Hong Kong's First Licensed Stablecoin HKDAP Under Security Scrutiny

Anchorpoint's Hong Kong dollar stablecoin HKDAP hit the Ethereum mainnet on August 12. Two days later, blockchain security firm BlockSec published a review of the live contract. Its conclusion: the code was "not production-ready."

BlockSec did not find a hack or impaired reserves. It found that too much control sat behind too few keys. A single privileged address could mint new tokens, burn them, freeze accounts and pause the contract. The governance system lacked a timelock that would delay sensitive changes. One address carried overlapping responsibilities for issuance, freezing, KYC administration and audit roles. BlockSec argued this weakened segregation of duties, a basic institutional control principle.

Anchorpoint is one of two companies licensed by the Hong Kong Monetary Authority under the city's new stablecoin regime. The HKMA granted licences to Anchorpoint and HSBC in April after reviewing 36 applications. The regulator said both had demonstrated an ability to manage the relevant risks.

BlockSec compared the deployed contract with the HKMA's supervisory framework. The HKMA requires licensed issuers to maintain strong operational and technology controls, including key lifecycle procedures and governance over internal controls. BlockSec said several characteristics of HKDAP's architecture sat uneasily with those expectations, particularly the concentration of privileged functions and the overlap between execution and oversight roles.

The review also found that HKDAP's KYC revocation mechanism did not function correctly. The relevant logic was effectively unusable because KYC proofs were not properly validated on-chain. The KYC issue is directly relevant to Anchorpoint's distribution model. The company is limiting HKDAP to institutional and professional users. A compliance mechanism that exists in documentation but does not work in deployed code creates a gap between policy and execution.

Anchorpoint describes the current release as a beta phase. The company has said broader retail adoption could begin toward the end of 2026. Beta status lowers immediate exposure. BlockSec noted that the contract is already live on Ethereum mainnet. A beta website can be isolated from customer assets. A live smart contract governing issuance, freezing and transfers is part of the token's operating system.

There is no evidence that any of the identified weaknesses have been exploited. No losses have been reported. The practical question is whether Anchorpoint changes the architecture before HKDAP expands beyond its controlled rollout.

Several changes would directly address the findings: distributing privileged authority across multiple independent signers, separating issuance and compliance responsibilities, and introducing timelocks around sensitive actions. Fixing KYC validation would be equally important if Anchorpoint intends to rely on those controls.

The episode creates a benchmark for Hong Kong's stablecoin regime. The HKMA deliberately licensed only two issuers from 36 applicants and described its approach as cautious. How Anchorpoint and the regulator handle a technically specific criticism days after launch will offer an early signal of whether Hong Kong's model can translate strict licensing standards into equally strong control at the smart-contract level.

For more on stablecoin compliance infrastructure, see Mastercard Tests Single-Audit Stablecoin Compliance With Borderless.xyz.