SFC and HKMA Co-host Seminar on Tokenized Commercial Applications / Trezor Investigation Confirms Three Devices Were Tampered With / Thailand SEC Proposes Daily Deposit and Withdrawal Limits for Stablecoins

Hong Kong's Securities and Futures Commission and the Hong Kong Monetary Authority co-hosted an industry seminar on 11 November, drawing more than 200 financial-sector participants to discuss how the city's tokenization ecosystem can move from pilot stage to commercial application. Ahead of the seminar, a licensed platform recently launched 24/7 secondary-market trading of a publicly offered tokenized fund for the first time, while the EnsembleTX project advanced 24/7 settlement of interbank tokenized deposits. Discussions focused on secondary-market liquidity, corporate treasury management and infrastructure improvements; regulators said they would connect tokenized products, digital money and financial infrastructure through a shared channel to speed commercial adoption.

Hardware wallet maker Trezor published a notice updating its investigation into hardware implants in devices sold by reseller CryptoBilis. Trezor said it has so far examined devices from 48 users who came forward and confirmed that three Trezor Safe 5 units were fitted with an additional circuit board; those units were sold between 20 August and 23 September 2026 through CryptoBilis and its Tokopedia and Shopee storefronts. The malicious hardware sits between the mainboard and the screen, can capture the recovery seed and passphrase shown on the display, and relays them to an attacker-controlled server over a mobile network. Trezor said it has not received any reports of user funds being stolen. To address the supply-chain risk, Trezor has cut its reseller network by roughly 80% and imposed stricter procurement and warehousing controls on the resellers it retains. It also released firmware version 2.13.1 on 11 November to block data exfiltration by implants in the affected batch, and said users who bought devices from CryptoBilis from March 2026 onward may request a free replacement unit or a refund.

Thailand's Securities and Exchange Commission (SEC) has published a draft rule that would cap stablecoin deposits and withdrawals at 5 million baht (about USD 148,000) per customer per day, applied separately to deposits and withdrawals and calculated on a per-operator basis. The regulator said the measure is intended to curb money laundering, cybercrime and circumvention of cross-border money transfer rules. The draft also bans transfers of stablecoins into or out of third-party wallets and requires operators to verify that customers own the account or wallet used for deposits and withdrawals, and to comply with the Travel Rule by collecting and sharing transfer information and using blockchain analytics to identify wallet addresses linked to suspicious activity. Crypto exchanges would have to disclose their market maker list and specify which assets those market makers provide liquidity for; crypto brokers would be barred from using liquidity providers for stablecoin-baht pairs; and certain over-the-counter trades would be subject to a 3 million baht minimum threshold. The draft continues a consultation the Thai SEC opened in September, when it already proposed stablecoin transfe

Unocoin, an Indian crypto exchange, said in a security incident update on November 12 that it had identified outgoing transactions from an ETH address in its BitGo wallet used to fund ERC-20 tokens, and that BitGo has opened an investigation. Because the enterprise accounts remain frozen, Unocoin said it cannot yet fully establish the scope of all anomalous transactions. Unocoin said more than 90% of user crypto funds are held in cold wallets and that it is rebuilding its entire server infrastructure from scratch, expected to take about four to five working days. Unocoin first detected unauthorized activity on November 6 and applied to freeze its Fireblocks and BitGo enterprise accounts at 19:24 and 19:29 that day; after detecting further unauthorized activity on November 9, it suspended all services. The investigation confirmed that its infrastructure had been compromised, while the root cause, scope of impact and any data possibly exposed remain under investigation.

The European Commission has published a draft Digital Fairness Act that would tighten regulation of in-game loot boxes, virtual currencies and payment mechanisms involving minors. The draft remains at the proposal stage, its provisions are not yet in force, and the text may still be discussed and amended. If the draft becomes law, it would bind all companies doing business in the EU, not only those registered in an EU member state; national governments could then impose fines under the rules, and consumers who consider their rights harmed could seek compensation. The draft also addresses omissions, distortions and "dark patterns" in advertising and public relations communications, and would ban personalised advertising and pricing aimed at children. The gaming provisions would require companies selling virtual currencies to state their real-money value and the actual price of items bought with those currencies; paid virtual-currency features for minors would in principle be switched off by default and could be enabled only with parental or guardian consent.

Hong Kong police have dismantled a cross-border criminal group that laundered money through cryptocurrency over-the-counter (OTC) channels, arresting 22 people — 21 men and one woman aged between 21 and 54. Investigators found the group had been active since August this year, recruiting mainland residents to come to Hong Kong to open stooge bank accounts and withdraw criminal proceeds in cash, then moving the funds to cryptocurrency OTC shops run by the group and laundering them through cryptocurrency trading. Police said the group laundered about HK$150 million over roughly three months.