AI Weekly Malaysia

MyDigital ID's Android app now supports the next-gen MyKad, letting new cardholders complete identity registration online after updating via the Google Play Store; iOS and Huawei users still have no timeline and must use a physical kiosk if urgent. The new MyKad launched on 16 September with 53 security elements including contact and contactless NFC and an enforcement QR code, but its redesign (chip left, no photo on the right) broke eKYC matching — the new card was rejected when signing up for TNG eWallet, Ryt Bank, AEON Bank and GXBank because the MyDigital ID app still rendered the old card template.

Why: If you run or integrate Malaysian onboarding, the new MyKad has been failing eKYC since mid-September at four named institutions (TNG eWallet, Ryt Bank, AEON Bank, GXBank) purely because of a card template mismatch — that is a fixable image/template assumption in your pipeline, not a chip or NFC problem. Anyone shipping a mobile app that touches identity should note this rollout is Android-first with no iOS or Huawei date given, so you cannot assume all users can self-register; plan a kiosk or JPN pre-registration fallback and ask your eKYC vendor whether their template library already covers the 16 September card.

TNG Digital and Webull Securities Malaysia have launched a Webull Mini Programme inside TNG eWallet's GOfinance hub, letting users open a Webull trading account digitally and fund it from their eWallet balance without a separate app. The mini programme covers US and HK securities plus CN A-shares with basic charting and educational content, but excludes Bursa Malaysia equities (REITs, structured warrants, ETFs), local index futures (FKLI/FKLM), FCPO, and international futures/FX access that the standalone Webull app offers, which also carries 58+ indicators, Level 2 data and a desktop terminal. Launch promo: open an account via TNG eWallet, deposit at least RM200 and hold it 30 days to get RM30 in Apple fractional shares; Webull has held a Capital Markets Services Licence from the Securities Commission Malaysia since launching locally in May 2024.

Why: This is a concrete case study in embedded-finance distribution: a licensed broker is buying reach inside a super-app by shipping a deliberately reduced product (no Bursa equities, no futures, basic mobile UI only), so if you are building a Malaysian fintech or investing product, the question is whether super-app distribution is worth the feature cut — and users who want local market or derivatives access still have to install the standalone Webull app anyway. The RM200-deposit / 30-day-hold / RM30-Apple-shares promo also gives a rough number for what a super-app-channel acquisition costs.

MBSB Bank expanded its cross-border transfer feature, Global Easy Transfer (GET), inside the MJourney app and web portal from 12 to 20 foreign currencies, built on Wise Platform, with a per-day transfer limit of RM150,000 and real-time tracking plus upfront cost disclosure showing the exact recipient amount. New corridors added include Vietnam, Canada and the UAE, alongside continued heavy demand on AUD and GBP. MBSB reports GET transaction volume up 250% in 2026 versus 2025, daily active unique users more than doubled, and a repeat transaction rate above 90%, with family support and monthly living expenses the largest transaction category.

Why: This is a bank white-labelling Wise's cross-border rails into a consumer app at a RM150,000/day cap — high enough to cover most Malaysian SMB supplier payments, not just tuition and family remittances. If you currently route payouts or overseas billing through a standalone remittance provider, GET is now a directly comparable option for the 20 listed corridors, and the disclosed 'exact amount recipient receives' means you can benchmark your current provider's all-in cost on the same terms. Note the article gives no fee percentages or FX spreads, so the cost comparison has to be done yourself inside the app before deciding.

At its HOOD Summit in Houston, Robinhood announced it is expanding trading hours, adding crypto perpetuals, and adding AI-powered automated trading tools aimed at more active traders. CNBC frames the move as retail brokerage competition shifting from low commissions toward access, speed, and automation, naming Coinbase and Schwab (which added 24/7 trading in select crypto futures on thinkorswim this year) as the comparison points. The excerpt is truncated and contains no pricing, launch dates, API details, or explanation of how the AI agents actually execute trades.

Why: Concrete takeaway is limited: the text gives no launch date, fee, or technical detail, so there is nothing to build against or migrate to yet. The one decision-relevant signal is that a mainstream US retail broker is publicly pairing 'AI agents' with order execution — if you are building agentic tooling with money-moving actions, watch how permissioning, logging, and liability get defined in a regulated context before copying the pattern into your own product.

Apple Pay launched in India on Tuesday, September 29, 2026, with Axis Bank as its first and only banking partner, supporting eligible Axis Bank Visa and Mastercard cards — but not the homegrown RuPay network — and only at merchants and terminals enabled for the service. Apple is asking roughly 20 basis points per transaction, which sources describe as a significant bite out of the 40–50 basis points of margin in the payments layer; HDFC Bank, ICICI Bank and SBI Card are not supporting Apple Pay at launch while commercial terms are still being negotiated. Unlike India's UPI system, Apple Pay is card-based, so each issuer and infrastructure provider has to integrate separately, which the report says makes a broad rollout harder.

Why: For anyone building payments or checkout in Malaysia, the number that matters here is Apple's ~20 bps ask against a 40–50 bps payments-layer margin — roughly half the spread — which is the same commercial question local acquirers and issuers would face if Apple Pay arrives in a market where DuitNow QR already handles instant bank-to-bank transfers at near-zero cost to the merchant. If you're choosing which rails to support in a Malaysian product roadmap, treat card-wallet support as a margin decision, not a checkbox, and note that India's launch excludes RuPay and three of its largest issuers — a domestic-network exclusion pattern worth watching locally.

Bitget is reported to have lost $387 million in a crypto hack, with investigators naming North Korea as the primary suspect based on IP addresses tied to VPN infrastructure previously used by North Korean hacker groups. The stolen funds were stablecoins that the thieves swapped into ETH within minutes, apparently to outrun issuer freeze mechanisms. Note: the supplied article body is only Tom's Hardware site navigation and paywall boilerplate, so no attack vector, timeline, or exchange confirmation is actually in the text.

Why: The one operational detail here is the minutes-long stablecoin-to-ETH swap, which implies issuer freeze and blacklist responses did not land fast enough to matter. If your product or treasury plan treats stablecoin freezing as a recovery mechanism for fraudulent or stolen transfers, that assumption needs re-checking against a minutes-scale window rather than an hours-scale one. Beyond that, this excerpt carries no Malaysian, Southeast Asian, or AI/tooling angle, so there is little for local builders to act on.

Bitget says an attacker stole about $388 million from its hot and warm wallets by exploiting a zero-day vulnerability in an unnamed third-party security product it used, which gave access to high-level internal credentials. On September 24 the attacker sent fraudulent withdrawal commands into wallet backend services, starting with two small test transfers at 18:31 UTC that stayed under Bitget's risk-control threshold, then larger transfers roughly 30 minutes later that the wallet system executed while bypassing risk controls. Bitget says cold wallets and private keys were unaffected, has isolated systems, revoked and reissued credentials, and disabled the affected functionality, but has not said whether the vendor has shipped a fix; CEO Gracy Chen described the incident in a livestream and interviews.

Why: This is a crypto-exchange incident with no stated Malaysia angle and nothing here that changes what most Malaysian developers, database learners, or SaaS founders build this week. The one transferable detail is the detection design: two test transfers below Bitget's risk-control threshold raised no alert, and the real drain followed ~30 minutes later — if you operate any withdrawal or approval flow, that is a concrete argument for alerting on threshold-adjacent sequences and not just on absolute size. Beyond that, the article does not name the third-party product, the vendor, or a fix, so you cannot act on the supply-chain angle from this text alone.