Hong Kong's push to build a licensed stablecoin market has faced an early, highly public test. Within days of the 12 August 2026 launch of HKDAP, the Hong Kong dollar stablecoin that went live through licensed distributors, the blockchain security firm BlockSec published a review of the deployed smart contract and concluded that it is, in its words, “not production-ready”. The finding is a design and governance critique rather than a report of any hack: at the time of writing, no exploit, reserve shortfall, or loss of user funds has been reported.
HKDAP is issued by Anchorpoint Financial Limited, a venture whose largest shareholder is Standard Chartered, alongside HKT and Animoca Brands. It is worth being precise about the “first” claim circulating around the story: the Hong Kong Monetary Authority (HKMA) granted its first two stablecoin-issuer licences on the same day in April 2026, to Anchorpoint and to HSBC. HKDAP is best described not as the first licence, but as the first regulated Hong Kong dollar stablecoin to actually reach the market.
What BlockSec says it found
According to BlockSec's published review, the powers to mint, burn, freeze and pause the token are concentrated in a way that lets a single key act alone. The firm reports that one address holds six roles, and that high-impact operations do not require the kind of multi-party approval usually expected of a regulated asset. BlockSec also flags defects in the token's compliance logic, saying the on-chain checks intended to enforce customer verification do not work as written and, in places, never execute. Its overall assessment is blunt: the contract's governance is “concentrated enough that a single key can mint, burn, or freeze”.
These are BlockSec's findings and its interpretation. The HKMA has not confirmed them, and Anchorpoint has not yet rebutted them.
The rules in question
The review's regulatory edge comes from Hong Kong's statutory framework for measuring a design. The Stablecoins Ordinance (Cap. 656) came into force on 1 August 2025, and the HKMA's detailed expectations are set out in its Guideline on Supervision of Licensed Stablecoin Issuers. BlockSec maps the HKDAP design against the guideline's technology-risk provisions, and those citations line up with the published text:
- No single party acting alone (para 6.5.3). The guideline says high-risk lifecycle operations, including mint, burn, freeze and pause, should be designed so that no single party can perform them unilaterally, for example through a multi-signature protocol, with measures such as timelocks and whitelisted minting.
- Segregation of duties (para 6.5.4). Split duties across staff to avoid a single point of failure, and ensure no one person has full control over role management.
- Independent audits on every change (para 6.5.5). A qualified third party should audit the smart contracts on deployment, redeployment or upgrade, confirming to a high level of confidence that they are free of vulnerabilities.
- Elevated key controls (para 6.5.7). Keys that govern minting and role assignment are treated as “significant” and must meet heightened security standards.
Whether HKDAP's live deployment actually breaches these provisions is, for now, a question the supervisor has not answered.
What the regulator has, and has not, said
The HKMA licensed Anchorpoint as a stablecoin issuer, and the licence can be checked against the authority's Register of Licensed Stablecoin Issuers. But it has issued no statement on the BlockSec review, opened no public action, and made no finding that Anchorpoint has breached its licence conditions. A separate HKMA alert warning the public about fake HSBC and HKDAP tokens circulated around the launch; that is a scam-token warning and should not be confused with this security review.
Why it matters for compliance teams
Beyond HKDAP, the episode is the first real-world stress test of Hong Kong's new regime, and it lands on a point compliance and technology-risk teams should note: in a licensed stablecoin, smart-contract governance is no longer an engineering best practice but a supervised control. A licence attests that an issuer met the bar at authorisation; it does not, by itself, guarantee that a specific on-chain deployment carries the multi-party approvals, working compliance logic and independent audit trail the guideline expects. The gap between “licensed” and “production-ready” is exactly where the next round of supervisory attention is likely to fall.
For now, the responsible reading is measured: an independent firm has raised serious design questions, the issuer and the regulator have yet to respond, and readers should watch for those responses rather than assume the matter is settled. You can read BlockSec's full review and the HKMA's supervisory guideline for the primary material.
