Currently, crypto platforms and custody services are overshadowed by a history of security failures, which shouldn't be the case. In the rapidly evolving blockchain world, theoretical concepts can quickly turn into significant financial ventures. This has recently happened with "real-world assets" (RWAs) being put on blockchains. After being an idea for years, major players like BlackRock and HSBC are now tokenizing bonds, gold, and more.

While this is exciting, there’s a major issue: crypto-native systems handling these tokens often lack robust cybersecurity. Having worked in cybersecurity across both crypto and traditional finance for two decades, I see a clear gap: compared to traditional finance, crypto firms generally have weaker risk control procedures. There's a lack of oversight, redundancy, and resilience among firms eager to use tokenized assets like gold or Treasurys for swaps or collateral.

The primary reason is underinvestment. Based on available data and my own observations, crypto custodians may need to increase their security spending tenfold to match the standards of major financial institutions tokenizing RWAs.

A long-term goal of RWA tokenization is to leverage blockchain's automated clearance and settlement for traditional assets, but this requires trust in the blockchain. If tokenized RWAs are stolen due to a hack, issuers like BlackRock might have to censor and re-issue tokens, turning tokenization into more paperwork and reputational risk, potentially slowing down adoption.

To prevent such issues, it's crucial to raise security standards in tokenization. As a security expert, I see no reason why blockchain systems should be as vulnerable to hacking as they currently are. Most "crypto hacks" are due to DeFi market manipulation, social engineering, phishing, or other off-chain methods. Traditional finance also faces credential theft but has built effective security practices. Crypto firms can do the same, but they currently suffer from a legacy of security failures, even among top-tier custodians like Prime Trust, which lost keys to an active deposit wallet, losing nearly $80 million in crypto.

Prime Trust's error indicates broader systemic issues. Solutions to crypto’s security problems include both technological fixes and improvements in process, training, and culture. Nic Carter’s proof-of-reserves (PoR) concept for off-chain crypto exchanges is a good starting point for responsible custodianship. However, PoR can be undermined if keys are lost or stolen. To strengthen PoR, we need real-time cryptographic proofs of key ownership and exclusivity.

Proof-of-key-ownership uses zero-knowledge proofs to confirm an entity holds the private keys it claims. Proof-of-key-exclusivity involves generating and securing keys within a hardware enclave, ensuring cryptographic protection. These solutions should be part of broader changes where digital asset custodians adopt institutional standards for a comprehensive risk management approach, such as the "three lines of defense" (3LOD) model. This model clarifies responsibility for assessment, mitigation, and oversight.

In 3LOD, front-line workers implement security practices, monitored by a risk management team, and audited by an internal oversight team. This model is often adopted as companies grow, similar to the current state of crypto custody as it moves mainstream.

Crypto firms must ensure their practices match the pace set by legacy institutions. Addressing crypto custody risk requires significant financial investment. Banks spend around 2.5% of their budgets on risk assessment and mitigation, with 0.5% on cybersecurity. Crypto firms, being smaller, might need to spend a larger budget proportion on risk and cybersecurity, potentially around 30%.

As crypto firms grow, so will their spending on risk management. With the rise in RWA interest, now might be the time for aggressive investment in security. Demonstrating bank-quality risk management could be crucial for collaborating with major players like BlackRock in the crypto space.

David Schwed is the COO at Halborn, a blockchain security firm. He was previously the Global Head of Digital Assets Technology at BNY Mellon and CISO for Galaxy Digital. He also founded the Cybersecurity Master’s Program at Yeshiva University’s Katz School of Science and Health.