This article first appeared in The Edge Malaysia Weekly on April 28, 2025 - May 4, 2025
ON Thursday (April 24) afternoon, when all eyes were on the trade war between the US and China, some investors on Bursa Malaysia found themselves logged out of their online brokerage accounts.
At first they thought this was due to a computer glitch in a relatively quiet market. But at around 4pm, they began to notice that something was not quite right.
The warrants of Bina Puri Bhd (KL:BPURI) spiked up to a level higher than the price of its mother share.
As the market wound down, news began to emerge that the trading system of some brokerage houses had been hacked, leading to unauthorised access and trading activity. By Thursday night, brokers were scrambling to unravel what had happened while grappling with immediate concerns about how to handle trading the following day as their trading system appeared to have been compromised.
Some even expected the regulators — Bursa Malaysia and the Securities Commission Malaysia (SC) — to suspend the market until there could be some form of assurance that the trading system was safe.
Nevertheless, trading continued as usual on Friday. On the same day, Bursa and the SC came up with a joint statement assuring investors of the integrity of the capital markets and that brokers as well as regulators were on high alert to ensure that the marketplace remained fair and orderly.
The joint statement also confirmed the unauthorised access and trading activity.
“Capital market regulators and brokers are on alert and remain vigilant while working closely to ascertain the root cause of the incident, and to implement any further necessary measures,” the joint statement said.
But the incident has left some unanswered questions as regulators, brokerage firms and system providers draw up measures to safeguard their trading systems from future attacks. For starters, several brokers have told clients with online trading accounts to reset their username and password.
There are two main providers of direct market access platform services to stockbroking firms — N2N Connect Bhd (KL:N2N) and Excel Force MSC Bhd (KL:EFORCE).
Following the hacking incident, N2N, in an April 24 note to clients outlined several recommended security measures, including blocking unidentified high-risk internet protocol (IP) addresses and trades from non-Malaysian IPs.
On the restrictions on IP addresses outside Malaysia, N2N told brokers to contact the company if any of their customers was affected by the block.
Following the hacking, questions linger about who will be responsible for the losses from the unauthorised trades that happened on Thursday afternoon. Will the authorities cancel the trades?
It is understood that Bursa held an “emergency meeting” with all stockbroking firms last Friday. During the briefing, Bursa suggested that the affected brokerage firms absorb the losses, if any, until there is further clarity on the matter, say sources.
“This is because the process of buying and selling shares requires brokerage houses to submit any rectification to erroneous trades within 15 minutes of the transaction,” says a source.
However, brokers believe they are not at fault because they claim their systems were not compromised and therefore they should not have to bear the burden of any losses arising from the recent hack.
“The trading system of the brokerage firms worked fine. So, why must they bear the losses, if any?” asks a broker.
Nevertheless, says another broker, most brokerage houses have insurance coverage for losses should their system be compromised.
“But at this point, it is unclear at which level the insurance coverage will be coming from,” he adds.
The quantum of losses cannot be determined yet. However, sources point to two counters — Bina Puri and Bina Puri-Warrant B — which saw unauthorised trading on Thursday.
“Some 80 accounts involving multiple brokerage firms were affected,” a source tells The Edge.
As at press time, the regulators had yet to disclose the list of securities that were affected by the incident.
Bina Puri-Warrant B, which closed at 30 sen on Wednesday, exhibited unusual trading activity from around 3.15pm on Thursday, doubling to 60 sen by 3.30pm. It remained at that level until 4.15pm before retreating to close at 48.5 sen — a significant increase of 61.67%.
The warrant’s total trading volume for the day hit 41.17 million units, with a substantial 33.149 million transacted at the peak price of 60 sen.
The trading volume of Bina Puri’s shares began to rise alongside the warrant, repeatedly hitting the day’s high of 40 sen, representing a 15.9% gain from the previous day’s close. The stock ended the day at 37.5 sen — up 8.7%, with a total of 103.68 million shares traded and a turnover of RM37.78 million.
In addressing the recent unusual trading activity, Bina Puri, in a filing with Bursa last Friday, says it is prepared to cooperate with the relevant authorities, including the SC and Bursa, by providing any information or assistance required during their investigation.
“The group would like to reassure stakeholders that the personal accounts and shareholdings of its key shareholders and owners have not been compromised or accessed without authorisation,” Bina Puri says in the filing. “The board of directors remains committed to transparency and the protection of investor interests.”
At last Friday’s close, Bina Puri’s share price fell 29.3% to 26.5 sen while the price of its warrant dropped 61.9% to 18.5 sen apiece.
Sources say while the authorities feel the brokers are liable for any losses arising from Thursday’s hack, the brokers themselves are looking at the service providers.
“But nothing has been ascertained as of now as to who is liable. One option is for Bursa to cancel all trades that were unauthorised,” says a source.
Under Bursa’s trading rules, the exchange regulator has the power to act on reversing any “erroneous execution” of a contract arising from a system failure or malfunction in the automated and computerised securities trading system or in any other system.
Bursa can also cancel any trades from unauthorised entry of orders.
A broker says that on the bright side, it is good that the incident happened on Thursday as it gave the authorities an extra two days to look closely into the matter and determine if there was any wrongdoing.
“Under the T+2 (settlement) rule, the sales proceeds will only be settled on Monday (April 28). This gives all parties involved the weekend to identify the impact [from the hacking incident] and what they can do about it,” the broker adds. Investors must settle their security transactions within two business days under T+2.
Save by subscribing to us for your print and/or digital copy.
P/S: The Edge is also available on Apple's App Store and Android's Google Play.