Hong Kong’s First Licensed Stablecoin Faces an Early Security Test
Hong Kong’s new regulated stablecoin regime has encountered an early test at the smart-contract layer. Just two days after Standard Chartered-backed Anchorpoint began rolling out its Hong Kong dollar stablecoin HKDAP, blockchain security firm BlockSec published an independent review of the live Ethereum contract and concluded that it was “not production-ready.”
Summary:
- BlockSec says HKDAP’s deployed Ethereum contract is not production-ready.
- A single key can mint, burn, freeze and pause the stablecoin, according to the review.
- The researchers also found that KYC revocation and proof validation do not work as intended.
- No exploit, reserve shortfall or loss of funds has been reported.
The findings do not indicate that HKDAP has been hacked or that its reserves are impaired. Instead, they raise a more consequential regulatory question: whether obtaining a stablecoin licence is enough when the controls written into the deployed code may not yet match the operational standards regulators expect.
The biggest risk is concentrated control, not a broken peg
BlockSec’s most serious finding concerns who can control the stablecoin.
Its review found that a single privileged key can perform several high-impact functions, including minting new HKDAP, burning tokens, freezing accounts and pausing the contract. Two keys collectively control all upgrades and administrative roles, while the governance system lacks a timelock that would delay sensitive changes before they take effect.
For a regulated stablecoin, those permissions are not inherently unusual. Issuers need the ability to mint and redeem tokens and may also need freezing or forced-burn capabilities to comply with sanctions, court orders or anti-money laundering requirements.
The issue is concentration.
If the same administrative authority can issue tokens, freeze holders and alter system behavior without independent approval or a meaningful delay, compromise of that authority becomes a single point of operational failure.
BlockSec also found that one address carries overlapping responsibilities for issuance, freezing, KYC administration and audit-related roles. The firm argues that this weakens segregation of duties, a basic principle of institutional control design.
That makes the security problem different from a conventional smart-contract exploit. The concern is not primarily that an outsider can call an unauthorized function. It is that too much legitimate authority appears to be concentrated behind too few credentials.
KYC controls exist in the contract but may not work as intended
The second issue is particularly relevant because HKDAP is a regulated product.
BlockSec says the contract contains a KYC revocation mechanism, but that the relevant logic is effectively unusable because KYC proofs are not properly validated on-chain. In its assessment, the revocation function therefore does not enforce the compliance behavior implied by the contract design.
That matters because HKDAP is being introduced through a controlled distribution model rather than launched as a permissionless stablecoin.
Anchorpoint began the first phase of HKDAP on August 12 with access limited to institutional distributors, corporate users and professional investors. Authorized distributors are expected to provide conversion between HKDAP and fiat currency and integrate the token into payments and settlement applications.
A compliance mechanism that exists in documentation but does not function correctly in deployed code creates a gap between policy and execution.
For regulated tokenized money, that gap may matter more than it would for a conventional decentralized token because the product’s regulatory legitimacy depends partly on demonstrating that restrictions and compliance controls can actually be enforced.
Why BlockSec says the design conflicts with HKMA expectations
BlockSec compared the deployed contract with the Hong Kong Monetary Authority’s supervisory framework for licensed stablecoin issuers.
The HKMA requires issuers to maintain robust operational and technology controls, including procedures covering the full lifecycle of private keys. Its framework also emphasizes governance, internal controls, risk management and secure management of technology infrastructure.
BlockSec argues that several characteristics of HKDAP’s deployed architecture sit uneasily with those expectations, particularly the concentration of privileged functions, overlap between execution and oversight roles, and lack of timelocked governance.
READ MORE: Stablecoin Payroll Is Turning Off-Ramps Into Everyday Finance
This is an independent interpretation by BlockSec, not an HKMA enforcement finding. The regulator has not publicly said that Anchorpoint has breached its licence conditions.
That distinction is critical.
According to Reuters, Anchorpoint remains one of only two companies licensed by the HKMA under Hong Kong’s new stablecoin regime. The authority granted licences to Anchorpoint and HSBC in April after receiving 36 applications, saying the successful applicants had demonstrated an ability to manage the relevant risks.
The security review therefore does not invalidate the licence. It exposes a different question: how quickly supervisors respond when publicly observable code appears to diverge from the controls expected during authorization.
A licence and a secure smart contract solve different problems
HKDAP illustrates something increasingly important as regulated finance moves onto public blockchains.
A regulatory licence evaluates the issuer as an institution. It can cover reserve management, governance, redemption rights, AML controls, operational resilience and management competence.
A smart-contract audit evaluates the software enforcing part of that business model.
Those layers overlap, but they are not substitutes.
Anchorpoint can maintain fully backed reserves and still deploy weak administrative controls. Conversely, a technically robust ERC-20 contract says nothing about whether the issuer holds sufficient reserves or can meet redemptions.
BlockSec explicitly limited its conclusions to the publicly deployed contract and observable on-chain behavior. It made no judgment about reserve backing, internal key-storage procedures or other controls that cannot be verified from Ethereum.
That boundary makes the findings more useful rather than less. They identify precisely what public blockchain infrastructure adds to financial supervision: outsiders can inspect the rules actually running in production instead of relying entirely on issuer disclosures.
The single-key issue is serious because of what those powers can do
A concentrated admin key becomes especially sensitive in a fiat-backed stablecoin because the privileged functions directly affect the token’s monetary supply and ownership rights.
If a key with mint authority were compromised, an attacker could potentially create unauthorized tokens. Freeze authority can prevent specific addresses from transferring assets. Forced burning can remove tokens from circulation, while pause functionality can halt broader activity.
Institutional systems often reduce those risks through mechanisms such as multisignature approval, role separation and timelocks.
Those controls do not eliminate compromise risk, but they make it harder for one credential or one operator to take unilateral action.
BlockSec’s criticism is that HKDAP recreated several of these control mechanisms through custom code rather than relying more heavily on mature, widely tested smart-contract components. The firm says many of the weaknesses it identified sit precisely in that custom governance machinery.
That gives the review a broader relevance beyond Anchorpoint. Regulated stablecoin issuers may be institutionally sophisticated while still introducing unnecessary technical risk by rebuilding standard blockchain primitives themselves.
Beta access does not remove the regulatory problem
Anchorpoint describes the current release as a beta-access phase, with initial distribution focused on institutional and professional users. The company has said broader retail adoption could begin toward the end of 2026 depending on market conditions.
Beta status lowers the scale of immediate exposure, but BlockSec argues that it does not resolve the underlying concern because the contract is already deployed on Ethereum mainnet.
That is an important distinction in financial infrastructure.
A beta website can be isolated from customer assets. A live smart contract governing issuance, freezing and transfers is already part of the asset’s operating system.
There is currently no evidence that any of the identified weaknesses have been exploited, and no losses have been reported. The practical issue is whether Anchorpoint changes the architecture before HKDAP expands beyond its controlled institutional rollout.
What matters now is whether the code changes before retail access
The next meaningful development is not HKDAP’s transaction volume. It is the contract architecture.
Three changes would directly address the most significant findings: distributing privileged authority across multiple independent signers, separating issuance and compliance responsibilities, and introducing delays around sensitive administrative actions. Fixing KYC validation would be equally important if Anchorpoint intends to rely on those controls as part of its regulated distribution model.
Because HKDAP’s code is publicly observable, those changes can be verified directly rather than inferred from corporate statements.
The timing also creates a useful benchmark for Hong Kong’s broader stablecoin regime. The HKMA deliberately licensed only two issuers from 36 applicants and has described its approach as cautious. How Anchorpoint and the regulator deal with a technically specific criticism only days after launch will offer an early indication of whether Hong Kong’s model can translate strict licensing standards into equally strong controls at the smart-contract level.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Zdravkov
Reporter at CoinsPress
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 10,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
