1) Regulatory

Hong Kong finalises its crypto regulatory framework as SFC completes the final licensing pillar

SFC chief executive Julia Leung declared this week that the conclusion of its public consultation on licensing regimes for virtual asset advisers and managers marks “the final leg of our journey to complete the regulatory framework for digital assets.” The SFC now covers exchanges, custodians, dealers, and advisers under a single coherent framework. Hong Kong also has 13 publicly offered tokenized products with HK$10.7B in AUM as of March 2026, a sevenfold increase from the prior year. The completion of the framework removes the last regulatory ambiguity that was keeping institutional capital at the door.

Read more

Singapore Police and crypto exchanges block $4.2M in scam funds in second joint operation

The Singapore Police Force’s Anti-Scam Centre ran its second joint operation with Coinbase, OKX, Coinhako, Gemini, Independent Reserve, StraitsX, and Upbit between April 16 and May 31, using blockchain analysis tools from Chainalysis and TRM Labs to identify 145+ scam victims across investment, job, love, and government impersonation scams. Combined with the first operation in March, the two rounds have safeguarded over $7M in total. Singapore separately announced the launch of a dedicated Cyber Command unit in May, scheduled to begin operations in July 2026, focused on cybercrime investigations, scam disruption, and crypto-related crime tracking.

Read more

2) Hacking & Physical Risks

China-linked SHADOW-EARTH-053 targets government and defense sectors across South, East, and Southeast Asia

Trend Micro disclosed details of a sustained espionage campaign targeting ministries and contractors in Thailand, Malaysia, Pakistan, India, Myanmar, Sri Lanka, and Taiwan, alongside one European NATO member. The group exploits unpatched Microsoft Exchange and IIS servers, deploys Godzilla web shells for persistent access, and stages ShadowPad implants via DLL sideloading. A parallel track specifically surveils Uyghur, Tibetan, Taiwanese, and Hong Kong dissidents and journalists. The dual-track structure, government intelligence collection combined with activist targeting, is a direct signal that political and business cyber risk are converging across the region.

Read more

DoJ, Meta, Microsoft, and Coinbase dismantle Southeast Asia crypto fraud networks, freeze $3.8M

The US Department of Justice’s Scam Center Strike Force, partnering with Meta, Microsoft, Starlink, and Coinbase, dismantled pig-butchering, investment fraud, and human trafficking networks running out of Southeast Asian special economic zones. Results: 1.4M Facebook and Instagram accounts disabled, 20,000 Microsoft accounts suspended, $3.8M in crypto frozen, and 63 arrests by the Royal Thai Police. For insurers, the scale confirms that APAC digital asset flows remain deeply entangled with organised fraud infrastructure at the regional level.

Read more

3) Industry & Markets

DB Insurance closes $1.65B Fortegra acquisition in the first Korean carrier purchase of a US insurer

South Korea’s DB Insurance completed its acquisition of Florida-based specialty insurer Fortegra for $1.65B in cash, closing the largest purchase of a US insurer by a Korean non-life carrier. Fortegra reported $3.07B in gross written premiums in 2024, operates across all 50 US states and eight European countries, and holds an AM Best A- rating. DB Insurance will operate Fortegra as a wholly owned subsidiary with existing leadership intact. Analysts expect Hanwha Life, Samsung Fire & Marine, and KB Insurance to study this transaction closely as it has established the regulatory and deal-structuring playbook for Korean outbound M&A in Western specialty insurance.

Read more

Willis D&O survey: Asian boards rank cyber as their top liability risk, separating the region from the global cohort

Willis’s 2026 global D&O survey of 975 senior decision-makers across finance, insurance, healthcare, and industrial sectors found that 76% of Asian respondents rated data loss and cyberattacks as very important or extremely important, placing the region ahead of the global average where health and safety holds the lead. Geopolitical risk entered the top seven globally for the first time, reflecting the impact of the Iran conflict and US-China trade friction on boardroom risk priorities. For APAC D&O underwriters, the combination of elevated cyber concern and newly surfacing geopolitical exposure is reshaping what directors face in terms of personal liability.

Read more

4) Insurance Spotlight

Asia’s cyber insurance market shows structural signs of life after years of flat penetration

A Dark Reading analysis published May 29 found that Asia’s cyber insurance market is showing its first genuine structural growth signals, backed by the CyberCube/UIB report earlier that week confirming Asia as the global growth frontier for the segment. Sub-5% SME penetration across most Asian markets, combined with accelerating ransomware volumes, 5G rollout, and tightening regulatory disclosure mandates, is converting latent demand into active buying. India, Vietnam, and Southeast Asia are the primary growth pockets. The question is no longer whether the market will grow, but which distribution models and product structures will capture it first.

Read more

QBE warns cyber attacks are speeding up across Asia Pacific as ransomware dwell time collapses

QBE’s latest APAC threat intelligence found that the average time between attacker access and ransomware deployment has fallen 70% since 2021, from around 100 minutes to under 30 minutes in recent incidents, with some cases recording full encryption of thousands of endpoints in under 10 minutes. APAC is increasingly in scope for newer criminal groups looking for markets with less competition from established actors, and attackers are combining technical access with social engineering to scale impact. For insurers, shorter dwell times compress the incident response window that most policy structures were designed around.

Read more

Hong Kong / London — 5^th June 2026— Continuum, a specialist risk advisory and insurance solutions firm focused on emerging technology industries across Asia, is pleased to announce a strategic tie-up with Native, a London-based specialist digital asset insurance broker.

The partnership brings together Continuum’s regional expertise across Asia with Native’s deep specialism in digital assets, blockchain risk, and access to the London insurance market. Together, the firms will support digital asset businesses, Web3 companies, blockchain infrastructure providers, and other emerging technology firms seeking sophisticated insurance solutions tailored to fast-evolving risks.

As digital asset adoption accelerates across Asia, companies in the sector are facing increasing pressure from investors, regulators, counterparties, and customers to demonstrate stronger risk management, governance, and balance sheet protection. Insurance is becoming a critical part of that infrastructure.

Through this partnership, Continuum and Native will work together to provide clients in Asia with access to specialist London market capacity, digital asset insurance expertise, and tailored coverage solutions across areas such as directors’ and officers’ liability, professional indemnity, crime, cyber, technology errors and omissions, custody-related risks, smart contract exposures, and other specialist risk classes.

Rob Russell, Founder & Director of Continuum, said:

“Asia is one of the most dynamic regions in the world for digital assets and emerging technology. But many businesses in this space remain underserved by traditional insurance channels. Our partnership with Native allows us to combine Continuum’s regional presence and client advisory expertise with Native’s specialist digital asset knowledge and London market access. Together, we can deliver more relevant, responsive, and sophisticated insurance solutions for the next generation of technology companies.”

Ben Davis, CEO and Co-Founder at Native, said:

“Native was built to support digital asset businesses with insurance solutions that understand how this market operates. Partnering with Continuum gives us a strong regional partner in Asia with deep knowledge of emerging technology risks, local client needs, and the broader insurance landscape. We see a significant opportunity to help high-quality digital asset businesses across Asia access the protection and capacity they need to grow with confidence.”

The partnership reflects a shared belief that the digital asset sector requires insurance partners who understand both the technical nature of blockchain-based risk and the realities of institutional insurance placement. Native’s public positioning focuses on bridging traditional insurance with onchain finance, while Continuum brings advisory expertise across financial lines, cyber, professional liability, and emerging technology insurance in Asia.

The collaboration will initially focus on supporting digital asset and emerging technology clients across Asia, including Singapore, Hong Kong, Japan, and other regional markets where demand for specialist insurance solutions continues to grow.

About Continuum

Continuum is a specialist risk advisory and insurance solutions firm focused on emerging technology industries across Asia and the firm supports businesses operating in sectors such as digital assets, fintech, blockchain, Web3, artificial intelligence, venture-backed technology, and financial services. Continuum provides specialist insurance advisory across financial lines, directors’ and officers’ liability, professional indemnity, cyber, crime, general liability, and digital asset insurance.

Website | LinkedIn

About Native

Native is a pioneering global insurance broker for the digital assets sector bridging traditional markets with on-chain capital. Native combines decades of experience in both digital assets and global insurance markets to solve complex risk challenges. With access to Lloyd’s of London, Native supports innovative protocols and platforms with a unique blend of consulting, traditional insurance placement, and alternative risk transfer solutions.

Website | LinkedIn

Media Contact

Download the full press release (PDF)

1) Regulatory

South Korea’s end-of-May crypto compliance deadline hits as exchanges race to implement kill switches

The FSC’s post-Bithumb reform package reaches its implementation deadline this week, requiring all Korean crypto exchanges to complete upgrades to 5-minute asset reconciliation, automated kill switches that halt transactions on detected discrepancies, and monthly external audit cycles. The original Bithumb incident in February saw 620,000 BTC accidentally credited to 249 users due to a single system error. With the deadline landing at end of May, exchanges that fail to demonstrate compliance face regulatory action as South Korea integrates these controls into its broader digital asset framework law.

Read more

Thailand Bitcoin and Ether ETFs advance as Southeast Asia races to become the region’s digital asset hub

Following SEABW’s close, Thailand is pressing ahead with its push to position Southeast Asia as a rival to Hong Kong and Singapore on digital asset infrastructure. The Thai SEC’s approval of crypto ETFs and regulated futures trading on TFEX, combined with a five-year capital gains tax exemption running through 2029, is drawing institutions that were previously sitting on the sidelines. The competitive dynamic between Bangkok, Singapore, and Hong Kong is accelerating regulatory clarity across the region faster than any single regulator could achieve alone.

Read more

2) Hacking & Physical Risks

TrapDoor supply chain attack targets crypto and AI developers across npm, PyPI, and Crates.io (May 24-25)

Socket disclosed a sophisticated malware campaign on May 24 that planted 34+ malicious packages and 384+ related versions across the three major developer package repositories. TrapDoor targets developers building crypto, DeFi, Solana, and AI protocols, stealing GitHub tokens, SSH keys, cloud credentials, and wallet data before any code ships. The campaign also injected hidden directives into .cursorrules and CLAUDE.md files to manipulate AI coding assistants into running data exfiltration routines disguised as security scans. For insurers writing smart contract and protocol cover, this confirms the pre-deployment layer is now an active attack surface.

Read more

“The next big DeFi exploit will start before the code is deployed” — and 2026 is proving it

A CryptoSlate analysis published this week argues that the industry’s focus on on-chain vulnerabilities is misplaced: the real entry points are now the developer environments, CI/CD pipelines, and dependency chains that determine what code reaches mainnet. The TrapDoor disclosure this week is cited as the clearest live demonstration yet. For underwriters, this shifts the risk profile of smart contract cover: a protocol can pass every audit and still be compromised weeks before it launches.

Read more

3) Industry & Markets

APAC insurance M&A holds steady as Australia records seven deals in Q1, led by Zurich’s $415M ClearView acquisition (May 25)

Despite broader APAC dealmaking caution, Australia and New Zealand drove regional insurance M&A with seven transactions in Q1 2026, up from one the prior quarter. The headline deal is Zurich’s pending $415.2M acquisition of ClearView Wealth, described by S&P Global as Zurich’s largest whole-of-company transaction in APAC in nearly a decade. A second deal saw International Medical Group acquire World Nomads from Nib Holdings for $48M to expand travel insurance distribution into Australia. Japanese insurers and private equity continue to be flagged as the primary drivers of deal activity through the rest of 2026.

Read more

Australian commercial insurance market remains soft through H1 2026

A May 2026 Insurance Business report confirmed that Australia’s commercial insurance market continues to soften across most lines heading into the second half of the year, with pricing pressure most visible in property and cyber. The softening is partly attributed to increased capacity flowing into the market and a relatively low major loss year to date. For Continuum, the soft Australian market creates both competitive pressure and an opportunity to differentiate on coverage quality and digital asset expertise as regional insurers reprice.

Read more

4) Insurance Spotlight

CyberCube and UIB identify Asia as cyber insurance’s next major growth frontier (May 26)

A joint report from CyberCube and United Insurance Brokers published May 26 positions Asia as one of the fastest-growing cyber insurance markets outside the US, driven by surging ransomware activity, rapid digitisation, and structurally low penetration. In many Asian markets, fewer than 5% of small businesses hold standalone cyber policies despite accelerating digital exposure from 5G, AI, and supply chain integration. Vietnam was identified as one of the fastest-growing ransomware targets in the region. The soft pricing environment in Western markets is actively pushing insurers toward Asia as the next volume growth opportunity.

Read more

Korea falls behind on cyber insurance as attacks nearly double in two years

South Korea recorded 2,383 cyber incidents in 2025, nearly double the level from two years prior, yet its cyber insurance market accounts for just 0.02% of global premiums. Only 2.7% of Korean companies hold a policy, and only 14.5% are even aware that cyber insurance exists. The low take-up is partly a cultural issue: firms prefer to handle incidents internally to contain reputational damage. As the FSC tightens exchange-level controls and AI-powered attacks intensify, Korea represents one of the starkest protection gap opportunities in the region for insurers with the right distribution approach.

Read more

1) Regulatory

Southeast Asia Blockchain Week convenes regulators and stablecoin giants in Bangkok

Thailand’s SEC and senior officials from Indonesia gathered at ICONSIAM alongside Circle, Tether, Bitkub, and SCBX for the region’s flagship Web3 policy event. Thailand’s SEC Director confirmed digital assets as a core regulatory priority for the next three years, with plans to expand on-chain issuance and real-time settlement. Circle’s David Katz addressed USDC’s institutional rollout across APAC. The event puts Southeast Asia firmly on the map as an active rulemaking zone, not just a growth market.

Read more

Thailand SEC closes public consultation on crypto derivatives licensing simplification

Thailand’s SEC shut its public consultation window on May 20 for a proposal that would let licensed digital asset firms apply for crypto derivatives licenses without creating separate corporate structures. The reform builds on February’s Cabinet amendment formally recognising Bitcoin and Ethereum as eligible instruments for regulated futures trading. With the feedback period closed, Thailand is set to finalise one of the region’s most commercially significant licensing changes, directly affecting how institutional players structure derivatives exposure across Southeast Asia.

Read more

2) Hacking & Physical Risks

Verus-Ethereum bridge drained of $11.6M in live cross-chain exploit

Attackers exploited a validation flaw that allowed the bridge to release ETH-side funds without confirming backing on the Verus side. The stolen assets (103.6 tBTC, 1,625 ETH, 147,000 USDC) were swapped to roughly 5,402 ETH and the attacker wallet was pre-seeded via Tornado Cash 14 hours prior. Blockaid detected the attack live but could not prevent the drain. The exploit is one of eight bridge incidents Peckshield tracked through mid-May, which collectively totalled $328.6M, cementing cross-chain bridges as 2026’s primary attack surface.

Read more

Peckshield: eight bridge exploits, $328.6M drained in May alone

Peckshield’s mid-May tally confirmed that cross-chain bridge infrastructure is suffering its worst month on record, with eight major incidents logged before the halfway point. The losses compound an already brutal year: April alone saw over $600M stolen across 30+ DeFi incidents, led by the KelpDAO and Drift Protocol exploits. The pattern of bridge failures, concentrated in single-verifier and cross-chain validation architectures, is the clearest signal yet that smart contract cover underwriting needs bridge-specific risk segmentation.

Read more

3) Industry & Markets

Pro Global enters APAC insurance market with Australian advisory acquisition

Pro Global acquired GSI Professional Services, a specialist audit and advisory firm serving Australian insurers and MGAs, with founder David Mills staying on as head of region. The deal is a platform play for broader APAC expansion, targeting demand for delegated authority oversight as regulatory expectations tighten across the region. It signals that established global insurance services players are now actively building APAC infrastructure rather than servicing the region remotely.

Read more

Ascend and Honor Capital merge to create insurance industry’s first vertically integrated financial operations platform

InsurTech Ascend has agreed to merge with premium finance provider Honor Capital, combining insurance payment infrastructure with capital access in a single platform. The deal is positioned as the first fully integrated financial operations stack for the insurance industry, covering premium financing, payments, and reconciliation. As APAC insurers face rising pressure to digitise financial operations and reduce back-office friction, this kind of vertical integration signals where the market is heading.

Read more

4) Insurance Spotlight

AI is not cyber: insurers pricing the distinction wrong as early litigation mounts

A May 20 Insurance Journal viewpoint made the case gaining traction in underwriting circles: treating AI liability as a subset of cyber risk is a category error, and early litigation is proving it. AI failures are landing in product liability, professional negligence, and algorithmic discrimination frameworks, not data breach language. Berkshire Hathaway, Chubb, and Travelers have secured regulatory approval to exclude AI damages from over 80% of GL policy requests. Standalone AI liability products from Munich Re, Armilla, and Embroker are filling the gap with limits from $2M to $50M. Cyber policies with unaddressed AI wording face contested claims ahead.

Read more

India’s IRDAI mandates AI cyber readiness audit from every insurer by May 22

India’s insurance regulator IRDAI issued an emergency directive this week requiring all insurers, reinsurers, brokers, and TPAs to submit a formal Action Taken Report on frontier-AI cyber readiness by May 22. Firms must detail their preventive, detection, and response mechanisms against AI-enabled threats, covering sensitive data assets and legacy IT systems. With less than a week’s notice given, the directive exposes how underprepared much of the sector remains. IRDAI’s revised Cyber Security Guidelines, issued in April and replacing the 2023 framework, underpin the mandate.

Read more

1) Regulatory

APAC stablecoin adoption has cleared the pilot stage — 56% of institutions now live

A Fireblocks survey of APAC financial institutions found that 56% are already live with stablecoin operations — the highest adoption rate globally — with another 40% in active pilots or planning phases. The shift is directly tied to HKMA and MAS regulatory frameworks coming online: institutions that previously ran proof-of-concept projects are now building production infrastructure for wholesale settlement, payroll, and cross-border B2B flows. 62% of APAC institutions have formally committed budget to digital assets in 2026, with stablecoins as the priority layer.

Read more

Bird & Bird flags MAS cryptoasset capital consultation as a “gamechanger” for Singapore banks

The legal analysis highlights that MAS’s proposed shift from a blanket 1,250% Basel risk weight to a principle-based, conditional framework is the most significant change to Singapore bank crypto treatment since digital assets entered the regulatory agenda. For qualifying tokenised assets and stablecoins, the new approach could unlock meaningful balance sheet capacity — and Bird & Bird notes that the tight exposure caps (2% of Tier 1) are designed to let the market prove itself before limits are raised.

Read more

2) Hacking & Physical Risks

40+ DeFi protocols have shut down in 2026 as total hack losses pass $770M

A May 9 analysis confirmed that more than 40 DeFi protocols have ceased operations or entered wind-down mode since January 2026, as cumulative hack losses passed $770 million. The crisis is concentrated in cross-chain bridges, liquidity providers, and protocols running single-verifier infrastructure — the same structural weakness exposed by the Kelp DAO and Drift exploits. April alone accounted for over $635 million across 30+ incidents, the worst single month on record.

Read more

Roaring Kitty’s verified X account hacked to shill a Solana meme coin

Attackers compromised the long-dormant verified account of GameStop influencer Keith Gill and posted a Pump.fun contract address, triggering an instant rally before the posts were deleted. Over 80 wallets lost nearly $2.9M in the collapse while the developer, operating through 10 wallets, extracted $611K. The incident is the latest in a pattern of high-profile social media account takeovers being weaponised for coordinated pump-and-dump schemes.

Read more

3) Industry & Markets

APAC dealmaking drops 6% in Q1 2026 as M&A caution bites

GlobalData’s Q1 2026 APAC deal analysis, covered by Insurance Business this week, found overall deal activity down 6% year-on-year, with M&A contracting 26% and private equity volumes falling 42%. Japanese deal activity slipped 51%, a notable reversal given the sector’s aggressive outbound appetite in 2025. The only bright spot was venture financing, up 21%, concentrated in AI and digital infrastructure plays. Regulatory scrutiny, geopolitical complexity, and longer due-diligence cycles are the primary cited headwinds.

Read more

APAC set to outspend every other region on digital asset infrastructure in 2026 — 62% of institutions have committed budget, more than double the global average

Fireblocks’ Financial Grid Report found that APAC is the most aggressive region for digital asset infrastructure investment this year, driven by live regulatory frameworks in Hong Kong and Singapore pulling institutions from pilot to production. New customer acquisition and market expansion — not compliance — are the primary drivers, with 36% of APAC institutions already in external client pilots, more than double the global average of 20%.

Read more

4) Insurance Spotlight

Western Union launches USDPT stablecoin on Solana — Philippines is the first APAC rollout market

Western Union announced it has selected Fireblocks to provide wallet, settlement, and financial operations infrastructure for USDPT, its new USD-backed stablecoin built on Solana. The Philippines is the first rollout market, with Bolivia to follow — putting stablecoin-powered remittances directly into one of APAC’s largest inbound corridors. The move targets Western Union’s $100B+ annual remittance network and signals that traditional money-transfer players are now building digital-asset infrastructure rather than watching from the sidelines.

Read more

SQ Protocol exploited on BNB Chain via hardcoded owner backdoor

The exploit was small in dollar terms ($346K) but significant in method: a publicly accessible ownership function in the verified staking contract allowed the attacker to assume full control, create fraudulent staking claims, and drain liquidity in a single transaction sequence. Security researchers flagged it as a textbook example of how unaudited admin access patterns in “verified” contracts create silent, catastrophic risk — a concern directly relevant to insurers writing smart contract covers on BNB Chain protocols.

Read more