Custody & Tokenized-Asset Protection | Boston Blockchain Week 2026

All right, good morning everybody and welcome. So, uh, guys, if we'll ask everyone to introduce themselves, uh, to start off. Go ahead. I'm Jeff Gardner, uh, Glass House Systems. I've been managing tech technology and techn technical security for 30 years.

Uh, Kyle Clark, uh, I lead sales for our financial infrastructure team, uh, at Anchorage Digital Bank. I really spend all my time uh working primarily with G SIBs as for the most part they get into the web3 ecosystem uh for the first time. So there's a lot of handholding a lot of education around things like security how these assets move onchain different types of you know flow of funds compliance considerations as well. Uh previous to joining Anchorage I was at Zero Hash uh for three years as a director of BD. So really spent the better part of a decade uh working with Trady firms to launch different digital asset solutions.

I'm uh Chris Russell um CTO and CSO at TZ Group. I've been there about five years and before that I came from a you know CISO background in uh traditional cyber security and then before that I was a in the intelligence field.

Great. And uh I'm Kian Raven. be moderating today and uh my firm unifies access to investments through a single API. So um as you guys know today we're talking about uh you know tokenized asset pro protection and the custody landscape and part of today's talk actually was going to uh mention a couple recent security vulnerabilities including for example social engineering related ones like the drift protocol hack a couple months back. But we had a really precient example just this morning of uh of social engineering when somebody imitated the Boston blockchain week telegram and contacted many of you guys and speakers saying that there were urgent changes to the agenda.

So goes to show that we're really in a high threat environment. Um so um so yeah well this panel is uh pretty pretty on topic. First question I have is basically to put you know to put some things into context for the audience uh and viewers who are watching online right now. Um you know can can you guys maybe walk us through current custody options? So there's self custody you know third party custody, hybrid custody, there are different types of wallets as well.

So maybe who wants to start off and just give us a brief explanation?

Uh sure. The basic idea is that uh who bears um the the cryptographic keys that authorizes the authorizes the transaction on the chain effectively owns the the asset and you can uh you in the case of uh blockchain uh bitcoin for example um that's you um you manage the the key that authorizes the transactions. These are the the smart contract system is based on your your choices. There's custodial systems where um you permit an organization to manage that uh that for you and there are variants on that um where you have uh delegated key responsibility delegated to a to a team or you have uh multi- signature which is where you you require uh um m multiple uh signatures in order to to affect the transaction and you've got variations on that and that's important because uh and Just earlier we were listening to a really exciting talk about agentic um transactions at the end of the day. Um who manages the key um influences where that asset flows.

And uh we're probably going to talk about this one today, some of the other incidents, but there variations on that theme. You know, do you social engineer the legitimate key holders to affect transactions that maybe are are are um you're using uh uh authentic technology to authorize a transaction that's really not appropriate? or are you actually breaking the underlying technology to affect a transaction? Um, so that's kind of my my take on it.

Do did you guys have anything to add about other custody options available today?

Yeah, this seems like the perfect opportunity to talk a little bit about Anchorage. Uh so to get back to kind of the specific question, I think it actually helps to put a little bit of foundation on kind of who we are, what it is we do, um and kind of draw some parallels and some there's always an opportunity cost is is what I tell clients. So there's two things that make Anchorage Digital Bank unique compared to every other custodian in the space today. Uh the first is our regulatory structure. So we were the first federally regulated digital asset custodian in the US.

uh we received OC regulatory approval in 2021. So all assets that Anchorage holds are not on balance sheet. We cannot co-mingle. We cannot rehypothecate by law. To follow up the point, we own the keys, not you.

It's us. The same way that you leverage a bank to hold your US dollars, you are leveraging us to hold your digital assets. And we work with groups like Black Rockck, Fidelity, State Street, uh Micro Strategy. We are institution only. And this is exactly the way that they want it.

Now the other part that makes us unique in addition to our regulatory standing is how we actually custody these assets. 100% of client assets are held in airgapped cold storage offline which is the same way we store nuclear codes for the record in this country. So we are managing the keys. All of your assets are offline and there is a kind of unique process to go about actually signing the transactions which then we have to review to release your assets. So because we are a federally regulated bank, every time assets come in, every time assets leave, they need to go through an attribution process.

And you know, you talk about the, you know, social engineering or address poisoning that takes place. These aren't super complex, you know, um, processes, but all it takes is one person to screw up. And we've had extremely advanced clients try to create a trusted destination for where they plan on sending assets and and we run the onchain analytics and say, "This wallet has an issue." They're like, "Well, that's funny. I just spoke to Wintermute or fill-in, you know, liquidity partner, and they said this is where it's going."

I'm like, "Well, dollars to donuts is you got spoofed." And sure enough, that's exactly what happened. So those are the types of protections that you know we put in place. However, the other side of the coin here is we are not a good solution for everything. Um we are not the best DeFi connectivity bridge because of a product of our compliance and our security.

Uh we are not the best payments orchestrator because you know you don't want to have to run KYC or collect all this information from a client who's buying you know $200 pair of sneakers. So, we are the right solution for the right use case, but by no means is that all-encompassing.

Um, TZ, that's who I work for. We have a qualified custodian license through uh FINRA. But, uh, I think balancing the need for like fast transactions and secure is what everyone's trying to reach the sweet spot on. It's how do I allow people to move seamlessly in and out of platforms while also making it secure. And I think the goal is to make it behind the scenes and make blockchain just look like any other security transaction.

No one sits around and worries about what kind of SQL server Fidelity is running your ETF, you know, digital footprint on. And that's the way blockchain needs to get to too. So, you know, from my approach, I always just trying to try and make it feel very seamless. Uh security, the KYC, all the stuff should happen on the back end. The customer should just be able to come in, look at, I want this, you know, here, I want to move it over here.

And you know, the goal of the whole industry, I think, is to make it very non-eventful. The blockchain going on the background is really cool, but you know, we don't necessarily need to to uh, you know, make it more complicated is for them. And so, just going back to the social engineering piece, you know, most people aren't going to try to break the cryptographic piece because it's just, you know, it's the more complicated version of it. So I'm seeing a lot more things like social engineering where they get into people's networks, they get into people's emails and they just try and you know change directions of oh no that's not the that's not our escrow wallet. This is things like that.

So, short story here, long story short, uh whether you're, you know, just a, you know, an individual deal with with crypto uh as a custody or a company, um you always got to kind of double check with a system where it's going to uh because they can hijack the browser, they can get in the emails, they do a lot of things and they'll be very patient uh because that's their bread and butter.

Makes sense. Makes sense. Um so, it's good segue here. We're actually going to talk about some of the recent hacks and I'm going to ask you guys to sort of rapid fire on what needs to change, you know, for those types of hacks not to happen again. So, we'll talk about Drift Protocol if uh if we'll ask you could could you explain what happened in Drift Protocol maybe?

And then we'll ask uh you how about you if you could uh Kyle explain what happened with the cold card wallet and then if everybody can say what needs to change what does the custody you know industry have to learn um and what can users do as well to just do like a backup you know triple check if they're picking a vendor.

Yeah. on the Drift Protocol one, um the uh the the legitimate key owners were socially engineered to authorize transactions that were not intended by the actual asset owner. Um it wasn't a technical breach. Um it was a social engineering breach. Um

North Korea, right, North Korean actors who even went to conferences in person, had meetings, they had dinner together and lunch with the actual Drift Protocol uh team. Yeah, that's right. It was it was very well done.

For me, the uh the issue that it raised is that we can't just worry about technical security like the cryptography was in place, the transaction from a key management perspective that they were legitimate keys that authorized unintended uh transactions. So when we talk security, we often focus on the technical security. Great. We also need to focus on the the operational security and then there's a governance issue. who sits above the the smart contract um institutions that manage that and adjudicates for example issues of um you know what if the institution authorizes a transaction but the asset owner didn't intend it.

So there's actually layers to this conversation and it's very easy for us to to to hyperfocus on one of those layers and I'm really interested in the two upper upper pieces. Chris actually did an article that talks very well about the two lower pace uh pieces. So I would recommend his article. Um but I I'm interested in the top two pieces, the operational security and the governance because that that's what really what interests me.

Okay. And how about cold card?

Yeah, you take this one. This is your wheelhouse.

Yeah. Well, and the bottom line with with cold card is they generated just kind of weak ciphers at the very beginning of the whole thing. So you have this whole company, this whole infrastructure, you have this whole thing. But the very beginning, the genesis of these keys was just weak. They're ones that were a little bit more predictable than you think.

So instead of having to, you know, throw a bunch of hash rate at it and and and and brute force it, um they could tell that it was, you know, a relatively simple hash, they could just spend a lot less time on it and they were able to come up with, you know, the private key uh ju just based off of very low amount of effort. And in that case, everything else after that followed the way it's supposed to work. They got authorization from a private key. All the checks and balances worked. All the people watching it saw these signed transactions.

And there just there was nothing else in the system to really kind of uh catch the fact that the very beginning was where the problem set. And so I think um my my lesson learned is that everyone that's worked in the in any industry anywhere, forget just blockchain, they've seen the dirty underside of the IT side. They've seen the unpatched system. They've seen the guy who built stuff that wasn't ever meant to see the light of day and ended up being the foundation for Fortune 500 companies. They see the cobalt servers running in the room, you know, on the main frames that no one thinks is still running.

And and and the bottom line is is we got to think about startups these days especially in crypto they have these really great products but in the first day there was a developer in a room with not a lot of supervision not a lot of you know decision making going on and they decided how the cre the keys were going to be created and so and things just ended up kind of rolling into production after that. So I think what everyone my lesson learned is security starts the beginning the as soon as the product is an idea and I'm a new CTO and I'm a former CISO but I think when it comes to blockchain the blockchain is part of the sec security it's part of the product and if you're not thinking about it from literally the first minute and the inception of the product you're kind of getting it wrong. You can't add it afterwards. This was a problem they could not fix later because these keys were already generated in a certain way. So you have to be thinking about security from the the first moment a project gets off the ground, not once you got seed money, not once you have enough money to hire a CISO, not once you know regulators are looking.

You have to have it baked in from the first minute or something like this can happen.

So that's a a great that's a really good takeaway. Um, I'm going to ask a sub question though and I think the audience might be interested and we'll ask the audience actually who by a show of hands who has like any digital asset exposure at all whether it's like a little bit of tokens or an RWA. Okay, pretty much almost everyone. So, Oh yeah. Well, I hope so.

Um but uh the the reason I'm asking this question is because I want to know from you guys you know basically after these hacks you know there have been multiple comp like hacks this summer others that we didn't even talk about people have been asking me just friends and stuff even family like okay man like cold storage uh you know could be could be compromised because of what happened with weak entropy um I don't trust anyone other than basically like Coinbase and you know Payword Kraken for for exchange uh storage. Um also we can't access you know we're not an institution. We can't go and work with like your firm. So what do we what what should they do? What's what's what what is the solution?

Hybrid custody or

go ahead Jeff. I recently did my doctorate and I looked at whether cyber security professionals understood risk. Um he was talking about building building security and by design and what I found was only about 11% of cyber security professionals understand risk. So this is a totally odd thing to say but I think it starts with understanding risk. Risk is two things.

It's the likelihood of something happening and the impact that it'll happen should it happen. And if you and and this can be learned and what I foresee is I liken understanding risk to a child learning to walk. If when a baby's born it it's immobile and then it learns to crawl. Then it learns to stand at a table and wiggle and then it takes tentative steps and then it learns to run and then someone teaches it risk management. Don't chase the ball on the road.

Well, we have emerging technologies. We have, you know, I grew up in a in an age where we didn't have computers in the home. Now we do. We have them have computers in our pocket. We're connected to a network 24/7 365.

We we're the baby that's now walking and running. And we have to learn risk management. And it can't come at the end. It has to come at the beginning. It's just as Chris was saying.

What I think to piggyback on that, you know, the kind of risk vectors or where risk exists in moving digital assets or just in the digital asset ecosystem in general, uh, is different in certain ways and and the same in certain ways as you'd see in Tradfi. So, something that I always kind of um, harp on with clients is that there are certain times where maybe you're withdrawing to a smart contract. tokenization is the thing that everyone's talking about like okay well there's a there's a smart contract risk to that if you're going to bridge oh well we're are we're building a tokenization we're our tokenized products on Solana we're going to accept USDC on Solana into the smart contract but we want to be able to take in all different sorts of stables and then bridge to USDC on Solana well the bridge opens up an an opportunity for an issue to occur so kind of helping clients really understand where these risks may be enhanced because again chances are it's probably the first time they're going through something like this at an enterprise scale and then kind of walking that tight rope between what's operationally feasible for them versus as secure as it possibly could be make it near impossible to move and at times that's appropriate and at other times it's not and very often you know the groups that I work with you know they believe that they're it's like a infomercial set it and forget it. And it's like actually that's not the case. Uh you're setting it, but then you're going to approve it every step along the way because that is where you kind of inject these other layers and opportunities for security protocol and and different quorums.

I think the uh not the crypto space but blockchain and tradi we've really missed the boat on giving investors and individuals the correct wallet setup structure safety whatnot. No one spent a lot of money on it. Um real world assets you kind of deal with a little bit different than than Bitcoin. It's not just a token that goes up and down. There's there's corporate actions, there's voting, there's dividends, there's these other things.

There should be prospectuses. there should be data for the investment built into it and you need a wallet in in my opinion that you can interact with a little bit more tangibly than MetaMask and I just don't see that many people have really built out something that is really geared towards individuals and and it and people should be doing more self-custody for for RWAS but you know we're not very good at passwords as a society so what's the answer well companies need to spend a little bit of money on corporate grade wallets for individuals and I think We're starting to see that. I know I'm involved with a couple, you know, joint ventures where a bunch of people that have been in the enterprise are saying like we're there's a lot of people left outside. They don't want to necessarily be in charge of millions of dollars of their own investments without some sort of backup. They also don't want to not have access to it and it be liquid when they want it to, which is the whole point of blockchain.

There's got to be something in the middle. And I think you'll start to see a lot more organizations are going to roll out products that are consumer, you know, oriented but have additional security that you normally wouldn't get unless you're some, you know, enterprise throwing money at it.

Thank you. Thank you. So, uh, this actually brings me to a question that I wanted to ask, uh, you Kyle specifically, u, but also anyone feel free to chime in here. Um what about like security audit practices and also you know FDIC coverage for those firms like yours that have bank charters right technically that allows you to obtain FDIC coverage on depositors's uh accounts up to the FDIC's limits which I think are 250,000 right

so what does that do why why are people not you know uh hacking Fed wire or Fed now first of all that's a That's that that I I always wonder that and and is it just because there's insurance coverage and or you know the the the sort of u bank uh bank charter makes disincentivizes people.

It's a really good question and I'll answer it in a few parts.

Okay. Um, we always talk about meeting clients where they are and you know we may be working with fill in, you know, the blank like GIB title and we're probably working with a pretty tight team, but the RFP and or the the third party risk management review process application that we are filling out sure as hell ain't designed for Anchorage Digital Bank. It's designed for any partner that the procurement office would work for. So there's always this certain degree of um I don't want to say friction that makes it education opportunity uh where you're asking for something that is impossible to do given the way this technology works. And a lot of times that's the case with uh compliance.

Compliance has to catch up. You know we could talk about SAR reporting for example or and going back to that kind of set it and forget it expectation. I work with a lot of clients who don't understand that we can't execute a a smart contract transaction just because from a regulatory standpoint we can't pre-wallet screen with very limited examples of where you can. Um so one piece of it is listen we try to bring all the degrees of of comfort and solace to procurement teams and security teams that we're working with. Some are much more forward than others for those gaps that I'm talking about where there is just no middle ground.

We, you know, once you get on a call and help people understand the way that we do things, they're usually like, "Wow, that's better than the way we do it." So that's great. Uh, but there's a certain learning curve to it. Uh, as always, now uh the next piece around insurance, yes, we are a federally regulated bank. Actually, BNY powers our fiat uh capabilities.

So any fiat we hold is is FDIC insured via BNY. Now if I told my digital asset clients like have no fear your deposits are guaranteed up to 250k like they'd laugh in my face because most of them hold hundreds of millions if not billions of dollars of assets. So

uh in that case the FDIC insurance as it relates to digital assets is kind of a non-starter. I think more banks will emerge though like like more uh more companies will take the regulatory approach of let's say Anchorage and then insured cash sweeps which are really common for for companies

particularly in the short-term treasury types of solutions as it relates to treasury management for these groups um 100% and you know fiat is still very much so first mile last mile it's a solution that you that you need to have so I think kind of one plays into the into the Cyber crime insurance is really kind of the big thing in in the space. It continues to be and I don't think that's going to change anytime soon.

Okay. Okay. I'll I'll I'll ask I'll move on a question because we're low on time and I do want to ask this question. It's about AI agents and custody security. So you guys know, you guys probably heard about I don't know if you guys are on on X often, but there's this whole craze around uh people using AI agents to make reservations at resi and resi is rate limiting them.

I think it's like called inverse the uh autonomous agent app platform, right? So they're actually giving people are giving access to this agent platform to their like you know Apple Pay uh wallet and bank accounts and everything through plaid and so the agent is able to autonomously spend money including logging into their crypto exchange accounts and and uh affecting transactions. So well you know how like your firm like what is the security protocol for that? Is are we are are people cooked? Yeah, I've actually spent a fair amount of time on this.

Um, I have a product in beta called Halo right now, which is uh basically guardrails for an agent on your brokerage account wallet and it allows you to set rules on, you know, like he can it can only spend this much or only this token or during these hours or nothing and it all has to go through approval and you can get like a popup message to approve it or not approve it. Um, but it is a really scary space and I I think you know that part's the easy part. A lot of companies can put some guard rails and rules around what the agent can do. Um, the real scary part is on the outside world and we talked about dig uh social engineering. Well, digital social engineering is going to be another thing where people are going to try and trick your agents that are out trading on your behalf and doing your trading schema.

They're going to be out there being able to stand up brand new websites, brand new domains, brand new everything that looks legit because they're going to use AI, too. and they're going to be out there trying to catch with honeypotss, you know, these agents that have access to your wallets. And I don't know that it's being talked about a ton. Um, but there needs to be a way for AI, you know, agents or even users to get more um reputational and I would say safety information off of wallets they're transacting with.

Maybe like a scoreboard.

Yeah. Uh I mean you'll see on ether scan and things like that people are starting to pop up things where you can look at who you are going to interact with and you'll get some some grading some scoring but this really needs to be built out and be more real time and and more I wouldn't say necessarily a product but I would say part of the part of just the whole infrastructure so that uh agents can you know whether it's a source of truth maybe it's many of them I'm not sure the right answer find out is the wallet I'm dealing with you know do they have a history of of problems s if they do they not have any history, what am I actually dealing with? And they need to be able to get that pretty quickly and pretty I would say cheaply uh in order for you know agents to take over trading which everyone you know is predicting is going to become you know 10fold what humans do. So I see some real problems with digital social engineering. I don't hear a lot of solutions yet.

I do know a lot of smart minds are working on it but uh I would love to see a little bit more publicly.

Go ahead. Um, forget the agents dealing with money. There's already been court cases where um, the courts have looked at the case where you're actually bestowing this power power, the power of an agent to represent you. The famous one I can think of is Air Canada. Um, Air Canada um, allowed agents to answer questions to the public about its policy.

Someone had a bereavement case where a family member died. He asked the agent, "Do can I buy the ticket and have it refunded after?" So, there was a financial consequence. And the agent said, "Yeah, I've scoured through the through the policy. You can do that."

And then when he tried to bring the value of his ticket back to Air Canada and get recouped because Air Canada says, you know, if you're flying for a family member, you've got to apply beforehand and then and you get the discount at the time of purchase. But that's not what the agent advised. So he tried to get the money refunded and the Canadian uh the Canadian court system said, "No, no, you've actually given the agent power to act on your behalf. So now you have to live with the consequences of that." um when you take that and I and I don't Canadian law might not uh influence American juristprudence or European juristprudence or whatever.

But the point is if you bestow an agent the power to do things like u affect payments on your behalf, you have to live with the consequence. Now I'm a risk guy, so when I talk about risk, people think, "Oh, you're just standing in the way." No, I think that allowing agents to affect transfers and payments and trades on your behalf is is doable. But at the end of the day, you have to be aware of the risks and you have to put into place the guard rails that allow that to be done safely. And it's a matter of sitting down with smart people and saying, "Do we really understand the risks?"

Well, thank you. And as a Canadian, I have to say, anytime Air Canada loses, I am happy. That's uh that's about it for today. We're just out of time. So, thank you very much, guys.

And uh if anyone has questions, I'm sure uh we'll be we'll be around. Uh, and thanks to the Cubic Labs team, uh, for putting this event together. It's really amazing.