Wall Street Demands More Than Just Promises of Security

The primary platforms for storing and transferring digital money, crypto exchanges, have seen their 24-hour trading volume reach approximately $190-$192 billion. As these exchanges expand to accommodate multiple assets, their security mechanisms must evolve beyond mere wallets to include identity, permissions, pricing, and settlement. However, despite increased regulatory pressure, the security of these exchanges remains inadequate. In 2025, the crypto industry witnessed the theft of over $3 billion in assets, with several incidents resulting in losses exceeding $1 billion each. Notably, these significant hacks occurred at major global exchanges with substantial capital and technological resources, indicating that a lack of resources was not the primary issue. Instead, the problem lies in the fact that security is often treated as a marketing tool rather than a fundamental discipline. Exchanges invest in appearances, such as dashboards and public statements, rather than genuine, day-to-day risk management. This approach, which I refer to as 'security theater,' focuses on creating the illusion of safety rather than actually being safe. It prioritizes optics over substance, with the real governance remaining weak. When a business is growing rapidly, security controls can be seen as a hindrance, slowing down decisions and raising uncomfortable questions. As a result, many platforms opt for confidence over discipline. However, this false sense of security does not withstand stress. The $235 million hot wallet breach at India's WazirX in July 2024 serves as a reminder of how quickly confidence can turn into users losing access to their funds. Genuine security is about the daily rules that govern how money moves, who has access, and how issues are handled when something goes wrong. To earn real trust, exchanges must demonstrate a system that can endure stress, which can be tested. From my experience, such a system has three core traits: proof-of-reserves, strict internal rules, and quick incident response. Proof-of-reserves is a starting point, providing evidence that certain assets exist. However, it is crucial that this proof is verifiable, for example, through cryptographic methods, and that it is accompanied by transparency regarding assets and liabilities, with independent checks. Internal rules should ensure that no single person can move customer funds, that unusual activity triggers reviews, and that large transfers require approval from at least two people. These controls prevent one compromised account from causing a chain reaction across the platform. For exchanges becoming multi-asset platforms, these rules must also prevent permission mistakes or pricing anomalies from leading to cross-asset liquidations. Quick incident response is the final test of real security, where a serious exchange knows exactly what to do in the first hour, isolates the breach, pauses critical flows, and communicates clearly. While these measures do not cover every possible risk, they form the backbone of true exchange durability. By 2026, simply saying 'trust us' will no longer be sufficient. Exchanges must stop acting like performers in a safety show and provide evidence of controls, separation of duties, independent assurance, and a response plan that works under pressure to attract serious, institutional capital and keep their customers.