Perhaps I am old-fashioned, but cryptocurrencies have never struck me as a sensible investment. My reservations have only deepened following last week’s cyber attack on crypto exchange Binance, in which customers’ digital assets worth $6.3billion (£4.7billion) were stolen.
To be candid, I do not completely understand how cryptocurrencies operate. The last time I invested in something I failed to grasp fully — a Japanese warrants fund I won in a competition in the early 1990s — the experience ended badly.
That brings me to the first rule of investing: never put money into an asset you do not properly understand.
Crypto assets fail to meet many of the safety tests I look for. They have no traditional underlying value, with prices driven largely by sentiment and speculation. Protection for UK investors is also extremely limited if something goes seriously wrong, despite around one in ten adults having some exposure to crypto.
In Binance’s case, its substantial financial reserves appear to have prevented customers from suffering catastrophic losses. Had the exchange been in a weaker financial position, investors could potentially have lost everything.
Brian Dennehy, managing director of financial adviser Dennehy Wealth, is blunt about the appeal of crypto. He says it attracts “a strange combination” of criminals, anti-establishment campaigners, younger investors seeking something different and people captivated by the promise of making money quickly.
Behind all the excitement, he argues, there is no dependable foundation for crypto valuations. Prices are shaped almost entirely by investor mood and speculation.
Dennehy also says repeated attacks have exposed the supposed security of crypto assets as little more than an illusion. The Binance breach, he believes, is another warning that crypto is not stable, secure or a dependable safe haven.
Those are strong words. Investors should take notice.
Binance’s substantial financial reserves appear to have prevented customers from facing catastrophic losses
The threat of a cyber attack
But the ease with which the TraderTraitor hacking group breached Binance raises a much broader question — one that may have been lost amid the immediate fallout from the theft.
If this North Korean state-backed cyber-crime operation can take £4.7billion in customers’ crypto assets, what would prevent it, or another hostile group, from attacking a UK bank or investment company and targeting our savings or investments?
The UK’s cyber-security chief has already voiced concern. Richard Horne, head of the National Cyber Security Centre, said the country’s ability to withstand hackers is “not where it should be”. He also warned that hostile nations including China and Russia could soon use artificial intelligence to target Britain’s critical infrastructure. Banks are clearly part of that infrastructure.
I have spent the past day speaking to specialists across the financial services sector. Their message is reassuring: there is no reason for customers to panic.
However, they also acknowledge that no financial institution, whether based in the UK or overseas, can guarantee complete protection against a cyber attack. That is unsettling.
James Broomhall, a senior associate at Grosvenor Law who specialises in financial crime, is among those I consulted.
He says the Binance incident should not lead people to assume that money held with mainstream banks or regulated investment platforms is suddenly in danger.
The risks are different, he explains. Banks and regulated investment companies operate under established rules, including obligations relating to operational resilience and the safeguarding of customer assets. So far, so reassuring.
But Broomhall adds an important caveat: no financial institution is completely immune from cyber crime. The crucial issue for customers is whether the bank or investment firm holding their money has robust security systems and effective controls in place.
Nigel Green, chief executive of wealth manager de Vere Group, makes a similar point. He says the financial sector has entered a new era of wealth protection, with AI allowing criminals to plan and launch attacks at machine speed.
That means exchanges, banks and individuals holding assets must ensure their defences can keep pace. Any financial business that still treats cyber security as simply another item in its IT budget, Green warns, is likely to be exposed.
Regulators are watching
Cyber security is firmly on the agenda for the Financial Conduct Authority, the Bank of England and the wider financial services industry.
Earlier this year, before the Binance attack but after the damaging cyber breach at Marks & Spencer and TraderTraitor’s successful attack on crypto platform Bybit, senior figures in finance were already raising alarms about weaknesses in the global banking system.
The concerns followed the discovery of vulnerabilities in software used by numerous financial institutions. Those weaknesses were revealed by Claude Mythos, an artificial intelligence model created by US technology company Anthropic.
The findings led Jamie Dimon, chief executive of US investment bank JP Morgan, to say Claude had uncovered “a lot of vulnerabilities” that needed urgent attention.
Last month, Bank of England governor Andrew Bailey and International Monetary Fund managing director Kristalina Georgieva also returned to the subject.
Bailey warned that trust in money is fundamental to the way society functions.
Georgieva issued an equally stark warning, saying that unless cyber fraud is tackled decisively, bank customers could lose faith in the system and start keeping cash at home — with “lots of people with shoeboxes under their beds”.
That behaviour may already be emerging in Britain, with the public recently making record withdrawals from cash machines.
Some of those withdrawals may have been prompted by the Binance attack, as worried customers feared their own bank could become the next target for North Korean hackers.
Others have been influenced by the Labour government’s “Be Ready” campaign, which encourages households to prepare for war, extreme weather or a major cyber attack. The advice has led some families to stockpile everything from tinned fish and wind-up radios to cash.
Even a fellow volunteer I met while collecting for the Royal British Legion Poppy Appeal in Bracknell, Berkshire, told me this week that she had begun concealing cash at home in case a cyber attack brought down her bank. It is an unnerving sign of the times.
Why traditional finance offers some reassurance
Financial institutions are far from perfect, but protecting customers’ money is a serious priority. A security failure can quickly damage a firm’s reputation, destroy trust and encourage customers to move their savings to a competitor.
Brian Dennehy of Dennehy Wealth says crypto appeals to criminals, anti-establishment idealists, young investors and those attracted by the promise of quick riches
Rafe Pilling, director of threat intelligence at cyber-security company Sophos, made the point effectively in the Financial Times several months ago.
He compared banks’ traditional grand buildings and strongrooms with the role cyber security now plays. Financial institutions cannot afford for customers to lose confidence, withdraw their money and take it elsewhere.
The Bank of England and FCA are also taking a hands-on approach. They test the resilience of financial companies by staging simulated cyber attacks, allowing weaknesses to be identified and repaired before criminals can exploit them.
Protection if a financial firm fails
Unlike crypto investments, money held with eligible financial institutions can benefit from the Financial Services Compensation Scheme if a damaging cyber attack contributes to a firm’s collapse.
The FSCS protects up to £120,000 per person if a bank or building society fails, while investment firms generally receive protection of up to £85,000.
Pension protection depends on the type of product. There is no upper limit to FSCS cover for a personal pension or pension annuity. However, if a Self-Invested Personal Pension provider collapses, compensation is limited to £85,000.
Broomhall advises people with substantial savings to spread their money across different institutions. Splitting deposits reduces the chance of holding more than the FSCS limit with a single authorised banking group.
Using several banks, building societies and other deposit providers also gives you another practical advantage: if one institution is hit by a cyber incident, you may still have access to money held elsewhere.
However, savers should check whether different brands belong to the same banking licence. Several well-known savings brands can be covered by one licence, meaning the FSCS limit applies to the combined balance.
Bank of Scotland, Birmingham Midshires, Halifax and Intelligent Finance, for example, are all part of Lloyds Banking Group and operate under one licence. Someone holding £35,000 with each brand would therefore have £20,000 outside FSCS protection.
Further information is available at www.fscs.org.uk
In reality, a personal scam is more likely to threaten your money than a bank-wide cyber attack.
If you believe you have been scammed, contact your bank and, where relevant, the investment platform immediately. Acting quickly improves the chances of tracing and recovering the funds.
People targeted by an authorised push payment scam — where a criminal persuades them to transfer money — should generally be reimbursed, provided they did not disregard previous warnings from their bank or the police that the payment was fraudulent.
Steps to keep your money safer
Banks and investment firms have a major responsibility to defend customers against hackers and fraudsters, but individuals must also take sensible precautions. These include:
- Activate two-factor authentication, which requires two separate forms of identification, such as a password and an authenticator code or fingerprint.
- Choose strong, different passwords for every online financial account rather than reusing the same one.
- Install software and security updates promptly on computers, phones and other devices.
- Treat unsolicited investment opportunities with suspicion, and never respond to unexpected texts or emails asking for payments or bank details.
One final warning about crypto
The UK is expected to introduce regulation for crypto assets late next year.
For now, however, losses on direct crypto investments are not covered by the FSCS. Investors also cannot turn to the Financial Ombudsman Service if something goes wrong.
The Bank of England and FCA are testing financial firms’ cyber defences through simulated attacks
Broomhall does not believe UK investors necessarily need to avoid crypto altogether, but he says anyone considering it must understand the risks before committing money.
Crypto assets carry risks that are very different from conventional investments, he says, particularly the absence of protections people normally expect when using a bank or regulated investment firm. If an exchange is hacked, fails or loses customer assets, recovering the money can be extremely difficult.
Glen Goodman, a former journalist and author of The Crypto Trader, made a small fortune trading digital assets. Yet for seven years he has also highlighted the security dangers involved when crypto is held by exchanges and online platforms.
A polished website can create a false sense of security, Goodman says. The collapse of Bahamas-based exchange FTX in late 2022 demonstrated that appearances can be deceptive, while Binance has shown that even the largest platforms are not beyond the reach of hackers.
For UK crypto investors, Goodman says, the central question is how their assets are stored.
His preferred approach is to purchase crypto through a trading platform such as Coinbase or Kraken, then transfer it promptly to a personal digital wallet, either software-based or hardware-based.
That wallet could be a mobile phone app or, for greater protection, a USB-style device that can be disconnected from the internet and kept beyond the reach of online attackers.
Moving assets in this way can protect them from the type of exchange breach suffered by Binance.
Even so, Goodman fears that as AI becomes more capable, no computer system will be completely safe.
For UK investors seeking exposure to crypto, he says one alternative may be a London-listed fund tracking the price of a particular crypto asset and operated by a major global financial institution such as BlackRock.
But there is still no FSCS protection if that investment fails. The message is clear: proceed with extreme caution.
Now is the time to stay alert.
moneymail@dailymail.co.uk
