What happens if North Korea steals Wall Street's tokenized assets next

Hackers managed to pull off the biggest crypto heist ever last week, stealing about $6.3 billion from Binance, the world's largest crypto exchange, in mere minutes.

The haul spanned multiple blockchains and included bitcoin , ether , XRP and billions of dollars worth of stablecoins. Binance said about $3 billion of the affected assets had since been frozen and pledged to cover the losses with its own funds.

Both U.S. law enforcement, including the Federal Bureau of Investigation, and a slew of blockchain intelligence firms and the FBI have attributed the attack to TraderTraitor, a North Korean hacking unit.

This was another brutal reminder of the security problems that have plagued crypto this year, with over $8 billion in assets stolen so far, according to Chainalysis.

But as more of traditional finance moves onto the same technology rails, it also raises a question that matters well beyond bitcoin: What happens when the asset stolen next time is a tokenized U.S. Treasury fund, private-credit position or stock?

Read all of CoinDesk's coverage of theBinance hack here.

Control and recourse

Banks and asset managers increasingly make the case for tokenization based on the same features that made crypto attractive in the first place: assets can move around the clock, settle quickly and be used across trading, lending and collateral markets.

The trade-off is that tokenized assets can inherit some of the same infrastructure risks.

“Key compromise, contract bugs and bridge exploits don't care what a token represents,” Salman Banaei, general counsel at RWA-focused platform Plume, told me.

What happens after a theft, however, can look very different.

The Binance hack offered a useful demonstration with stablecoins. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion of stolen tokens within hours, according to TRM Labs. The attacker, meanwhile, was still holding roughly $2.4 billion of bitcoin and ether that no issuer could simply freeze.

Tokenized securities can come with similar administrative controls, but also with legal ownership rights tied to the underlying asset.

Adam Popat, CEO of tokenization technology firm SettleMint, said a stolen token does not necessarily erase the rightful owner's claim to the stock, fund or bond behind it. Depending on how the security is structured, an issuer can freeze transfers, invalidate stolen tokens and reissue them to the verified owner.

“The rightful owner retains that claim even when someone else controls the token,” Popat said.

Joris Delanoue, CEO of transfer agent Fairmint, put the distinction more simply.

“The underlying technology may be the same, but the ownership model is fundamentally different,” he said. “A stolen key should not erase your shareholder rights.”

A blockchain verifies who signed a transaction, Delanoue said, while a transfer agent provides the legal accountability for who owns the shares.

How much protection investors have, though, depends on the structure.

With issuer-sponsored shares, Popat said, the token can be tied directly to the official shareholder record, giving the issuer a clearer path to restore ownership.

A synthetic token instead represents a claim against the third party that created it, so recovery depends on that intermediary's terms and smart-contract controls.

That still leaves the question of when an issuer should step in.

Having the technical ability to freeze or reverse a transfer is different from having the legal authority to do so immediately. The problem is especially acute when tokens can trade freely on permissionless markets.

Popat said that where tokenized assets circulate on public networks without identity checks, a thief may be able to sell them quickly, potentially passing them on to other buyers before an issuer or court can intervene.

Blockchain markets move in minutes, while court orders and other legal processes can take much longer.

“A court order is a clear trigger, but that legal process is far too slow for onchain markets where bad actors can liquidate their positions in seconds,” Banaei said.

For all the industry's talk about removing intermediaries, tokenized securities may still need someone in the middle with the authority that can step in when something goes awry.

Contagion can still bite

Even if a stolen tokenized security can be frozen or replaced, the market around it can still break down following a hack.

Anthony DeMartino, co-founder and CEO of $2.6 billion blockchain yield platform Sentora, said the bigger concern is whether investors can actually sell when they need to.

Many tokenized assets don't yet have deep markets, so issuers rely on market makers and OTC desks to buy and sell them at certain prices.

For example, DeMartino said that a large holder of RWAs needed liquidity during the Binance hack, but these "market makers reneged on those deals."

That exposes a weakness in the promise of 24/7 tokenized markets. An asset may technically trade around the clock, but that doesn't mean buyers will be there during a market shock.

“In my view, this is a big step back for tokenized RWAs,” DeMartino said. “Or maybe it’s just the realization that this liquidity was never real in the first place.”

That's another test Wall Street will have to grapple with as more assets move onchain: not just whether the token itself can survive a hack, but whether the market around it still works when crypto comes under stress.