Securing the Stack: Standards & Architecture | Boston Blockchain Week 2026

Well, first of all, thanks for having us. Uh, I'm Adam Rack. I'm going to be moderating this panel. I am the executive director for the Blockchain Security Standards Council. We are a nonprofit organization, uh, membership based organization building standards for blockchain for digital assets.

We've been around for about two years. Uh, right now, uh, I have some of Max and Eric are members and Droo is also a sort of affiliate member u working on the assessment side. is we're looking at both building security standards and developing the assessment tools as well to help create more security in the blockchain. So, uh I'm going to have all the panelists just introduce themselves quickly, talk a little bit about what the role is at BSSC and then uh we'll jump into some questions. So, Max, I'll let you uh kick it off.

Sure. Hello everybody. Um I'm the director of security engineering at Figment. Um we're responsible for offensive security, cloud security, all all the good stuff. Um we joined BSSC early on about two and a half years ago I think now.

Um and my focus has largely been on the node operations standard which is going through it's I think third version now coming out soon. Um and then also sort of like a a more meta standard that we call the general security privacy um standard. We can get into all that in a bit. Um and then uh hopefully soon in the in the coming weeks we should have a transaction security standard that's largely looking at like transaction systems um as like from the system point of view whereas like typically I think the industry tends to look at it like a pointto-oint thing. My transactions going from here to there.

There's a lot of other things in play and there's a lot of things you can get wrong. Um so I'm really excited for that one.

I'm Eric. I run our digital asset security program at Coinbase. We I think co-founded the BSSC um over two years ago now as well and we've largely had a large hand with basically building the foundation for all the standards right now. We've heavily authored the token integration one. Um and the one thing that pairs with each of these standards as well which we will be publishing later on are our audit frameworks which gives you a guide for you know how to go through each of these standards and what to look for specifically so that um in in the near future we can have a more certified process for doing all of this.

And Drew.

Yeah. Hey, I'm Drew. I don't do anything nearly as exciting as these guys here. I'm just an auditor. But um no, happy to be a part of the blockchain security standards council.

I work for Crow. We're a global audit firm. Um we joined about two months ago as a general member and we just help again review the standards, the assessment frameworks that these guys are writing and eventually you know hopefully help with actually performing the audits and testing those things once they're out in the market. So appreciate being here.

Thank you. And just from a background, so we've got five standards out. We have our sixth one coming in as mentioned. We do have one on token integration on key management on node operations. Uh we have a smart contract standard as well that just came out this year and then also a general security and privacy st practice which is really based on the NIST CSF to really provide a baseline so that anybody who is in the blockchain space in digital assets can at least have that baseline of security in place.

Um so my first question is you know you guys are you part of the BSSC what we hear sometimes and some maybe push back is you know with standards are you really stifling innovation in the space that you're in and I'd be curious you guys are all you're part of it you're in innovative companies what's your response to that do standards stifle innovation

so they can that's asterisk right um I think

that's not what you're supposed to say Max

Hold on hold on I'm I'm working up to something here Um I I think they definitely can. Uh but I think what BSSC identified was that there's like a gap in the standards market, if you want to call it that, where a lot of the standards are kind of like um either incredibly highly specific to like one like super specific thing and drills down super deep um and costs a bunch to get audited um against that standard. um or you have them like crazy crazy broad to the point where they're not sort of accomplishing what their goal is which is to you know up you know raise the bar for security um where I think the the the Goldilock zone is um is a like smaller lighter weight standard that uh isn't that that's opinionated enough on the security side but not bucketed into like a specific blockchain. Right? So, like to throw an example out there, um you know, if you wanted to get uh like a smart contract standard or whatever, right?

Like you might write it just for one blockchain, but you're going to have to like rewrite that thing for all the other blockchains to actually be useful, right? Um and there's going to be a lot of repetition, you know, right? All this kind of stuff. So we kind of approached it from a different point of view where we'll write broad enough standards that hit all of the different technologies to the best of our ability so that we can drive adoption a little bit better and then like reach the smaller companies that need the standards. We don't want to go through a whole suck too and pay you know 50 grand to go through hell.

Yeah, I'll give you the glass half full version of what Max was saying there which I agree with all of that. Um but this is a common misconception and I hope to bring up two points that will maybe reframe the way we think about innovation and standards. The first one being that you know the ultimate goal of standards is to increase user safety and trust. You can kind of think about it like an analogy of brakes on a car, right? If you think about what brakes on a car do, most people will say, "Well, it's to slow a car down."

But the other perspective is that well now you can drive as fast as you want, as safely as you want and and ultimately that's what standards are there to do is it's so that you can literally innovate literally as fast as you want and know that there are safety and guard rules in place. Um the second point being that you know each of the things that we've identified in these standards over the years are real world incidents or anchored to real world security incidents. Right? The tuition fee of everything that we've put in there has been paid for by the victims and builders of these protocols that have gone under because they lost it all in one hack or were impacted so heavily to the point where they couldn't operate anymore. And so all of these standards that we have basically lay that foundation, that blueprint for people to understand that they at least have a baseline safety net and then can innovate from there.

Do you want to touch on that piece or do you want to move on to the

I was going to add one one small thing. So I think what they both talked about, right? Um I probably should have added this in my intro, but my background I started as a PCI auditor. So I did used to do those very niche audits where you're looking at one very specific thing and trying to address the security of that. Um, and if you're not familiar with what a PCI audit is, that focuses on credit card data written by the credit card brands.

Um, I think you can classify audits into two buckets usually. One is opinion based and one is based. And the difference there is that opinion based places a lot of judgment and ends up being extremely high level because you're catering to a lot of different stakeholders that may not necessarily be involved in the building and the innovation part. The requirement based part is where you often see it complement innovation because nobody wants to be in a position to where you build something and you want to get it out into the market, it gets hacked and then you lose everything, right? That's what's actually going to stifle innovation.

If it fails, I think it's going to set you back, right? And we see that happen all the time with crypto. It's anytime there's a big hack, all the big banks, all the big companies, they pull back. So these standards are being written by people that are building and actually innovating in the space which I think is a beautiful thing because those requirements are being written by somebody that people that actually understand what it takes to innovate. So it's not meant to stifle innovation.

It's meant to complement it.

Great. Thank you. Um so Eric, I want to turn to you. So we have like the token integration standard something that Coinbase is the editor for. Um written it, updated it.

I if you know if I had a token I wanted to get listed and I I came to you guys and I said, "Hey, I've I've passed the assessment. I'm I'm certified for the token integration standard sort of what's the benefit for me? What what what do you what's your reaction to that? How do you guys respond at Coinbase? What's the what's the next step around that?"

Yeah, great question. And my first reaction would be, "Wow, someone actually took the time to be transparent enough with us to go through these standards, go through that audit piece, and really show us that they've followed all of these proper methods to be secure." Um well that in it of itself already establishes trust with the partner which instead of you know us taking so long doing all these security reviews going back and forth with all these questions we now are just we're we're already streamlined. We can go straight into the integration. We can go straight into the listing process itself uh once we validate that that that standard review.

And honestly, more than anything else, like I was alluding to earlier, it gives us that level of trust and transparency because at the end of the day, crypto, especially security, it's a team sport. Like our security of what we offer is underpinned by the security of our partners, right? Like we can only offer this token. We can only offer these specific products because the vendors and the partners that we work with have gone through these links to make sure that they themselves are secure as well. And we don't have to waste time figuring out what are their current security gaps.

What do they what do we need to monitor for that they don't have covered all that stuff that is all streamlined away with with being able to go through one of our reviews and being able to go through these standards and show us that you've met this bar. So it sounds like it's better trust, faster trust, and and potentially for me it's it's a faster process as well. So I'm saving time, you're building trust, we're building trust together, and it's sort of a much better process.

Yeah.

Um

Max, what do you think about the from like let's say from the node operation standard or anything else around that? Like what's the you see the benefit or or um for a potential customer or for somebody who follows some of the standards? Yeah, I think node um safety is something that is not thought about as much as like token integration or smart contract security or like that that kind of stuff. Um at the end of the day, node operation is very web two, right? Like I'm running a web 3 binary on an actual piece of compute, right?

Like it's the same thing that any other uh company does in or out of blockchain. Um so it was a little bit challenging to kind of figure out what the value of a node operation standard would be because the goal is not to rewrite um you know existing 20 or 30 years of like IT security knowledge um that's not providing any value. Um so when we started digging into it we did find that there was a lot of little things that you that could trip you up right if you're like a smaller node operator or you're like a younger company and you don't understand sort of the the the nuances of specific chains. Well, there's lots of ways that you can trip into something that's like actually quite dangerous. Um, so then like we found the niche and then we started writing it.

Um, and it's evolved since then. Um, I think it's a good sort of baseline platform to be able to communicate to the the companies that we partner with to to show that like look, Figment is sort of putting our money where our mouth is, right? We care about security. We've invested in security. not only have we like contributed to writing a standard around exactly what our our business is which is operating nodes um you know we've certified against it uh so I think it's it's a good thing for like the industry as a whole um it it would be very nice to see other sort of node operators uh adopt it even if it's like a self sort of like a self assessment a self-re I think that still goes a long way in like proving trust and and you know showing openness whoever you're working with.

That's super helpful. And I think when I think about like we've got some larger members like Anchorage and and Coinbase and we also have uh you know smaller smaller members. I mean Figment's not a giant company, right? You but you're sort of in invested in uh BSSC from the beginning. Um you know you're I think you'd said you 150 employees not not a giant thing versus Coinbase.

So it it doesn't have to be the big companies that come into the table and kind of work on this stuff. It's it it benefits everybody big and small um as well

and I think there's value in having different sized companies at the table right like um it was very obvious when we started working on the transaction uh safety or slash security standard um the way that a small company approaches that problem is very different from like how a massive company like Coinbase would approach that problem right you're you're running into different edge cases of systems design and security um so it's it's critical that you have people with the different perspectives at the table.

And so we've got now the couple the standards out. We're having new we're going to have sort of six out there some revisions and then we're we're moving towards sort of this assessment framework. Um so D tell me like Max said oh you know he'd mentioned about SOCK 2 and the huge cost around that. What's the intention sort of around this this assessment framework you've done auditing for years in different different areas. How is this different and what's sort of the intention uh around this framework?

I I think all of them kind of you can classify them in one term which is risk mitigation, right? I think that the traditional frameworks that we have right now, Max said this, we don't want to try to rewrite 30 years of IT security, right? But when you talk to regulators, when you talk to the people that actually make decisions with the money, they're not going to want to make a decision that's risky. So, how do you actually demonstrate to them that you've addressed the risk of getting into something that's honestly still considered risky? Right?

Crypto is not considered to be a safe asset to put your money into if you're a public company, a bank or a government agency, and you have a treasury, crypto is near the bottom of the list of things that you invest that money into. And that's purely because of the risk factors that are out there. So, when we think of a company that's going through an IPO and they want to address their risk factors, what is the one thing that you can do? You can take these smaller standards that are tailored towards that specific risk and say we've addressed that risk because we have this industry framework that's written by the people that built this technology and we've made our decision to invest in that and address that risk. Right?

It's not intended to replace things like socks controls ITGC's a sock to those are always going to exist. You're always going to have to do those if you want to reach that bar of going you know public and being listed on the stock exchange. But if you want to again start mitigating those risk factors and demonstrating that to the regulators and decision makers, this is one of the best ways to do that because it addresses those very very specific nuance risks that are again new because of blockchain technology and then um so I wanted to kind of I guess the question everyone talks about is sort of AI right and you know how maybe let's talk about AI and blockchain and digital assets you know when we're building the standards um say first for max and Eric like you know are are we are you thinking about AI as we're sort of building them? How are you using that tool uh in terms of the development of that um of you know of of these standards? Um yeah, I think the so like just to be frank, the whole industry is struggling with this, right?

Like we're we're we're struggling on how to like rationalize about uh an agent and what is an agent and what's the principle of lease autonomy and you know all all of these um sort of new problems have propped up. Um but they've also sort of identified a whole bunch of older problems that maybe weren't um uh you know sufficiently you know controlled for right like access control is still uh like super valuable in the whole AI world. um sandboxing and VMs is you know you just look at hugging face and and everything else right so I think there there's a lot of old security stuff that is being talked about a lot more that doesn't necessarily have sort of a home in our standards but is you know we're still participating in in that discord uh or discourse sorry um but uh we we have been looking specifically at controls um that uh reach that layer between sort of like agent and and blockchain. Um there's not a ton. We have a few controls.

They're still being workshopped, but we really want to make sure that we like strike the iron properly, right? Um and and not sort of, you know, it's it's a brand new industry. So, I guess TLDDR to actually answer the the question, it's um we're thinking about it. We have some opinions, but I think the cards still have to fall. Like, we're not quite sure what it's going to look like.

Yeah, I mean, Max pretty much hit the nail on the head there. Um, it's it's a very multifaceted problem. It's also depends on where you're at in the life cycle of the product as well as where you're at in the life cycle of where you're looking at it from security as well. Um, the the main thing I will add on to that, especially as it ties back back into our standards here, is the fact that, you know, we have this blueprint. We've already established this foundation that allows anyone whether you are a small firm or a bigger firm to follow.

And in general, by being able to meet these specific standards, you're you're generally AI proof to a certain extent. Like you're not going to be like especially for something as black and white as the token integration standard. You know, ERC20 smart contracts have been around for a while now. There's while you can add a lot of customization to them, for the most part, it's a solved problem and and for the most part, if you adhere to the specific standards and and the secure ways to build it, you're not going to be vulnerable to anything novel or zero day from from an AI system. Um, now, like I said, it's multifaceted.

there's other places within the security life cycle that AI is starting to poke holes in and that, you know, it's a game of cat and mouse where, okay, we as security researchers need to stay ahead. Um, and by staying ahead, we also fight fire with fire. Sometimes we employ our own AI agents to figure out how to secure our own systems. Um, and then that gets into a rabbit hole of like, okay, well, how do we know they're being honest? How do we make sure that with new each new model that comes out that they're still hitting the same benchmarks as the previous ones?

And so, you know, at Coinbase, we've solved this in many different ways. Each of our teams have specific use cases, especially within security. Um, and and you know, specifically under the blockchain security team, we have specific models that we like to lean on for particular tasks and then we farm out other um tasks to other sub aents that that are better at that. But again, it's this is a very open-ended problem and in general tying it back to our standards, if you adhere to our standards, it will you are in generally an AI proof uh zone. So,

so it's interesting like I when you talk about sort of the new different variances and stuff, it seems like I mean from the security industry, if you go back to web 2 and others, it's not not really any different in some respects where there's you're constantly sort of have new technologies, new ways that sort of the the bad guys are trying to get at you. This is just sort of the the new shiny latest tool to to do it. You might say it was some 20 years ago it was something else versus today it's AI as being sort of leveraged and it sounds like the the benefit is though you have some positives as well right you can use that tool to your advantage

uh to help help protect and help be more secure

right absolutely

um so Droo now but what about like on the assessment framework like are we now can can are you going to get replaced I mean are we going to just get um AI to do all the assessment frameworks and we're good to go now or we [laughter] got some time to go still.

No, I I I hope not. But I mean I I don't think that we're in a position yet where AI is going to replace any job wholly, right? I mean I think people will say that there are jobs. There's probably a list floating around somewhere on LinkedIn that says these are the 10 most secure jobs in the next two. Like I don't know what what data are they grounding that in.

Right. But this the the problem of uh I don't want to say regulating, but maybe that's the first word that pops in my head. Regulating AI and utilizing it in the best way and safest way possible isn't just a crypto problem. Isn't just a blockchain problem. It's a every industry.

It's industry agnostic, right? I mean, you think about healthcare that there's insurance companies out there now processing insurance claims using AI as that first layer of review. and your insurance claim for a medical bill might get denied because you don't meet the set criteria that the agent was trained to look for. I It's the same thing when you think about agentic payments when it's tying into the blockchain and you have these companies. Coinbase developed X42, right?

That's meant to push this innovation forward to say we want people to create automated processes, but there's still always going to be that concept of human in the loop, right? you you're going to have to have somebody there that understands the input, the output because AI is not a black box. It's being configured by somebody. And if those configurations aren't set appropriately, you introduce bias, hallucinations, all these different problems. And that's where I think these standards are going to play a play a role, right?

Is saying these are the 10 risks. Again, going back to the last answer that I had, you need to look at the risks and address those risks efficiently. And there might need to be a specific standard. And I think ISO is working on something. NIST is working on something.

you know, we're working on something. It's everyone's kind of trying to play a role in in developing something there.

That's a great answer. Um, when so, you know, Drew mentioned about risk and I think really what we've talked about a lot of the standards work is really risk mitigation, right? It allows us to do the work to build more trust in in digital assets, trust in blockchain, uh really support the market, um, and hopefully support growth of those those areas as well. Um, so we've got our set of standards. It'll be hopefully six approved soon and and our FRA frameworks in place which will be launching and people can go get certified.

Um where are their gaps still? Where where what what should where where is you guys bolstered on the tech working group for BSSC? What what's next or where are we missing in terms of addressing some of the risk areas around blockchain?

I think you can probably write standards for days to be honest. Like I think there's like a neverending um you know queue of of standards or or you know niches that are are are begging for like someone to write down what a baseline security standard um should be. I I think a lot of it is already kind of solved by the companies who are operating in those niches. They're just not um sort of expressed written down somewhere. um which kind of tilts the the the security field a little bit unfortunately to the smaller companies who are maybe just getting into that niche um or you know who are trying to evaluate how how to get into that niche and it's um that that information is sort of like hidden right because we haven't written it down so what we try to do at BSSC and the tech working group is just like throw out crazy ideas of like you know is is there merit in a stable coin standard what the heck would that look like I don't know is there is there merit in like agentic payment standards like maybe right like the whole thing is like two three months old.

Um

so I think like going through that that process I know we're going to find new niches and then you know when we're sitting at the table and and and if everyone thinks it's a good idea it's probably a good idea and then that's the trigger to start writing something put pen to paper and see what shakes out.

Yeah. Yeah, and Max touched on a on a really good point there, which is like we could burn the ocean with with going through all the different rabbit holes for all these different niche topics. Like we lightly touched on quantum, we lightly touched on like replay attacks. We've lightly touched on all these other different methods of of how to even audit them, too. Um, and and honestly what we're what we're kind of converging on is there's no one way to to really solve all of this.

Um, and and really what we want to do with the BSSC and the standards that we've published is like we want to give our auditors, we want to give people that are building the best path that we've found so far. like a an analogy that um I like to use or that I've heard one of our leaders use that that I've now stolen is treat it like a compass, not like a GPS. Like there are specific things that you can absolutely follow to the tea and if you do, it will protect you, but you know, you have your own use case, right? Like you maybe not don't need to exactly adhere or you're willing to accept a little bit of risk here because it allows you to move faster and that's okay. It's not meant to, again going back to the first question, it's not meant to stifle innovation.

It's meant to at least give you the guard rail so that you can move faster, more confidently.

And Drew, any comment on that? I know you're not in the tech working group, but like when you look at the assessment side, like are there areas that you say, gosh, I think wish BSSC would work on because this is a gap that we see in a risk factor.

No, I I mean I think these guys are doing a fantastic job writing it, right? But it goes back to what Eric was saying. It's not uh it's not risk prevention, it's risk mitigation. There's always going to be a risk of something. There's going to be a zero day vulnerability, something that an AI agent is going to go and find in two years that they're going to exploit, right?

But as long as we're educating the industry and the community on what the actual risks are that we see and how to best address them, I think we're in the right spot. We'll just have to keep evolving, right, and stay ahead of the curve.

Okay. Um so we've got couple minutes left on this. I think we're running ahead of schedule for the overall, but I'm happy to take some questions if anyone has any and if not, we'll give everyone a final word. Uh, any questions [snorts] on this while I have a minute or two?

Come on. Standards are riveting. I'm sure there's a ton of questions here. Yeah. [laughter]

You want us to ask you questions? We can see who is paying attention.

No. Um, so I but I'll let um Max and Eric and and Drew give sort of any kind of final comments, but I would just say from the BSSC standpoint, we are definitely a newer organization. We're we're sort of continuing to evolve and the more engagement we can get. We have lots of membership categories, including a free general membership category that allows people to help participate and help us shape our standards, um, which is great. And then we obviously have other paid memberships and things to have more engagement.

But the more engagement we can have, small or big companies, the better off we are and the better standards we can make. So I encourage you to check out our website and uh at blockchainsc.org uh and and consider joining and being a part of the process. But Max, any final words?

Uh yeah, I mean I think you hit the nail on the head like we we need more people to join. You know, like those different perspectives are already always great. I won't rehash everything you said because I agree with it. I would just like to pitch that like we are kind of like forwardleaning. We're it's it's still, you know, we're drafting standards.

We're talking about auditing, but like we do all of our work on GitHub, you know what I mean? Like we're we're trying to not be a boring standards uh association. Um and I think we're doing a pretty good job. So, you should definitely check us out.

We have cool t-shirts and hats and

Oh, yeah. We got standard swag. Standard swag. There you go.

Yeah. I will and I'll and I'll end on this which is just reharping on the fact that security and crypto really is a team sport. Like we need more people to bring their experiences to help us design better. We only all succeed safely by being on this plane altogether, right? Like literally any single one of these niche things could be an industry ending event potentially.

Um and and the more that we're all working together making sure their the standards are safe, up to date, accurate with the latest methods and TTPs that our threat actors are using right now, the better off everyone will be. So

yeah, I I mean I agree with everything you guys have said. I think the one thing I always the one statement I like to make is security is like trying to hit a target that's moving further and further away continuously. So the more people we have shooting at that target, the more likely we are to hit it. I think the more people we can get in, the more perspectives we can get in, um the better the community is going to be able. So

I just want to thank our panelists and uh thanks Ian everybody for having us here. We appreciate it. Thank you.