The reported $6.3bn hack of Binance has put the security and resilience of cryptocurrency exchanges firmly back under the spotlight.

Whilst the initial frenzy and immediate question is around what has been stolen and what may ultimately be recovered, the incident raises much broader issues for businesses using crypto-exchanges, the regulatory framework surrounding them and customers seeking to recover their assets.

Our digital assets team have been following the story all day and here look at three of the questions arising from the incident.

Laura Clatworthy: What does the hack mean for businesses using crypto-exchanges?

A lot of the immediate attention has understandably focused on the value of the cryptocurrency stolen and whether Binance will make customers whole. But that is only part of the issue.

Many businesses, including large businesses, use the Binance platform and the impact will not be confined just to those assets lost in the hack. Suspension or disruption of the platform itself will affect investors and businesses which rely on it in their day-to-day operations, potentially creating further questions around Binance's liability.

Binance will also be under considerable pressure to cover customer losses. That is important for its own reputation and value, but we are also looking at a wider issue for the crypto sector. An incident on this scale has the potential to damage confidence well beyond one exchange, particularly when Binance is such a significant player.

What is interesting and I think a good sign is that we are already seeing cooperation within the crypto sector through the identification and freezing of assets linked to the attack. That could prove extremely important in determining how much can ultimately be recovered.

There are other consequences which may take longer to emerge. One is the potential compromise of customer data alongside the theft of cryptocurrency. Another is exactly what Binance means when it says that it will cover “losses”.

Because crypto-assets can be volatile, If a customer has lost a particular quantity of an asset, simply replacing the same amount of those assets that were held in the account may not necessarily put them back in the position they would otherwise have been in. This isn't comparable to a bank simply re-crediting a customer account pound for pound following a fraud. Aside from the usual volatility, values have been dropping as a direct consequence of this hack, and customers (not only those whose accounts have been hacked) may have had other losses arising from the suspension of the platform during which period they have been unable to access and deal with their crypto.

This hack should therefore be a prompt for investors and businesses using crypto-exchanges to assess the wider risks and questions about the impact on their operations if access to a major platform and/or their account is suddenly disrupted or suspended.

Daniel Tunkel: Does a hack on this scale expose a bigger problem with crypto-regulation?

I am given to thinking that a Binance hack has been an accident waiting to happen for some time. Binance is among the world's largest crypto-exchanges, but it has also had a controversial relationship with regulators.

The distinction between regulation and customers' individual legal rights is important here.

Public promises made by Binance about covering losses should not automatically be confused with what individual customers have actually been promised under their contracts. If Binance failed to perform its obligations to customers, the terms governing those relationships, and where those obligations can be enforced, become highly relevant.

But there is a separate regulatory question around how an incident of this magnitude was able to occur and what authorities do in response.

The circumstances of the breach and the adequacy of Binance's security arrangements are obviously matters of extreme interest to regulators. That is distinct from the private law remedies available to customers. The regulatory picture is also complicated by the international nature of Binance, because the response may vary considerably from one jurisdiction to another and according to the extent to which Binance falls within relevant regulatory regimes.

Operational resilience is one of the obvious questions arising from all of this. Regulation of crypto-exchanges isn't simply about preventing an incident (any incident, not merely one of this scale). There is also the question of whether providers are sufficiently resilient, including financially, to absorb the consequences when something on this scale does go seriously wrong. Alexander Shirtcliff raised precisely that issue in our discussions following the hack.

And if customers cannot obtain satisfactory redress directly from Binance, it becomes material to understand whether the budgets of regulators or government compensation schemes come into play.

Rather than simply suing Binance, particularly if its ability to meet claims were itself under pressure, customers may need to consider whether stolen assets can be traced into the hands of those who subsequently received them. Blockchain technology may assist in identifying movements, but turning that information into meaningful recovery across different exchanges and jurisdictions is another matter (particularly if – as has been suggested by some – the hack has originated in North Korea, which to be frank, does not have a good track record of amenability to western world systems of law and justice).

There is one further question, which perhaps should exercise us most, even if it is for the longer term.  Should the world financial markets accept that hack-proofing is simply not possible – whatever operational resilience rules the regulators agree – and that the world may have to move to a system that prices in some sort of conception of failure?  If so, how is that priced and who bears the cost?

Alexander Shirtcliff: Some assets have been frozen, but who actually owns them?

The freezing of a significant proportion of the stolen assets is clearly positive news, but freezing an asset and recovering it are two different things.

A freeze essentially holds the ring and prevents assets from moving while the underlying position is investigated and, where necessary, determined by the courts (and which courts may be a significant question). What it doesn't necessarily determine is who owns those assets or who is entitled to receive them and I expect there will be litigation around precisely that question.

There is unlikely to be a single answer applicable to every customer and every type of asset. Similar ownership issues arose following the collapse of FTX. Establishing ownership can become extremely important because customers who are able to demonstrate that particular assets belong to them may stand in a very different position from other customers or creditors if insolvency follows.

The more difficult problem concerns the stolen assets that have not been frozen.

Those losses may lead to individual claims against Binance and potentially collective action. Just because the hack happened does not automatically mean Binance will be found to have been negligent or in breach of its obligations. That will depend on the facts and the obligations it owed. But where individual customers cannot realistically fund litigation themselves, collective action can provide a means of pooling resources and making claims viable and I expect to see this happen in the coming months.

Asset tracing could become equally important. Where stolen cryptocurrency can be followed to other exchanges or custodians with assets in jurisdictions where court orders can be obtained and enforced, those intermediaries may become important parts of the recovery process.

The immediate freezing of assets is therefore an important first step, but it isn't the conclusion of the recovery exercise. The much bigger questions are who can establish ownership, where the remaining assets have gone and what legal mechanisms are available to get them back. All of which remain unknown right now.

Three questions, one much bigger issue

The Binance incident illustrates the number of different legal issues that can emerge from a major crypto breach.

For businesses, it raises questions around reliance on exchanges and the consequences when access is disrupted.

Regulators will have to consider the resilience of major crypto service providers and the effectiveness of existing protections under scrutiny.

Whilst customers who may have losses in the millions will find that recovering assets could ultimately depend upon contracts, ownership, tracing and potentially litigation across multiple jurisdictions.

Those questions will continue to develop alongside the investigation into the hack itself.