Hong Kong’s SFC issued stricter custody requirements for licensed virtual asset platforms after $3B in global crypto thefts, targeting vulnerabilities in wallet security, transaction verification, and access controls.
The Hong Kong Securities and Futures Commission (SFC) has released a comprehensive circular introducing strict new custody standards for virtual asset trading platforms, following over $3 billion in global crypto thefts during the first half of 2025. The measures form part of its “ASPIRe” roadmap and mandate minimum requirements for wallet infrastructure, transaction verification, and access controls. The move comes amid increasingly rapid and sophisticated attacks—hackers can move funds in four seconds, 75 times faster than average exchange alerts—highlighted by incidents such as BtcTurk’s $48 million multi-chain hack and Bybit’s $1.5 billion loss in February. Hong Kong, which currently licenses 11 platforms with nine under review, is also advancing stablecoin regulation, granting only a few initial licenses, and expanding tokenization initiatives. In H1 2025, North Korea-linked groups were responsible for $1.6 billion of stolen crypto, while recovery rates remain low at just 4.2%.