HONG KONG — Anchorpoint's HKDAP stablecoin went live on Aug. 12. By Aug. 14, a published security review had flagged the contract as not production-ready, exposing a control failure in Hong Kong's first licensed HKD-pegged token.
The review, authored by blockchain security analyst Yajin Zhou, found that a single private key holds the authority to mint new tokens, freeze wallets and force-burn holdings. Concentrating those three functions in one key removes the checks that prevent unilateral manipulation of the supply—making every holder's balance contingent on whoever controls that key.
Zhou's review also found that the contract's Know Your Customer controls and revocation mechanisms do not work as coded. KYC gates in a licensed stablecoin are not optional—the Hong Kong Monetary Authority's stablecoin framework requires issuers to enforce wallet-level compliance. A revocation control that fails means the issuer cannot remove access from a sanctioned or non-compliant wallet, directly contradicting the terms under which the HKMA issues licenses.
Anchorpoint is not a startup operating outside the regulatory perimeter. The issuer is a joint venture backed by Standard Chartered, HKT—Hong Kong's dominant telecom operator—and Animoca Brands, the Web3 investment group. That institutional backing and a live HKMA license made HKDAP the most credible first entry in Hong Kong's stablecoin market. The security findings arrived before any retail investor could hold the token: the HKMA has restricted HKDAP to institutional holders, with retail access deferred until late 2026 at the earliest.
The institutional-only restriction now reads less like a cautious rollout and more like a firebreak. Had retail wallets been live, a single-key minting vulnerability on a token marketed as pegged to the Hong Kong dollar would have carried direct consumer risk.
The HKMA's own licensing process was already under strain before HKDAP launched. The regulator missed its self-imposed March 2026 target for issuing the first stablecoin licenses. It ultimately granted two licenses in April against a field of 36 applications, a selection rate of roughly 6 percent. The regulator has signaled that even future license grants will remain limited. HSBC's own HKD-pegged coin is expected in the second half of 2026, meaning Anchorpoint launched into a near-empty competitive field—and still drew an immediate security flag.
The South China Morning Post's editorial board said after the licensing delays that Hong Kong's regulators have a well-known cautious stance and that there is no need to rush. The HKDAP findings suggest the opposite problem: a framework rigorous enough to reject 34 of 36 applicants approved a contract that a single published review found non-production-ready within 48 hours of deployment.
Stablecoins pegged to the Hong Kong dollar carry specific structural relevance the security flaws make harder to dismiss. Hong Kong employs a large domestic worker population that sends remittances across Southeast Asia. An HKD stablecoin that works as designed cuts intermediary layers—and the fees they charge—out of those transfers. It can also anchor derivative products that need a stable-value collateral base. A contract with broken KYC controls and a single mint key is not a credible foundation for either use case.
The broader context for the HKDAP launch is a regulatory queue that has effectively ruled out a yuan-denominated equivalent. Beijing has not authorized a CNH stablecoin. The HKMA's licensing structure, combined with the limited number of approvals, means that even the approved HKD stablecoin path is narrow. Anchorpoint's stumble narrows it further.
Zhou's review does not name a specific remediation timeline, and Anchorpoint has not publicly addressed the findings as of publication. The HKMA has not issued a public statement on the security review. The contract runs on Ethereum, which means any fix requires a redeployment—a new contract address, a migration of any existing institutional holdings and a fresh audit before the issuer can credibly claim the vulnerability is closed.
The HKDAP case establishes a gap between Hong Kong's stated ambition to be a digital asset hub and the technical execution that ambition requires. The HKMA spent months vetting 36 applicants and selected two. One of those two deployed a contract a public security review called not production-ready. The retail lockout means no individual funds are at immediate risk. The damage to the licensing program's credibility is a separate question the HKMA has not yet answered.
