Computer misuse

Read the PDF edition (2 pages)

The offences

The Computer Misuse Act 1993 criminalises unauthorised access to computer material (s 3), access with intent to commit an offence (s 4) and unauthorised modification (s 5). Further offences cover unauthorised use or interception of a computer service (s 6), unauthorised obstruction (s 7) and unauthorised disclosure of access codes (s 8). The 2017 amendments added offences of dealing in personal information obtained through computer misuse (s 9) and obtaining items for use in computer misuse offences (s 10). Maximum penalties for a first offence range from a S$ 5,000 fine or two years' imprisonment for simple unauthorised access to a S$ 50,000 fine or ten years for access with intent. Where a protected computer is involved the ceiling rises to S$ 100,000 or twenty years.¹

Every theft of a private key is an offence under s 3, because reading the key file or the seed stored in a device is access to computer material without authority. Using the key to sign a transaction that moves tokens is access with intent to commit an offence (s 4), while the modification of the ledger state effected by the transaction is arguably unauthorised modification under s 5. A smart-contract exploit that causes a protocol to transfer tokens it would not otherwise have transferred is the paradigm case of unauthorised modification. The "code is law" defence, that the contract permitted whatever input it accepted, has not been tested in a Singapore court. My expectation is that it would fail, because s 2 defines "unauthorised" by reference to the entitlement of the person controlling the computer, who never consented to being drained.

Extraterritorial reach

The Act applies where either the accused or the computer was in Singapore at the material time. A hacker in Eastern Europe who drains the wallet of a Singapore-licensed exchange commits an offence triable in Singapore even if no Singapore resident was harmed, because the exchange's servers or signing devices are in Singapore. The provision gives the Commercial Affairs Department jurisdiction in almost every hack of a Singapore platform, which in turn supports mutual legal assistance requests to the countries where the proceeds land.²

Notes

1. Computer Misuse Act 1993, ss 3–11, Singapore Statutes Online (consulted June 2026): penalties as stated for each section, with enhanced punishment where damage is caused. ↩
2. Computer Misuse Act 1993, territorial scope provision, Singapore Statutes Online. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.