Wall Street Demands More Than Just Promises of Security

The primary platforms for storing and transferring digital money are crypto exchanges, with the market currently experiencing a 24-hour trading volume of approximately $190-$192 billion. As these exchanges expand into multi-asset venues, their security mechanisms must evolve to include identity, permissions, pricing, and settlement. However, despite increasing regulatory pressure, the security of these exchanges remains a significant concern. In 2025, the crypto industry saw the theft of over $3 billion in assets, with several incidents resulting in losses of over $1 billion each. Notably, these significant hacks occurred at major global exchanges with substantial capital and technology, indicating that a lack of resources was not the issue. Instead, the problem lies in the fact that security is often treated as a marketing tool rather than a fundamental discipline. Exchanges invest in superficial measures such as dashboards, reserve snapshots, and public statements, which may appear reassuring but do not demonstrate how risk is managed on a daily basis. This approach, which Chen refers to as 'security theater,' focuses on creating the illusion of safety rather than actually being safe. The consequences of this mindset are severe, as it can lead to significant losses for users when stress hits the system. Chen argues that genuine exchange security requires a system that can withstand stress and has three core traits: proof-of-reserves, strict internal rules, and quick incident response. Proof-of-reserves provides evidence that certain assets exist, but it is essential to have transparency that clearly shows assets and liabilities, with an independent check. Additionally, strict rules inside the company, such as no single person being able to move customer funds and unusual activity triggering reviews, are crucial. Quick incident response is also vital, with a serious exchange knowing exactly what to do in the first hour of a breach, isolating the issue, pausing critical flows, and communicating clearly. By 2026, simply saying 'trust us' will no longer be enough for exchanges to keep their customers and attract institutional capital. Instead, they must demonstrate evidence of controls, separation of duties, independent assurance, and a response plan that works under pressure. Security is about building systems that mitigate damage, slow down bad decisions, and hold up under stress. Exchanges that make this shift will maintain trust, while those that do not will continue to learn the same lesson the hard way.