Hong Kong SFC Tightens Crypto Custody Rules After Global Security Incidents

Hong Kong’s Securities and Futures Commission (SFC) has issued strict new custody standards for virtual asset trading platforms following global security incidents that resulted in over $3 billion in crypto losses during the first half of 2025.

The comprehensive circular sets minimum requirements for wallet infrastructure, transaction verification, and access controls as the regulator prepares the industry for advanced custody technologies under its “ASPIRe” roadmap.

The Hong Kong SFC issued new guidance for virtual asset trading platforms to strengthen custody standards, citing global security incidents and gaps found in a recent review. The circular outlines minimum requirements for wallet infrastructure, access controls, and management…

The SFC’s action comes amid a devastating wave of crypto security breaches, with hackers stealing funds in as little as four seconds, 75 times faster than average exchange alert systems can respond.

Just yesterday, Aug 14, Turkish exchange BtcTurk became the latest victim with a suspected $48 million multi-chain attack targeting hot wallets across seven blockchain networks, marking the second major breach for the exchange within 14 months.

Global crypto losses reached $2.47 billion across 344 incidents in the first half of 2025, with wallet-related breaches accounting for $1.7 billion across just 34 attacks.

The Bybit exchange suffered the most significant single loss at $1.5 billion in February, while infrastructure attacks dominated 80% of stolen funds through compromised private keys and inadequate access controls.

Dr Eric Yip, the SFC’s Executive Director of Intermediaries, emphasized that “client asset protection must always remain a top priority for all licensed VATPs” amid heightened global risks.

The new standards address key vulnerabilities, including compromised third-party wallet solutions, insufficient transaction verification processes, and inadequate access controls over approval devices.

According to a report Cryptonews covered yesterday, the SFC and Hong Kong Monetary Authority issued a joint warning about market volatility linked to stablecoin licensing speculation, cautioning investors against basing decisions on “misleading prospects of gains from short-term price volatility.”

Global regulatory differences on stablecoin may influence issuer location decisions and adoption as Hong Kong implements its regime.#hongkong #hk #stablecoinhttps://t.co/bwww2I8wVA

HKMA Chief Executive Eddie Yue confirmed that only a small number of stablecoin licenses will be granted initially despite engaging with dozens of interested parties.

As of July 30, Hong Kong has licensed only 11 virtual asset platforms, with nine under review, implementing expedited licensing procedures since January 2025.

The government accelerated tokenization efforts with approved products, including gold tokens and money market funds, while exploring real estate and private equity tokenization through Project Ensemble infrastructure.

Over 40 companies have submitted stablecoin license inquiries, even before the August 1 regulation took effect.

Major firms, including JD.com, Ant Group, Standard Chartered, and Circle, publicly stated application intentions, while law firms report managing consultations for additional candidates finalizing materials.

Blockchain analytics firm Global Ledger revealed that hackers moved funds in 68% of cases before attacks became publicly known, with one-quarter fully laundering stolen assets before any alerts were issued.

The fastest fund movement occurred just four seconds after exploitation, while the fastest complete laundering process took 2 minutes 57 seconds.

North Korea-linked groups, including Lazarus, accounted for $1.6 billion or 70% of total stolen amounts in the first half of 2025.

The sophisticated actors plan movements to coincide with normal transaction activity, typically striking around noon when organizations experience staff shifts and reduced vigilance.

July crypto hack losses surge 27% to $142 million with CoinDCX's $44 million insider breach and GMX's $42 million exploit leading victims.#July #CryptoHackhttps://t.co/4UCMKaxUvI

Infrastructure attacks targeting centralized exchanges contributed to 54% of total losses, with hackers exploiting high-value single points of failure.

Personal wallets and token contracts followed at 11.7% and 17.2% respectively, while DeFi platforms, bridges, and gaming projects suffered additional losses.

Recovery efforts returned only $187 million through law enforcement, white-hat arrangements, and exchange cooperation, representing just 4.2% of stolen funds.

Legal frameworks have failed to evolve quickly enough to match the speed of digital asset activities, creating challenges for international cooperation and asset seizure.

Notably, physical violence against crypto holders has also escalated with 32 “wrench attacks” reported globally in 2025, putting the year on pace to exceed 2021’s record.

Nearly one-third occurred in France, where attackers increasingly target family members through kidnapping and mutilation attempts, demanding ransom payments.

The post Hong Kong SFC Tightens Crypto Custody Rules After Global Security Incidents appeared first on Cryptonews.