Hong Kong Stablecoin Clears Real-Money Insurance Test as Security Flaws Surface.

HashKey Exchange and YF Life Insurance International have completed a live transaction using real funds to test HKDAP, Hong Kong’s regulated Hong Kong dollar stablecoin, for paying insurance premiums, in what the two companies call Hong Kong’s first batch of institutional verification for the token.

Hours earlier, BlockSec published a review of the contract actually running behind that test. BlockSec, the blockchain-security firm co-founded by Yajin Zhou, an associate professor at the Chinese University of Hong Kong, concluded the contract doesn’t yet meet the standard a commercial stablecoin should meet. Neither HashKey’s nor YF Life’s announcement mentioned the review.

The test ran the full subscription and redemption cycle: converting Hong Kong dollars into HKDAP through HashKey Exchange, then redeeming it back out. Those are the mechanics YF Life would need to let customers pay premiums directly in the stablecoin. HashKey and YF Life said the token cuts settlement confirmation from the two to three business days a premium payment normally takes to near-real-time.

YF Life said it looks forward to working with HashKey Exchange to explore stablecoin premium payments, with the aim of becoming one of the first Hong Kong insurers to accept HKDAP for that purpose. Any customer-facing rollout depends on regulatory approval, and neither company has set a launch date.

YF Life’s major indirect shareholders include Massachusetts Mutual Life Insurance Company and Yunfeng Financial Holdings. HashKey Exchange, under listed HashKey Holdings (3887.HK), holds Hong Kong Securities and Futures Commission licences to deal in securities and run automated trading services, plus a virtual asset trading platform licence.

HKDAP is issued by Anchorpoint Financial, a joint venture between Standard Chartered Bank (Hong Kong), telecoms group HKT and Web3 investor Animoca Brands. The Hong Kong Monetary Authority granted Anchorpoint a stablecoin issuer licence on 10 April 2026, one of only two approved from 36 applicants under the territory’s Stablecoins Ordinance; the other went to HSBC.

Anchorpoint began HKDAP’s rollout on 12 August, two days before the YF Life test. Dominic Maffei, the venture’s chief executive, has said its focus is “supporting commercial applications demonstrating regulated tokenised money value in real-world settings, including payments and settlement use cases.”

What the review found

The review found a single administrative key can mint, burn, pause or freeze the token with no time-lock delay for review, and that the contract’s KYC revocation check is “dead code”: a logic error means it never fires, so a wallet stays able to transact even after the verifier that approved it loses its registration. Zhou wrote on X that his team’s review found the contract “is not production-ready.” BlockSec’s write-up said the design clashes with Stablecoins Ordinance requirements on multi-signature authorisation for high-risk actions and segregation of duties.

HKDAP remains in what Anchorpoint calls beta access, limited to institutional counterparties rather than retail customers, and YF Life’s own move to customer-facing premium payments is still conditional on separate regulatory sign-off. Real money is already moving through the rail. The review’s finding is that the contract underneath it isn’t the one Anchorpoint says it will eventually run in production.