Mankun Law Firm Attends Wanxiang Blockchain Summit | Discussing the Future of Web3 Payment Security and Compliance

We look forward to our next gathering!

As Web3 accelerates its development, payment security and legal compliance have become key determinants of whether the industry can move into the mainstream. During the panel discussion at the Wanxiang Blockchain Conference, CertiK CTO Li Kang, SlowMist Vice President Sun Xi,Liu Honglin, Founder of Mankun Law Firm,and moderator Bi Tongtong, Co-founder of PANONY & PANews, engaged in an in-depth discussion on“How to Build a Secure Future for Web3 Payments”covering multiple dimensions, including security risks, regulatory uncertainty, the balance between decentralization and compliance, and best practices for startup and personal security.

 

Dual Challenges: Underlying Security Risks and Upper-Layer Compliance Uncertainties

What is the greatest dilemma facing Web3 payments? The experts agreed that security and compliance are two major hurdles that must be overcome.

Sun Xi, Vice President of SlowMist, summarized the current situation as “security issues at the foundational layer and compliance issues at the upper layer.” From a security perspective, the primary risks include:

• First, improper management of users’ private keys.In the Web3 world, “users are their own banks,” but most individuals lack sufficient security awareness, leading to frequent leaks of mnemonic phrases or private keys, recurrent theft of wallet assets, and extremely low success rates in asset recovery.

• Second, the frequent occurrence of smart contract vulnerabilities.Emerging payment scenarios, such as cross-chain bridges and decentralized finance (DeFi) protocols, have become key targets for attackers. Once vulnerabilities are exploited, they often result in substantial losses.

• Third, the risks arising from the anonymity of on-chain funds.Although blockchain ledgers are open and transparent, the anonymity of addresses facilitates the flow of illicit funds.

At the compliance level, regulatory uncertainty also places significant pressure on the industry. Attitudes toward crypto payments vary significantly across different countries and regions—some actively embrace innovation, others impose strict prohibitions, and still others maintain a wait-and-see approach. This“compliant today, crossing red lines tomorrow”dynamic environment makes it difficult for project operators to define their operational boundaries.

CertiK CTO Li Kang concurs with this view and further elucidates the roots of regulatory uncertainty from a technical perspective. He points out that this uncertainty stems not only from policy changes but also from the inherent complexity of blockchain technology. The difficulty in tracing on-chain fund flows often leads to misinterpretation of regulatory actions, triggering market panic. Meanwhile, the cross-border nature of blockchain means that policy changes in one jurisdiction can have ripple effects on payment companies operating globally.

 

Entry of “Established Players”: Industry Evolution and New Risks

Despite numerous challenges, the immense potential of Web3 payments is attracting an increasing number of “established players.” Liu Honglin, founder of Mankun Law Firm, observes that the industry is undergoing a significant transformation.

He notes that early crypto payment projects—especially those providing services directly to consumer-end users—were often “very sloppy” in terms of operational qualifications and compliance. However, as jurisdictions such as Hong Kong progressively clarify their stablecoin regulatory frameworks, more leading domestic cross-border payment companies are entering the market. These new entrants adopt compliance-driven strategies from the outset of their projects, demonstrating professionalism far exceeding that of early-stage startup teams, whether in applying for licenses, deploying on-chain anti-money laundering (AML) tools, or building security systems.

However, new risk points are also emerging. The freezing of on-chain assets is becoming an increasingly serious issue. For example, issuers of mainstream stablecoins may freeze assets at specific addresses in accordance with regulatory requirements, and regulatory authorities may also request the freezing of on-chain funds through official letters. This poses a potential threat to institutions holding large volumes of assets. Liu Honglin believes that the resonance between pain points and demands will inevitably create new opportunities, and the Web3 payments sector will see significant commercial potential and value within the next one to three years.

 

Decentralization and Compliance: Not an “Either-Or” Choice

When stablecoins incorporate compliance features such as allowlists and blocklists, does this deviate from the "crypto ethos"? Addressing this long-standing debate, experts generally agree that decentralization and compliance are not mutually exclusive; rather, they can be made compatible through technological means.

Sun Xi points out that compliance is a matter of rules, whereas decentralization is a matter of structure. Future Web3 systems should provide compliance support through technology without undermining user autonomy. For example, regulatory requirements can be embedded directly into the code layer at the project’s inception to create "compliance code," thereby reducing the need for later manual intervention while preserving the spirit of decentralization. He believes that if this model matures, the focus of future discussions will shift from "whether compliance is needed" to "how to achieve intelligent compliance."

Li Kang similarly believes that no decentralized system, including decentralized exchanges (DEXs), can completely evade regulatory requirements. Although blacklisting mechanisms for stablecoins may result in the freezing of funds, their primary intent is to prevent illicit activities such as money laundering. The ultimate goal of regulation is user protection and market integrity; therefore, the key lies in designing reasonable mechanisms that prevent abuse. The industry should maintain open dialogue with regulators to find a balance.

Attorney Liu Honglinfurther emphasizes:"Decentralization is not an end in itself, but a means to achieve an end."In real-world scenarios, when users encounter cryptocurrency theft or disputes, their first reaction is still to"report to the police"He points out thatregulation does not equate to centralization and can also be undertaken by international third-party organizations.To promote the adoption and compliance of the blockchain industry, it is necessary to lower barriers to user experience, for example, by introducing allowlist and blocklist mechanisms, risk warning systems, and emergency response mechanisms for asset risks, enabling users to quickly contact regulators or service providers when issues arise. These measures will help the industry develop more securely.

 

Practical Recommendations for Practitioners and Users

Regarding how startup teams should position themselves in the payments sector, the three panelists unanimously agreed thatsecurity and compliance must proceed in parallel and be embedded at the initial stage of system design.

Sun Xi recommended that wallet systems should support multi-signature or MPC mechanisms; deploy real-time on-chain monitoring and early-warning systems; establish emergency response mechanisms to ensure rapid intervention and handling in the event of attacks or anomalous transactions;

In terms of compliance, as global regulatory policies tighten, KYC and KYT have become basic requirements for project operators, rather than optional features. Meanwhile, integrating on-chain transaction monitoring systems, such as StraitsX, can ensure the legality of transaction sources and avoid receiving illicit funds. Sun Xi emphasized that the purpose of these measures is not only to meet compliance requirements, but also to protect users and safeguard customer assets.

Li Kang’s advice was more direct:“Make more friends in the fields of security and law.”

Attorney Liu Honglin further pointed out that although blockchain is borderless, compliance still depends on the regulatory requirements of the user’s jurisdiction.Therefore, from a business perspective, compliance issues require attention to security in areas such as technology and mechanisms, while also taking into account relevant government regulation.He pointed out that when serving clients, it is necessary to assess the licenses required for conducting business based on the needs of the target market, and adjust strategies according to cost-effectiveness.If certain licenses are not cost-effective at the current stage, it may be necessary to re-plan. Compliance work should be advanced according to priorities and return on investment, and aligned with market strategy and development stage.

 

Advice for ordinary users:

Awareness is the best defense:CertiK CTO Li Kang pointed out that individual users must clarify their objectives when engaging in on-chain activities. If the sole purpose is investment, users may opt for channels such as cryptocurrency exchanges or exchange-traded funds (ETFs) without needing to hold assets directly. For users seeking deeper engagement, it is advisable to consult open-source security resources, such as the "Dark Forest Survival Manual," to understand potential risks. Furthermore, users are encouraged to build a network of security contacts and engage regularly with security experts or law firms to enhance their on-chain security awareness and capabilities.

Safeguard Private Keys, Secure Assets: Sun Xi, Vice President of SlowMist, advises newcomers to the industry to gain familiarity with the trading environment by purchasing small amounts of crypto assets. He specifically reminds users to: first, properly safeguard private keys, as possession of the private key equates to control over the assets; second, remain vigilant against fake wallet or exchange download links promoted by certain domestic search engines to avoid phishing and Trojan horse attacks; and third, avoid herd-driven speculation, approach investments rationally, and protect their assets.

Ensure the Security of Fiat Currency Accounts: Liu Honglin, Founder of Mankun Law Firm, reminds users to prioritize fund security. When converting crypto assets into fiat currency through methods such as customer-to-customer (C2C) transactions, there is a risk that personal bank accounts may be frozen, necessitating cautious operation. He suggests that newcomers may consider joining Web3 enterprises, particularly in the fields of legal compliance or business services, to enter the industry with lower risk and accumulate experience.

Regarding traditional payment enterprises still hesitating on whether to enter the market, experts have expressed clear views. Li Kang believes that payments based on virtual currencies and tokenized assets have become a market reality, stating that "the question is not whether to participate, but when to participate."

Attorney Liu Honglin added that crypto payments represent an irreversible future trend. Once enterprises determine their strategic direction, they should act decisively without excessive hesitation. Do not be deterred by short-term volatility once the direction is clear. What truly matters is sustained investment and a long-term perspective. While uncertainties currently exist, the certainty of technological transformation is greater. Those who establish robust security, compliance, and trust systems at this stage will secure the initiative in the next market cycle.

Sun Xi proposed three key criteria for assessment: whether the business scenario supports experimentation with Web3 integration, whether user assets are protected in compliance with applicable regulations, and whether risk management and regulatory issues can be addressed promptly. Only by preparing adequately in these three areas can enterprises successfully enter and establish themselves within the new generation of payment systems.

By Yuliya | Source: PANews