Why Wall Street Remains Skeptical of 'Trustless' Security Claims

The primary platforms for storing and transferring digital currency are now crypto exchanges, with the crypto market experiencing a 24-hour trading volume of approximately $190-$192 billion, according to industry data. As these exchanges grow into multi-asset platforms, their security mechanisms must evolve to include identity, permissions, pricing, and settlement, in addition to wallets. Despite increased regulatory pressure, security remains a significant issue. In 2025, the cryptocurrency industry lost over $3 billion to theft, with several incidents resulting in losses of over $1 billion each. Notably, these significant hacks occurred at well-funded, major global exchanges, indicating that a lack of resources was not the problem - rather, security was being treated as a marketing tool. Much of the industry still views security as a performance rather than a discipline, with exchanges investing in convincing surface-level measures such as dashboards, reserve snapshots, protection funds, and public statements. However, this approach does not provide insight into the daily management of risk. Unless security is designed to be enforced rather than simply showcased, even the largest platforms will remain vulnerable. When stress arises, this fragility can quickly affect users. The concept of 'security theater' refers to the practice of prioritizing the appearance of safety over actual safety. This mindset takes hold when a company is growing rapidly and must maintain a smooth user experience, often leading to security controls being viewed as a hindrance. However, this false sense of security does not withstand stress, as seen in the $235 million hot wallet breach at India's WazirX in July 2024. Genuine exchange security is a system that can withstand stress and has three core traits: proof-of-reserves, strict internal rules, and quick incident response. Proof-of-reserves is a starting point, providing evidence of certain assets' existence, but it is essential to have transparency that clearly shows assets and liabilities, with independent verification. Internal rules should prevent any single person from moving customer funds, trigger reviews for unusual activity, and require approval from at least two people for large transfers. Quick incident response is also critical, with a serious exchange knowing exactly how to respond within the first hour, isolating the breach, pausing critical flows, and communicating clearly. These measures form the foundation of true exchange durability, preventing routine incidents from becoming systemic failures. By 2026, simply saying 'trust us' will no longer be sufficient for exchanges to keep their customers and attract institutional capital. Instead, they must provide evidence of controls, separation of duties, independent assurance, and a response plan that works under pressure.