Welcome to our institutional newsletter, Crypto Long & Short. This week:

• Bob Williams on how stricter crypto regulations in Asia are putting more personal responsibility on senior leaders, making strong governance and D&O insurance essential.
• The FBI’s Haidy Grigsby on how crypto scams are increasingly targeting experienced investors by building trust and tricking them into making larger deposits until their money is gone.
• Top headlines institutions should pay attention to by Francisco Rodrigues.
• Hyperliquid's TradFi bet is now 40% of its own volume in Chart of the Week.

-Alexandra Levis

Expert Insights

Asia’s digital asset crackdown: accountability gets personal

By Bob Williams, FinTech, digital assets, & blockchain advisory leader (Asia/Pacific), Lockton Companies

A new wave of digital asset regulations across Asia is increasing pressure on trading platforms and asset managers to strengthen governance — and to reassess their Directors’ and Officers’ (D&O) liability insurance arrangements.

In recent months, three leading digital asset hubs — Hong Kong, Singapore and South Korea — have announced plans to refine their respective regulatory frameworks. As regulatory expectations rise and senior management’s personal accountability becomes clearer, platform operators must stay informed of these developments and evaluate whether their existing risk transfer strategies remain fit for purpose.

Hong Kong: expanding accountability beyond governance

In August 2025, Hong Kong’s Securities and Futures Commission (SFC) issued a circular to licensed virtual asset trading platform operators clarifying senior management's responsibilities regarding the custody of clients' virtual assets. The circular reinforces expectations around governance, internal controls and effective oversight, signaling a continual shift toward personal accountability for directors and senior management.

An emerging consideration from the SFC’s consultation process is whether virtual asset management service providers should be permitted to rely on non‑SFC‑regulated or offshore custodians. From an insurance perspective, the availability of coverage for virtual asset risks is closely tied to the robustness of custody arrangements, including security controls, operational resilience and asset protection standards. To date, insurance capacity has largely been supported by the prescriptive requirements imposed on SFC‑regulated custodians and platforms.

If alternative custody models are permitted, ensuring that non‑regulated or offshore custodians are held to equivalent standards, including appropriate insurance coverage will be critical. Without alignment, firms that have invested heavily to meet Hong Kong’s regulatory and insurance expectations may face a competitive disadvantage, while the objective of enhancing investor protection and market integrity could be undermined.

Singapore: reinforcing senior management competency

In 2025, Singapore introduced licensing requirements for digital token service providers serving only overseas customers, bringing a broader range of firms within the Monetary Authority of Singapore’s regulatory perimeter.

Under the licensing guidelines, the competency and fitness of key individuals are core admission criteria. Senior management is expected to demonstrate a clear understanding of the regulatory framework and to exercise effective oversight and control over business activities and staff.

As regulatory expectations rise, so too does the personal exposure of directors and officers. In this context, D&O insurance remains a critical component of a firm’s overall risk management framework, helping to protect personal assets in the event of claims or regulatory actions arising from alleged governance or oversight failures.

South Korea: gearing up for Digital Asset Basic Act

South Korea is pursuing a more expansive regulatory overhaul through the proposed Digital Asset Basic Act, introduced to the National Assembly in June 2025. The bill seeks to formalize the digital asset market by regulating issuance, trading practices and distributions, while introducing new governance structures around asset listing and delisting decisions.

These imminent changes would significantly increase compliance obligations for trading platforms and related service providers. In this environment, D&O insurance plays an important role in protecting directors and officers from the financial consequences of legal actions, investigations or claims arising from alleged regulatory breaches.

Navigating regulatory complexity with D&O insurance

Across Hong Kong, Singapore and South Korea, regulators are refining already sophisticated frameworks to address the evolving risks of digital assets. These developments reflect a broader global trend toward intensified regulatory scrutiny and heightened expectations of senior management accountability.

For firms operating in the region, this means proactively reviewing governance structures, custody arrangements and insurance programs to ensure leadership is appropriately protected against emerging liabilities. D&O insurance is no longer a secondary consideration — it is a core element of responsible risk management in an increasingly regulated digital asset landscape.

Informed Perspectives

Crypto scams are not just targeting the uninformed

By Haidy Grigsby, special agent, cybercrime and digital evidence unit, Tennessee Bureau of Investigation

A common assumption is that crypto scams prey on the uninformed. While this is often true in financial fraud, crypto-related frauds are increasingly catching experienced investors, retired professionals and former market participants off guard with increasing frequency.

In my work at the FBI, I recently met with a retired trader who fit that profile exactly. He met a young woman online who claimed to know someone involved in crypto trading. He was told he had been selected as a consultant because of his experience. His case illustrates a strategy that we now see often.

Initial contact often begins with a wrong-number text, LinkedIn message or social media outreach. What starts as professional often turns personal or romantic, a tactic known as “pig butchering.” Scammers flatter expertise, create exclusivity and get the target to move the conversation to encrypted apps. In this case, "she" said WhatsApp was easier for her.

Exploiting familiarity with legitimate infrastructure, victims are instructed to open accounts on real exchanges, then use self-custody wallets to access external sites through built-in Web3 browsers. Because they click within a trusted app, they often don’t realize that they have left it.

These fraudulent markets mimic real ones with a twist: unlike real markets, these platforms allow one daily trade at a set time, ostensibly to capture optimal volatility. Victims choose long or short, allocate funds and confirm a brief trade lasting seconds or minutes. The scammer will often claim to contribute their own funds, reinforcing trust and the illusion of shared risk.

Balances grow and profits appear real. In truth, no trading occurs — the website is controlled by the operation, and the returns aresimply numbers entered by the scammer on their end.

To build credibility, victims are encouraged to withdraw a small amount after a “winning” trade. The withdrawal appears processed successfully, but is funded with cryptocurrency stolen from other victims and is meant to encourage larger future deposits. “I took profits. It had to be real,” the retired trader told me in frustration.

The websites change domains and branding frequently, with victims being told the company is merging, upgrading or rebranding. In reality these changes occur because of law enforcement takedowns, and victims are simply redirected to “new trading platforms.”

When victims attempt larger withdrawals, the narrative shifts: regulatory holds, tax prepayments, liquidity verification thresholds or tier upgrades. Each explanation is paired with urgent demands for more funds.

Convincing victims of the truth remains one of the greatest challenges. When I spoke with the retired trader, it was difficult to convince him I was law enforcement and that he had been dealing with a criminal organization, not one individual. No one wants to believe the person they built trust with and gave substantial sums of money to never existed. This retired trader was left to face his family, admit he had been defrauded and ask for help with basic living expenses. By the time he accepted reality, his retirement savings were already gone: assets had been transferred overseas, laundered and liquidated.

Source: FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report, p. 53, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

The FBI’s 2024 data show losses rising with age, likely reflecting the fact that older individuals have more accumulated wealth than those in their 20s.

Victims gather evidence: phone numbers, accounts, photos and websites — most of it turns out to be stolen, fake or AI-generated. Despite the difficulties in apprehending the perpetrators of these sophisticated schemes, law enforcement continues to pursue these cases. Anyone affected should cease all communication and report the incident to local law enforcement, IC3.gov and Chainabuse.com.

Headlines of the Week

- By Francisco Rodrigues

This week’s headlines show institutional adoption has kept on growing in the cryptocurrency space, yet old dangers remain. Protocol exploits, state-sponsored attacks, and technology disruption remain active threats.

• U.S. rule change may open trillions in 401(k) funds to crypto: Following an executive order from President Donald Trump, the U.S. Department of Labor has proposed a rule that would make it easier for 401(k) plans to include alternative assets, including crypto.
• Drift says $270 million exploit was a six-month North Korean intelligence operation: Solana protocol Drift was exploited for $270 million on April 1, after being infiltrated by a North Korean state-linked group in an operation that took roughly six months.
• Bitcoin's $1.3 trillion security race: Key initiatives aimed at quantum-proofing the world's largest blockchain: Google researchers found a sufficiently powerful quantum computer could break Bitcoin’s core cryptography in less than nine minutes, yet Bitcoin developers are working on multiple defenses.
• Coinbase wins initial bank regulator nod for trust charter, boosting custody push: The nod requires Coinbase to build out compliance systems, hire key staff, pass reviews and demonstrate strong risk management controls before it can secure a full charter.
• Franklin Templeton launches crypto division with 250 Digital acquisition: The asset management giant’s planned launch of Franklin Crypto is anchored on its planned acquisition of crypto investment firm 250 Digital.

Chart of the Week

Hyperliquid's TradFi bet is now 40% of its own volume

Hyperliquid's HIP-3 has scaled from ~$115 million in its first week (Oct 2025) to a peak of $17.8 billion/week, now consistently representing 35–40% of total protocol volume. Despite launching as a crypto-adjacent product, HIP-3 is overwhelmingly a TradFi venue, with Commodities alone driving ~60% of volume and pure crypto categories accounting for just ~12%. The aggregate (core + HIP 3) volume continues to decline since the early March 2026 peak with the HYPE price now following the same trend.

Listen. Read. Watch. Engage.

• Listen: Jennifer Sanasie is joined by Bloomberg Intelligence Senior Analyst James Seyffart to break down what Morgan Stanley’s bitcoin ETF could mean for institutional flows, fee competition, and the next phase of crypto adoption.
• Read: In Crypto for Advisors, Paul Frost-Smith, CEO of Komainu, covers how institutional crypto is converging with traditional finance, but speed can introduce risk if legal and compliance layers aren't aligned. Then, in “Ask an Expert,” Sam Boboev from the “Fintech Wrap Up,” details the key coordination risks institutions must solve for.
• Watch: Jennifer Sanasie hosts Public Keys from the NYSE. Christopher Perkins discusses the recent acquisition by Franklin Templeton and the new “Franklin Crypto,” Superstate CEO Robert Leshner and Invesco’s Kathleen Wrynn break down their partnership, and NYSE Senior Market Strategist Michael Reinking, CFA unpacks the macro environment.
• Engage: Have you bought tickets to Consensus Miami yet? More speakers have been added to the agenda! Surrounding Consensus is an institutional summit, an advisor-focused “Wealth Management Day,” 100+ ancillary events and much, much more.

Looking for more? Receive the latest crypto news from coindesk.com and market updates from coindesk.com/institutions.

Note: The views expressed in this column are those of the author and do not necessarily reflect those of CoinDesk, Inc., CoinDesk Indices or its owners and affiliates.