Cyber

Security

Dubai

The Hong Kong Securities and Futures Commission (SFC) on Thursday issued new requirements for phishing-resistant authentication methods for virtual asset trading platforms (VATPs) and online brokers in the special administrative region.
The new standards require stronger phishing-resistant authentication methods and device binding while prohibiting the use of one-time passwords through SMS, email or app-based logins.&nbsp;Platforms must implement the changes within the next 12 months.
The <a href="https://apps.sfc.hk/edistributionWeb/gateway/TC/news-and-announcements/news/doc?refNo=26PR101" rel="noopener noreferrer nofollow">requirements</a> outlined stronger alternatives such as passkeys, registered devices with cryptographic verification and hardware security keys, which the SFC described as phishing-resistant solutions.
The measures raise Hong Kong's cybersecurity standards as the global crypto industry saw an increase in phishing attacks and social engineering scams in the first quarter of 2026. Those types of incidents accounted for $306 million of the <a href="https://cointelegraph.com/news/web3-hacks-cost-464-million-in-q1-hacken" rel="noopener noreferrer nofollow">industry's total losses</a> of $482 million in the period.&nbsp;
Counterfeiting and fraud attacks accounted for 57% of the security incidents reported to the Hong Kong Cyber Security Accident Coordination Center in 2025, according to announcement.
“To protect customer accounts from increasingly complex and changing counterfeiting and fraud attacks, comprehensive measures must be implemented in conjunction with prevention, detection, response and education,” said Ye Zhiheng, executive director of the Intermediaries Department of the China Securities Regulatory Commission.
<img alt="" height="870" src="https://s3-images.ctmedia.io/media/content/pasted-image-1963.png" width="1420">
SFC issues new anti-phishing requirements for crypto platforms and online brokers. Source: apps.sfc.hk&nbsp;
<h2 id="phishing-attacks-threaten-crypto-investor-holdings">Phishing attacks threaten crypto investor holdings</h2>
Phishing attacks and social engineering scams are a pressing global concern for the cryptocurrency industry.
On Wednesday, a crypto investor <a href="https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval" rel="noopener noreferrer nofollow">lost nearly $1 million</a> after signing a malicious phishing token approval transaction on Ethereum, the latest reported incident of phishing scam-related crypto industry losses that totaled $366 million in the first half of 2026.
Earlier this month, a wallet holder reportedly lost $1.65 million after connecting to a fake exchange and signing a malicious contract in a similar incident, which enabled attackers to gain unlimited access to the funds, researcher Ryan Coleman <a href="https://x.com/RyanColeXBT/status/2073172860034789620" rel="noopener noreferrer nofollow">said</a> on Friday.&nbsp;
Related: <a href="https://cointelegraph.com/news/belgian-police-arrest-phishing-gang-leader-572k-stolen" rel="noopener noreferrer nofollow">Belgian police arrest suspected phishing gang leader tied to $572K theft</a>
On May 25, onchain analyst “b-block” warned that scammers used Google to deploy malicious phishing ads impersonating decentralized exchange Uniswap, reportedly stealing more than <a href="https://cointelegraph.com/news/scammers-make-400k-through-fake-uniswap-ads-on-google" rel="noopener noreferrer nofollow">$400,000 from victims</a>.
Leading crypto industry figures, including Binance co-founder Changpeng <a href="https://cointelegraph.com/news/zhao-fix-address-poisoning-investor-loses-50m" rel="noopener noreferrer nofollow">Zhao, have previously</a> called for better wallet security measures to avoid phishing scams, after an investor lost $50 million in an address poisoning scam in December 2025.&nbsp;
In May 2024, one victim lost $71 million to an&nbsp;<a href="https://cointelegraph.com/news/trader-loses-68-million-address-poisoning-scam" rel="noopener noreferrer nofollow">address poisoning scam</a>&nbsp;in an unusual case that ended with the attacker&nbsp;<a href="https://cointelegraph.com/news/wbtc-thief-returns-71-million" rel="noopener noreferrer nofollow">returning the full amount</a>&nbsp;two weeks later. The reversal followed mounting pressure from investigators who claimed to have tracked the scammer’s potential IP address.
Magazine: <a href="https://cointelegraph.com/features/asia-express" rel="noopener noreferrer nofollow">Dubai tops Asian crypto hubs, Taiwan passes crypto laws: Asia Express</a>

Hong Kong regulator orders new anti-phishing measures for crypto platforms

Table of Contents

Cointelegraph

Other articles published on Jul 9, 2026

Join our free newsletter for daily crypto updates!