Welcome back to Continuum Risk Update
Every Friday we pull the top Asia headlines on digital-asset regulation, cyber risk, industry moves and insurance signals, with concise takeaways and practical actions for insurers and corporate risk teams.
1) Regulatory
South Korea’s FSC Advances the Digital Asset Basic Act
South Korea’s FSC held its first Virtual Asset Committee meeting of 2026 on March 4, formally advancing the Digital Asset Basic Act — Phase 2 of Korea’s comprehensive crypto legislation. The meeting locked in an ownership cap of 20% for major shareholders of crypto exchanges, with the FSC retaining authority to approve exceptions up to 34%. Upbit and Bithumb, which together control roughly 90% of Korea’s domestic trading volume, face a three-year grace period once the law is enacted.
2) Hacking & Physical Risks
“Silver Dragon” — APT41-Linked Group Targets Southeast Asian Governments
Check Point Research disclosed a new China-aligned cyber espionage group, Silver Dragon, assessed with high confidence to be operating under the APT41 umbrella. Active since at least mid-2024, the group targets government ministries and public sector organisations across Southeast Asia, with additional victims in Europe. Silver Dragon uses a custom backdoor — GearDoor — that routes command-and-control communications through Google Drive, disguising malicious traffic as normal cloud activity.
3) Industry & Markets
Korea’s 20% Ownership Cap Sets Up Major Exchange Restructuring
South Korea’s ruling party and FSC finalised a framework to cap individual and corporate ownership of major crypto exchanges at 20%, with FSC-approved exceptions up to 34%. Upbit’s controlling shareholder holds roughly 25–28%, placing him immediately above the new ceiling. The industry body DAXA called the measure one that shakes the foundation of the sector, and M&A deals previously near closing are now back under review.
4) Insurance Spotlight
HK SFC Cold Storage and Insurance Mandate — Active Enforcement 2026
Hong Kong’s SFC mandates that all licensed virtual asset trading platforms store 98% of client assets in offline cold wallets, and maintain adequate insurance for any client assets held in hot wallets. Singapore’s MAS requires 90% cold storage but stops short of mandating insurance, leaving a voluntary coverage gap for the residual hot-wallet exposure that many firms leave uninsured.
