Risk in APAC has moved from who holds the key to what is allowed to act. The largest losses of Q3 2026 began not with a stolen credential, but with a system, person or model that was permitted to act. Bitget’s wallet incident reached a revised USD 387.5 million, while Hong Kong’s SFC flagged 65 websites impersonating HashKey, a licensed exchange. Meanwhile, 28 banks settled tokenised cross-border payments in the BIS pilot. Our Q3 2026 Quarterly Risk Report maps the three themes that defined the quarter and where cover most often falls short.
What This Report Covers
- Why digital asset losses have moved from keys to governance, vendors and approval workflows
- How fraudsters used real domains, licensed brands and AI to make requests look genuine
- What the move of tokenisation and stablecoins into live infrastructure means for operational risk
- Which controls and insurance lines deserve review before renewal
