Trust & Adoption: What Enterprises Need Before They Deploy | Boston Blockchain Week 2026

Right. Good afternoon. Got a very exciting panel today. Um, I'm gonna start it off and have everyone introduce themselves. So, Alex, you want to go first?

Perfect. Uh, my name is Alex Ring. I am a forensic accountant and sort of fraud examiner. Uh, I focus on all things compliance, but mostly um financial crimes related to cryptocurrency. I know everybody's favorite topic, the blockchain conference.

Um, I work with law enforcement. I teach them how to investigate cryptocurrencies and how to use blockchain to their advantage. Um, and I also volunteer with a nonprofit organization called Operation Shamrock, which fights against crypto enabled scams or pig butchering scams. Um, if you don't know what that is, I encourage you to Google it. uh where I focus a lot on education and um community outreach, how we prevent this, how how to spot it, and how to um um Oh, excuse me.

Um how to protect your family and and yourself from these scams.

Hey all, this is Gungjan Laiji, director platform controller at Falcon X. Recently joined the company a couple of months back. Prior to that, I was at Kraken where I was helping with uh new product launches uh and implementing them into finance. Also being an auditor in my past life. I was at EY for 10 years.

Hey everyone, uh I'm Michael Abrril. I'm the founder of Varity. Uh to the web 3 crowd here because we're at Boston Blockchain Week. It's uh Varity is a deepen orchestration protocol, but to normal people, it's just an orchestration cloud. Uh we don't rely on any of the centralized cloud providers.

We aggregate independent providers, consumer hardware, uh gaming rigs, Bitcoin mining rigs that have been repurposed and we can orchestrate the workload, whether it's an AI agent, a large language model, a web app, anything.

Hey everyone, I'm Iman and I lead capital and partnerships at Avant. Uh to be very brief, Avant is one of the largest capital allocators in DeFi. We are the largest user of protocols that you might know very well like athena and some others. We play a large role in orchestrating activity across DeFi in terms of what strategies people need to deploy and also act as a major trust agent and counterparty uh inside of decentralized finance. super excited to chat with um the fellow people on our panel today and talk more about what enterprises need to see before they actually come in and use decentralized finance.

Great. So, I think we're Michael, we're going to start off with a question for you. What has changed in the last two years that makes enterprises more willing to deploy blockchain solutions today than in the past? I mean within the last two years of course the first thing that pops out is regulatory clarity with Genius and then Micah rolling around the same time in Europe. Um there's more of like an evergreen thesis behind the entire blockchain industry maturing where you're seeing actual use cases being separated from protocols to actual applications and because of that we're seeing more widespread adoption within enterprises.

Um second of all I would I would add that the barrier to entry with blockchain now and for enterprise adoption has decreased significantly because you're seeing the value props being communicated forward rather than saying okay because we have blockchain architecture this is the value prop. It's blockchain that's that's never going to be the value prop. The value prop is is it going to be faster? Is it going to be um is is it gonna is it going to be faster? Is it going to be more like is there going to be more cost savings?

And is it going to be easier to use? That's really anybody really cares about. Nobody cares about blockchain. They care about is it going to benefit the enterprise.

All right. And Gunin, I have a question for you. So, what governance structures should be in place before launching a blockchain based solution?

All right. So, I've worked a lot with uh new product launches at Kraken and uh you know at Falconics as well. For me, governance pretty much comes down to four questions, right? who owns it, what could go wrong, uh what are the controls around it, and can we actually prove and explain what we did, right? I'll give an example.

Let's say tokenized equities. Everyone familiar with tokenized equities. Um the technology behind tokeniz equities could work very well, right? You would be able to mint tokens, burn tokens, you would be able to transact tokens, but that does not mean it's ready for enterprisewide uh deployment, right? So, let's take the first one.

who owns it. It's extremely important for organizations to figure out who owns it and who has authority uh to do what when things go wrong. So for example, there are different work streams which work together, right? So there's engineering, there is uh product finance, regulation or regulatory guys, uh there is legal, there's compliance, there's ops. All of them have their responsibilities.

But when something goes wrong, when a protocol breaks, when you're not supposed to transact with customers in a certain jurisdiction, right? If things of that nature happen, um, who has the ownership or who who's going to own pulling the plug saying stop the product right now, that has to be established beforehand and not when things go wrong. Combining second and third, which is organizations need to figure out what could go wrong and what are the controls you have for those risks, right? Again, giving you an example of tokenized equities. What happens when All right.

So, so blockchain is going to tell you that you have 100 Tesla tokens in your wallet or they have been transacted, right? But what's the guarantee that they actually backed by 100 Tesla stock? Who's going to look at that? What happens when there's corporate action? What happens when there is dividend payouts?

U stock splits, reverse splits, things of that nature. So what happens when customers who are not supposed to trade tokenized equities trade tokenized equities. So all of those risk and all of those what could go wrong need to be figured out beforehand uh and not after when the products launched. The third thing is you know which I have spent a lot of time in with is data integrity which is explaining what we did and why we did it and how we did it. Right?

So similarly in tokenized equities just because the wallet will tell you or the blockchain will tell you that 100 Tesla stocks have been or tokens have been traded that doesn't mean anything for the enterprise right for the enterprise you have to figure out what's the process flow what are the business events how do you book revenue what is u your um 606 right how all of that flows in your subleddger how all of that goes to your your GL and ultimately only financials. So the entire string of events need to be figured out before product launch. So for me all of these four things matter from a governance standpoint.

Great. All right. I guess along that lines as we're talking about the governance piece, Alex, what role do auditors, risk advisors, and compliance teams play in building stakeholder confidence?

Okay. The scary tree as I call it. Compliance, risk, and audit. Right. I always imagine like the Homer Simpson meme with the bushes like people just kind of vanish into it when you say those things.

Jokes aside, um so to um go off what Gunjam was saying is um compliance, risk and audit play crucial role to ensure that this governance that he was giving an example um is deployed properly. Right? Compliance, risk and audit are the most fundamental thing in any organization. crypto agnostic and they will make or break your organization if you set it up correctly. They're going to set you up for success and vice versa, right?

Um so compliance is really going to look at that regulatory compliance. Um whether it's the Genius Act or Micah or whatever jurisdiction you're in, hopefully the Clarity Act, um or whatever your business is, if you're a bank, you're a financial institution, you're a crypto data business, right? Do you are you governed by OC or Fininsson or all these um other agencies? um compliance is really going to look into that to make sure that um our organizational structure is following the rule of the law and then risk and audit is going to come and they're going to audit and make sure that what we're talking about this Tesla token versus Tesla stock is that what we have on our ledger right and audit I know it's a scary thing um but you know Tether just went through their first audit first audit ever done uh for stable coin issuer issuer since the genius act passing and they got an unqualified opinion right the clean audit opinion and I know it was like this veil of mystery what is going to happen to tether but the KPMG went and they looked at all these things they looked at the ledgers they looked at their governance they looked at internal controls internal controls are number one reason why fraud happens anywhere in any organization so we need to figure out how do we mitigate those risk and that's where the risk comes in. So it's like this kind of synchrony of things that happens with compliance audit um and risk to ensure that number one we look good to the regulators number two we're doing the good by the regulators by our investors by any stakeholder um and that we're we're doing the right thing for the industry as well because we want to prevent another FDX or another run in in that case.

So yeah,

like it kind of the next question does dubtail even into this like what are the most common risk management mistakes organizations make when they're deploying the blockchain solutions? Kjen, you want to take a shot at that?

Sure.

I think from my perspective, the biggest mistake that uh that companies make is thinking that if technology works, risk is mitigated, right? Um firstly organizations look at risk uh with a very narrow spectrum. They focus too heavily on technology risk, cyber security risk, right? But you also have u compliance risk uh regulatory risk. You have different type of risks.

I'll give you an example with staking, right? So your staking protocols or your staking product may work seamlessly. There's no issues in that. But you have validator risk, slashing risk, regulatory risk, liquidity risk, uh custodial risk. So there's a lot lot more risk which you don't see on the surface but there are and you don't want to be late in mitigating those.

So you need to think about all of those risk or the risk profile per se together. Second point is uh based on even if if these teams kind of are working I've seen that these teams work in silos, right? So the ones which I mentioned compliance is is looking at regulatory risk uh finance accounting is looking at reconciliation risk right I've seen all of those kind of working in silos doing their own thing documenting and that's about it but you need someone in the organization who puts all of these together who looks at the product on a entire level holistically with a bird's eye view and says how do these risks intermingle because in digital assets one if there's an issue in in one area it increasingly escalates or escalates very fast to the other area. Right? And the third mistake which I've seen is organizations think managing risk is a one-time iss one one time thing that we just manage risk when it's the product's launched and that's about it right but if you see 6 months down the line uh the markets have changed products have changed protocols have changed custodial has changed regulation has changed and you don't want to again be sitting and thinking oh everything's going perfectly whereas you get a call from your regulator saying hey guys this has changed why don't you know you guys are inviting ation of certain things, right?

So, in a nutshell, you need to you need to constantly monitor the risk on an ongoing basis, maybe every six months, every one year and also have an escalation uh process of protocol. If something goes wrong, what do you do in those cases?

All right, Alex, how can organizations demonstrate the accuracy, integrity of onchain data to regulators, investors, and customers?

Oh, perfect. I love this question. This is a hot topic in crypto compliance. So I think the data integrity piece the blockchain solved 50% of the problem for us already right because just of the fundamentals of the blockchain it's transparent immutable no single point of failure uh which makes it a source of truth uh but it doesn't work um for an organization that's trying to deploy a product whether you're trying to do any type of crypto trading buy sell trade you're doing stable coins payments elements tokenized deposits anything like that we need extra metadata and so I would say looking into what other um companies are doing what's what third party vendors can we find they're going to provide this data for us so investing in a good analytics tool like chalysis TRM any um any of those products are going to give you some some information but this is from a macro level right we need to invest in order to be compliant and in order to show to the regulators and investors and any stakeholder that we are taking this seriously, right? Compliance is probably what will uh get you fined if you're not complying um with whatever rules.

So um if you're implementing any of those analytics tools u they're not going to attribute 100% of the blockchain because it's just not possible, right? Blockchain is constantly moving, constantly doing things. Your organization is doing things if you're doing deposits or stable coin, right? There's constantly movement there. So, we can't attribute everything.

But what we can do is we can look at a data and we can attribute it ourselves. And so, that's on a micro level. If you're running a really good organization where you have a good financial investigations unit there, uh hopefully those investigators are labeling wallets. We see a scam, we label a wallet. Uh we see terrorist financing, we'll label a wallet.

It's a controversial thing in in the compliance industry, but I think we need to talk about it more, but that's also going to show to regulators and everybody else that we're very proactive in taking it seriously. We see something wrong, we do something proactively about it, and hopefully those analytics firms are going to take our data. Um, and the best thing about it is that if you find a scammy wallet or anything like that, you do not have to disclose your customer data. You just have to talk about the whatever whatever activity. You see a scam, your customer got scammed, you label that wallet as a scam.

That's it. We're not disclosing anything else. Uh it takes five seconds. And I think if we started being more proactive about it, that would also show um it number one, it would add more to the data itself, right? And if you have good data, you can make good business decisions.

If you don't have good data, then you're running blind. Um, and I think kind of all of those things together are going to show everybody, hey, we're taking this seriously because we need to take it seriously because we still do not have a seat at the at all table as a crypto industry. Um, so we need to take these steps and um, and show that that we are serious about compliance.

That's a good tip. That sounds like you don't need to turn over all the data. It's just the when an individual has a scam. That is good to know.

Yeah. Yeah. A lot of scams. Don't get me started.

All right, we're gonna pivot and talk a little bit about adoption. So, um, Michael, why do some techn technically successful blockchain initiatives fail to gain user adoption? Okay. So going back to what I said initially in your first question, blockchain initiatives that scale typically with very technical engineering teams, they care more about the blockchain technology being the value prop itself rather than is this going to help whether it's operational efficiency, it's speed, privacy, cost savings or simplicity, ease of use. And for the people in the enterprise, the employees using whatever that blockchain initiative is, how easy is it for it to be adopted?

I mean, does somebody have to go through a training manual or can they have that time to value sort of like in a productled like growth strategy where the customer can understand exactly or in this case it's the employee of the enterprise. Can they understand exactly what is the value prop? Is it making my life at work easier and how can I see it benefit the enterprise? I think that right there, those three and then baking in privacy as well, that's And what strategies have been most effective in overcoming internal resistance to blockchain initiatives?

So this is more so not on the enterprise side but more so for the productled growth kind of masking it. But as you see with hyperl as you see with poly market the entire user interface has nothing to do with blockchain content or complexity. They've abstracted all of that away from the end user because now with the blockchain industry as a whole progressing and maturing, you're not just capturing the web three market. You're capturing the web two market as well, which is what every single business is trying to do. I mean, and to appeal to that market from like a user psychology standpoint.

You can't be complicating it with all this technical jargon. You have to explain things in a visually compelling manner that's simple to use. for example. So with hyperlquid and poly market, you don't see anything with blockchains unless you're, you know, in the 10% power users. But you go in, you trade and that's it.

The entire abstraction of of blockchain has already been done and they're able to capture such a larger web two market and that is being applied within enterprises because employees at the end of the day, they're not they're not being paid to learn and go back to school to learn about blockchain technology. They just want to use the tools to make their life easier because at the end of the day, they have to hit numbers. That's all they have to do. They gota they got to pay bills. So, yeah,

we do have bills to pay. Yes.

All right, we're gonna pivot a little bit here. Um, and when Amed, I'm sorry, did I mispronounce that?

I Okay, so when a fund asks you whether they can actually size an onchain product, what is the first thing you look at and what do most teams still lead with that you ignore?

Yeah. So, this is actually a really interesting discussion because I feel like it ties into a lot of what others on this panel have gone into on the more infrastructure and compliance side. We're on the allocation side of things. So, we look at what has actually happened so far that will allow us to either make an allocation decision or deny allocating into a tokenized equity product or an onchain bond fund or just a purely DeFi native product in and of itself. There are some core risks that a lot of people don't look at and some risks that have been popular up until today but have really changed in the past two to three years and that's what we really spend a lot of time diligencing that others in our category have not and unfortunately because they have not have succumbed to these risk vectors.

So one of them for example is uh key management and operational security risk. So if you look at the state of DeFi two or three years ago, you would have seen the primary method of attack to drain funds from a smart contract or exploit some logic in a protocol is smart contract risk. At the end of the day, immutable code is great because again it allows you to audit exactly what that code can do, but it also surfaces the problem where once something happens, it's happened and you don't know when something will happen or what will happen until it does. So the risk vectors in this case are very binary instead of non-binary like you see in traditional finance where you know for example if somebody steals money from a bank you have some method to you know there's a serial number for that dollar you can put it on some list and there could be some eventual recovery or if it's completely sent through swift or some other technology like that it can almost be fully recovered but on chain if some stable coins are stolen from an account or if ETH is stolen or scammed, it's gone. There is nothing you can do about it.

And if you're running an onchain fund and you have exposure to these risk factors, it's extremely important to one, control for those and two, educate your um LPs about these risks because it's not like, okay, one day the vault share might be worth $1 and backed by$1, but tomorrow it might only have 95 cents in it. And how do you how do you account for that? and how do you educate for that? Um, it's really been interesting because we've gone kind of backwards in a way where our initial risk vector was web 3 native risks, smart contract, and today the majority of risks are, you know, how are people handling their private keys? Like for example, um, Drift, which was one of the largest perpetual exchanges on uh, Salana, was exploited for nearly $300 million earlier this year.

And the reason for that, if any of you guys have been tracking that, is the core developers had the smart the the private keys for the smart contracts that controlled nearly all of the custody of funds on one laptop that they were using for their own personal affairs. So imagine how easy it is for somebody to a threat actor, in this case it was Lazarus Group who has been like the primary perpetrator of these attacks to go in and really like become friends with somebody that owns that laptop and you know maybe borrow it for a day or send them an email that they open a PDF on or any of those kind of things that the private keys are gone like that and once they're gone it's extremely hard to protect against that once it's already happen. So there are many many many protective measures that you go through before you do that and that's what we spend most of our time diligencing today.

All right. So after a category incident on that note um what do you rederwrite first and like the smart contracts the operators or the lost waterfall? So on that note, over the past couple of months, there's been almost one uh D5 protocol exploit every 24 hours, which is remarkable to think about. But less than 5% of those were smart contract exploits because what we've seen is a lot of the original triedand-true smart contract architectures like a v3 for example or the morpho codebase or some of these others have been forked and reodited and reodited and reodited and those aren't the primary risk factor anymore. And one also important thing to note is that not all blockchains are immutable and decentralized.

A lot of the ones that you see today like for example we recently deployed a a project on INC which is Kraken's uh layer 2 blockchain is almost completely centralized. So is you know Salana arguably avalanche and many of the other uh consensus protocols are largely centralized. So you also have to look at that as a core risk. If if there is a category event, the first thing to look at is what are you potentially exposed through through dependencies. If there is a smart contract exploit on a you're not just looking for okay, you know, a was exploited that money is gone.

What is next? What uses the A codebase that might be next? What uses a fork of A that you know could be getting worked on? Um, if it's an operational security uh exploit, you're looking at, okay, what was the private key storage solution that this protocol used? Um, if it was a draining of a wallet, you look at what allowances did that did that wallet make to which smart contracts.

You really have to look and the dependencies in DeFi are both great and also scary because when something happens, you have to go all the way down from the top of the tree to all of the layers underneath. And when there are events like large large category events, that tree can go like 50 plus layers deep. And you have to look at what what is the universe of possibilities here. And it can really really be immense. And there are some firms out there that are mapping out all of these dependency trees because all of this data is there.

It's all onchain. It's all verifiable. It's all auditable. But it's about how do you actually get to see that in a way that is comprehendable and AI has helped with that drastically. Being able to, you know, go into your cloud MCP and use a tool like herd who is really great at at doing this and they're pioneering this field can go in and ask like do what in this tree has exposure to this dependency or this dependency and it cuts down the time on our side from having to scan through hundreds of protocols and hundreds of smart contracts to maybe only a couple.

All right, guys. We're going to close with a rapid fire. So, I'm gonna have each of you guys answer this one. So, if every audience member could take one action tomorrow to improve the likelihood of a successful blockchain deployment, what would it be and why?

Label wallets. Label wallets. Label wallets. [laughter]

I would say probably get your compliance, risk, finance, operations team seat at the table when you're building products and not when you are about to launch them in two weeks. I'm going to say abstracting blockchain complexity from the user and I'm going to say all of the above plus transparency and communication. The biggest failures in decentralized finance have been due to a lack of transparency or a lack of communication or a combination of the two. So, please tell your users what you're actually doing with the funds that you that they give you. On that note, [laughter] all right guys, well, please join me in um say thank you very much to this panel.

Great job today, guys.