority to approve or sign transfers of client assets, and when was that access last recertified?
  • Which third-party providers and software, including our security tools, hold privileged access or can reach client sessions, keys or data? How are they monitored?
  • Would our monitoring flag small test transfers or unusual withdrawal instructions before a large outflow?

2. If our controls fail tomorrow, are we prepared? 

Ask management:

  • Who declares an incident, who notifies MAS within the one-hour window, who assesses PDPA notifiability, who speaks to clients, and who informs the board?
  • When did we last exercise the plan end to end with senior management and our critical providers, and what changed as a result?
  • For digital-asset activity: how quickly can we halt withdrawals, rotate keys, and reach the analytics firms, stablecoin issuers and law-enforcement contacts that may help trace or freeze assets?
  • What will we tell clients in the first hours, and who approves it?

3. Who is advising the board on cyber risk? 

Technology changes too quickly for cyber risk to sit with IT alone. The MAS TRM Guidelines expect boards to include members with the knowledge to understand and manage it. 

Ask:

  • Does the board, or one of its committees, include members who can challenge technology risk reporting?
  • Do we receive reporting we can act on, covering risk appetite, key indicators, incidents, near misses and third-party exposure, rather than project status alone?
  • Do the CIO and CISO have direct access to the board?
  • When did we last receive an independent view of our cyber resilience, from internal audit or an external reviewer?

How RSM can help

RSM Singapore helps boards and senior management of MAS-regulated institutions, including digital payment token service providers, work through these questions. Our work includes:

  • assessing cyber hygiene and technology risk controls against MAS Notices, the TRM Guidelines and industry practice;
  • reviewing third-party arrangements, including wallet, custody and other technology providers;
  • designing and exercising incident response plans, including regulatory notification steps;
  • internal audit of technology and cyber risk, and board reporting that translates technical risk into business terms.

This content is general information, not legal, regulatory, tax or investment advice. Seek tailored professional advice for your circumstances.

To discuss how these developments affect your organisation, contact our Technology Consulting team:

Hoi Wai Khin
Partner
Kendrick Choo
Associate Director