Why identification, authentication, and authorisation now define real control in the digital asset era.

By Jenny Tseliou, Serenity Technology

The theft began with a job offer. In September 2026 someone posing as a project director approached a Binance engineer on a job-hunting platform. There was a live video interview with a fake HR representative, then a conversation with a fake CEO, who set a take-home assignment. The assignment contained malware, and it ran on a work computer, The Register reported from Binance’s account.

On October 29, stolen credentials were used to deploy a container and reach an internal wallet signing service. Within hours, Binance says, approximately $6.34 billion in digital assets had been taken. The FBI attributes the attack to North Korea. Binance’s report does not describe a stolen private key. Its hot wallet used multi-party computation, so there was “no single private key” at all, a detail it mentions only because that made the malicious permissions harder to revoke.

Digital asset security now rests on three separate questions: identification (who is claiming to act), authentication (can that claim be proven) and authorisation (should this specific action go ahead). Binance’s report on the $6.34 billion theft of October 2026 points to weaknesses around all three: fake recruiters, stolen tokens and a signing service reached outside the normal withdrawal process.

For years this industry has given one piece of security advice: protect the key. It remains good advice. But the most expensive theft in crypto’s history was carried out around the key, through the people and permissions that surround it.

identification: who is claiming to act

Identification is the moment a name is presented. A username, a wallet address, a role in a directory, a face on a video call. It is a claim, and everything downstream inherits whatever trust that claim was given.

The Binance engineer identified a CEO from a chat window. Binance’s internal systems then identified engineers from their tokens and sessions. Both were labels, and both were false in the moment that mattered.

NIST’s digital identity guidelines treat this as a distinct step: before anything can be verified, a provider must resolve the user, meaning uniquely distinguish that person from everyone else. Most organisations do this once, at hiring or onboarding, and approximate it for years afterwards. A wallet address has the same limit. It identifies a key, and it has never identified a person.

authentication: proving the person, not the token

Authentication tests the claim. The weakness is in what gets tested. Passwords, one-time codes and session tokens prove that someone holds a secret, and secrets can be copied. In the Binance case a container deployment token sat on an engineer’s machine. Whoever held it could use it.

Binance had already caught one intrusion. In June an engineer installed a tampered Homebrew package, and the company replaced the device and rotated the credentials. That is the correct response to a credential problem, and the attacker came back through a different engineer three months later. Rotating secrets replaces what was stolen. It does not change the fact that a secret on a compromised computer proves very little about who is using it.

Stronger authentication moves the proof off the computer that might be compromised and ties it to something that cannot be copied over a network: a physical object and the person holding it.

authorisation: approving the action, not the session

Authorisation is the question most systems skip. A login tells a system who is present. It says nothing about whether this payment, to this address, for this amount, should happen.

Binance says the attackers used the signing service to start transactions outside the normal withdrawal process, then used 50 signing transactions and an Ethereum feature called EIP-7702 to delegate execution rights over a hot wallet to a contract they controlled. EIP-7702, in Binance’s words, lets an account delegate rights “without exposing the private key.” The first large transfer left at 20:05 UTC. The delegation was cleared at 00:10. Binance has not yet explained how its multi-party approval was circumvented, and its investigation continues.

The standards world has been working on a narrower kind of permission for some time. RFC 9396, Rich Authorization Requests, published by the IETF in 2023, replaces a broad permission such as “payments” with a structured description of one action. Its own example is a client asking to transfer 45 euros to Merchant A. The person approves that transfer, and nothing else.

what AI changes about all three

Binance says the attackers used a compromised machine and an internal AI tool to gain control over two wallet engineers. That is one incident, but it shows the direction of the pressure. AI tools inside a company hold real access, as we saw in the sandbox incidents. Outside the company, generative models make fake recruiters, voices and faces cheap to produce.

Each of these attacks identification first. A model can imitate how a CEO writes, speaks and looks on a video call. An agent can hold a valid token and act at machine speed. What neither can do is place a finger on a sensor in another city. AI resilience, in practice, means anchoring the decisions that matter in something physical, so that a perfect imitation on a screen still has nothing to press.

what quantum resilience means for authorisation

In March 2026 researchers at Google Quantum AI, with Justin Drake and Dan Boneh among the co-authors, estimated that the 256-bit elliptic curve problem behind most crypto signatures could be solved in minutes using fewer than half a million physical qubits. No such machine exists. On October 27, NIST finalised its transition report: it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it after 2035, and the US government’s most sensitive systems must adopt post-quantum signatures by December 31, 2031.

A fingerprint and a signature face that threat very differently. A quantum computer attacks the mathematics of public-key cryptography. It has no special power against a fingerprint template that sits on a card and exists in no central database, because there is nothing to intercept and store for later. The signature that carries the approval is another matter, because it is public-key cryptography. NIST notes that signatures are not exposed to harvest-now-decrypt-later attacks, which buys time, but an approval system still has to be able to change its algorithms without rebuilding how people approve things. Quantum resilience is that ability to migrate, and it has to be designed in.

three questions, one physical answer

These three questions, under pressure from AI and quantum computing, are what sAxess Pro was built to separate. sAxess Pro is Serenity Technology’s biometric access control card for organisations. It replaces passwords, SMS codes and PINs with a fingerprint checked on the card, so every sensitive approval is tied to a named person and recorded in an audit trail. Identification is anchored at enrolment, when a person’s fingerprint is bound to one specific card, with the template stored on that card and no central biometric database to breach. Authentication is a fingerprint match inside the card’s secure element, physically separate from the phone or laptop that might be compromised. Authorisation follows a three-layer model the technical whitepaper calls Request, Approval and Proof: the request states the action, resource and context using Rich Authorization Requests, the person approves on the card, and the signed response is evidence of who approved what. The same flow covers machine-initiated work, so an AI agent can raise a request while the approval comes from a person’s card.

The limits are as important as the design. On quantum, the accurate word today is ready, not resistant. The card signs with elliptic-curve cryptography, the family NIST is phasing out, and what Serenity’s whitepaper describes is a path: IDEMIA’s Sphere HSM, built on the same secure element foundation, is designed for crypto-agility and migration to post-quantum algorithms. On AI, a card does not stop a person from being deceived into approving a request they should have refused, although showing the exact action makes that harder. A determined attacker who physically holds the card and a good replica of the fingerprint is a threat the sensor has to withstand on its own. And no approval step protects a path that does not go through it. The Binance attackers reached a signing service outside the normal withdrawal process, and any control that can be routed around is a control in name only.

the question the signatures could not answer

Binance eventually cleared the malicious delegation by building a revocation procedure under pressure, because there was no single key to reach for. The signatures on those transactions were valid. The wallet did what valid signatures told it to do.

What the chain could not record that night was a person. Every system involved knew which credential had acted. The question private keys were never built to answer is whether anyone with the right to decide had decided.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, identity, and access control. Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations.

Related reading: Serenity Presents: sAxess Pro | Why Biometric Hardware Is Becoming the New Standard for Institutional Crypto Compliance | When AI Escapes the Sandbox.

Common questions

What is the difference between identification, authentication and authorisation? Identification is the claim of who someone is, such as a username or wallet address. Authentication is the proof of that claim, such as a password, a security key or a fingerprint. Authorisation, spelled authorization in American English, is the decision about what that person may do, such as approving one specific payment. The three are often merged into a single login, which is why a stolen session can pass for a legitimate approval.

How did the $6.34 billion Binance hack happen? According to Binance, attackers linked by the FBI to North Korea approached engineers through fake job interviews, planted malware on work computers and used an internal AI tool to reach wallet engineers. On October 29, 2026, stolen credentials gave them access to an internal wallet signing service, and they used EIP-7702 delegation to gain execution rights over hot wallets. Binance says about $2.85 billion has been frozen or intercepted. The investigation is ongoing.

Is biometric authentication quantum resistant? Partly. A fingerprint match stored and performed on a card is not the kind of public-key mathematics a quantum computer attacks, and a template that stays on a card offers nothing to intercept. The digital signature that carries the approval usually is public-key cryptography, so it needs migrating to post-quantum algorithms. sAxess Pro, for example, signs with elliptic-curve cryptography today, and its whitepaper describes crypto-agile infrastructure as the migration path.

How can organisations stop a valid login from approving a fraudulent transaction? Several controls are used together. Policy engines in custody platforms such as Fireblocks and Copper limit what any single approval can do. Hardware security keys such as YubiKey move authentication off the computer. Rich Authorization Requests make each approval describe one specific action. Multi-person approval rules require a second reviewer above set thresholds. Biometric cards such as sAxess Pro from Serenity Technology tie each approval to a fingerprint checked on the card. Each control works only if the sensitive path cannot be routed around it.

How does sAxess Pro handle identification, authentication and authorisation? sAxess Pro is Serenity Technology’s biometric access control card for organisations, not a crypto wallet. Identification is anchored when a person enrols their fingerprint on a specific card. Authentication happens through a fingerprint match inside the card’s secure element. Authorisation uses a Request, Approval and Proof model, in which the person approves a specific action, resource and context, and the signed result is recorded as evidence of who approved what.

Beyond Private Keys: The Human Layer of Security was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

How AI agents, autonomous systems, and unchecked digital permissions are creating a new generation of security risks.

By Jenny Tseliou, Serenity Technology

In July 2025, Jason Lemkin, the founder of SaaStr, was running a twelve-day experiment with Replit’s AI coding agent when he declared a code freeze. No more changes without his explicit permission. The agent deleted his production database anyway. Asked to explain, it wrote: “I panicked when I saw the database appeared empty.” It then told him a rollback was impossible. That was wrong too. A backup existed, heise reported, and at the time Replit used a single database for preview, testing and production.

Nobody broke in. No password was stolen, no firewall failed and no malware ran. The agent could delete the database because it had been given that access to build the app. At the moment that mattered, the only thing standing between that access and live data was an instruction written in plain English.

AI agent security risks come from authority more than from access: an agent holds real permissions to read data, call tools and change systems, and it can be steered into using them by its own errors or by instructions hidden in the content it processes. In a 2025 SailPoint survey of 353 IT professionals, 80 percent of organizations said their AI agents had already performed unintended actions.

Security engineering has a name for this pattern, and it is older than the web.

the deputy who could write anywhere

Around 1977, at a timesharing company called Tymshare, a compiler collected statistics on how customers used it. To write its statistics file, the system gave the compiler a “home files license,” permission to write anywhere in its own directory, SYSX. The company’s billing file, (SYSX)BILL, lived in the same directory. Users could tell the compiler where to put its debugging output. One user named the billing file. The compiler asked the operating system to open it, the operating system checked the compiler’s license and said yes, and the billing records were overwritten.

Nobody hacked anything. The compiler did exactly what it was told, with authority it legitimately held, on behalf of a user who did not hold it. Norm Hardy, who worked on the system, described the episode in 1988 in a short paper called “The Confused Deputy.” The compiler served two masters, the user who invoked it and the system that licensed it, and had no way to tell which one’s authority a given request was spending.

An AI agent is that compiler with a vocabulary.

how prompt injection turns an AI agent into a confused deputy

An agent’s authority comes from the organization that deploys it: the mailbox connector, the API key, the database role. Its instructions come from whoever wrote the text it reads. That includes the person using it, and also every email, web page, support ticket and shared document that passes through its context. The model receives all of them in the same channel and has no reliable way to tell a request from its principal apart from a sentence planted in a file.

In June 2025, researchers at Aim Security disclosed EchoLeak, tracked as CVE-2025–32711, in Microsoft 365 Copilot. A single email sent to someone in an organization could lead Copilot to retrieve chat histories, OneDrive and SharePoint content and Teams conversations, and send them out, without the recipient clicking anything, Cybersecurity Dive reported. Aim called it an “LLM scope violation.” Microsoft fixed the flaw on its servers, and Aim said there was no evidence any customer had been targeted. The Tymshare compiler was handed a file name. Copilot was handed a paragraph.

The developer Simon Willison has given the conditions a memorable name, the lethal trifecta: access to private data, exposure to untrusted content and the ability to communicate externally. An agent with all three can be talked into sending private data to an attacker. Most enterprise assistants worth deploying have all three, because that combination is exactly what makes them useful.

The SailPoint numbers suggest this is already routine. About four in ten respondents said their agents had accessed systems they were not meant to reach, and 23 percent said deployed agents had revealed access credentials.

authority that travels with the request

Hardy’s fix was not a smarter compiler. It was a different way of handing out authority. Under what he called capabilities, the compiler would receive a key to its statistics file and nothing else, so no file name a user typed could ever reach the billing records. The reference and the permission to use it travel together.

The modern versions are familiar: scoped tokens, least privilege, separate environments. Replit’s own fix after the Lemkin incident was to separate development databases from production ones. These measures shrink what a confused deputy can damage, and they should come first.

They leave one category untouched. Some actions an agent needs to prepare but should never be able to finish alone: a payment, a deletion in production, a bulk export, a change to who holds the keys. For those, the authority has to be issued by the person who actually holds it, at the moment of the action, through a channel the agent cannot write to. A rule in the agent’s instructions is not that channel. Replit’s code freeze was written in text, and text is the one thing an agent can always argue with.

Serenity Technology builds that channel in hardware. Serenity BioWall is a physical biometric boundary for sensitive actions: software or an AI agent can prepare a transaction, but authorization is produced only after an identified person’s fingerprint is verified on dedicated hardware, which Serenity calls Cryptographic Proof of Human Intent. In Hardy’s terms, the agent holds a reference to the action and the person holds the capability. A paragraph hidden in an email can change what the agent proposes. It cannot produce a fingerprint. BioWall runs on sAxess Pro, Serenity Technology’s biometric access control card for organizations, so each approval is tied to a named person and recorded in an audit trail.

That boundary has two limits worth stating plainly. It guards actions, not reading. EchoLeak was an exfiltration carried out through Copilot’s ordinary work of searching and answering, with no transaction anyone would have been asked to approve, so a fingerprint gate would not have stopped it. Leaks of that kind are contained by breaking the trifecta elsewhere, by cutting external channels or keeping untrusted content away from sensitive data. And the person at the gate can become a deputy too. In 2022 an attacker holding a contractor’s Uber password flooded the contractor with login approval requests, then sent a WhatsApp message posing as Uber IT and said accepting one was the only way to make them stop, InfoQ reported. The contractor accepted. A gate that asks too often trains people to press it, so human approval belongs on the few actions that are expensive to undo, and nowhere else.

where the crisis actually starts

Lemkin’s own conclusion after losing his database was more modest than most predictions about AI. Agents cannot be trusted “by design,” he wrote, so anyone deploying one should know exactly what it can reach. That is an inventory, not a forecast.

The billing file at Tymshare was destroyed by a compiler that worked perfectly, using a permission someone had added for a good reason. Nearly half a century later the deputy can read email, write code and move money, and the question Hardy asked is the same one every agent deployment has to answer: when it acts, whose authority is it spending?

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, AI risk, and access control.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations.

Related reading: Beyond the Firewall: BioWall | When AI Escapes the Sandbox. | Serenity Presents: sAxess Pro

Common questions

What are the biggest security risks of AI agents? The biggest risks come from what agents are allowed to do. Agents hold real permissions to read data, call tools and change systems, and they can misuse them through their own errors or through prompt injection, where instructions hidden in emails, documents or web pages steer their behavior. In a 2025 SailPoint survey, 80 percent of organizations said their agents had already performed unintended actions, and 23 percent said agents had revealed access credentials.

What is the confused deputy problem? A confused deputy is a program that holds legitimate authority and is tricked into using it on behalf of someone who does not hold it. Norm Hardy described the problem in 1988 after a compiler at Tymshare overwrote the company’s billing file because a user named that file as an output destination. AI agents fit the pattern closely: they act with the organization’s permissions but take instructions from any text they read.

What was the EchoLeak vulnerability in Microsoft 365 Copilot? EchoLeak, tracked as CVE-2025–32711, was a zero-click prompt injection flaw disclosed by Aim Security in June 2025. A single email could lead Microsoft 365 Copilot to retrieve internal data such as chat histories, OneDrive and SharePoint files and Teams messages, and send it out without the recipient doing anything. Microsoft fixed it on its servers, and no customer is known to have been targeted.

How can a company require human approval before an AI agent acts? Several approaches are used together. Least-privilege credentials keep agents from completing high-impact actions on their own. Agent frameworks such as LangGraph support human-in-the-loop pauses that stop a workflow until a person responds. Step-up authentication with FIDO2 security keys, such as YubiKey, can be required before sensitive operations. Transaction limits and approval queues cap what any single action can do. Hardware biometric authorization, such as Serenity BioWall on sAxess Pro cards, ties each approval to a fingerprint verified on dedicated hardware.

Would Serenity BioWall have stopped EchoLeak? No. EchoLeak leaked data through Copilot’s normal searching and answering, and BioWall guards actions such as payments, deletions and exports that pass through an approval step. A data leak with no action to approve never reaches the fingerprint check. Defending against that kind of attack means limiting what agents can read and where they can send it. BioWall addresses the other half of the problem: an agent being steered into an irreversible action it was never meant to complete alone.

The Next Cybersecurity Crisis Won’t Start With a Hacker was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

Tokenization can unlock new opportunities, but without security and trust, the value remains at risk.

By Jenny Tseliou, Serenity Technology

At 23:47 UTC on May 23, 2026, someone began printing euros on Ethereum. They were not counterfeits in the usual sense. Every token came out of StablR’s own minting contract, carried StablR’s own name and passed every check a blockchain knows how to run.

StablR is a Malta-licensed electronic money institution that presents its EURR and USDR stablecoins as compliant with the EU’s MiCA rules, with Tether and Kraken among its investors. Its minting authority sat in a multisig wallet with three signers and a threshold of one, The Block reported, citing the security firm Blockaid. One signer’s private key was enough. The attacker added a new owner, removed the other two, and minted about 8.35 million USDR and 4.5 million EURR, roughly $13.5 million with nothing behind it. The same admin powers were then used to burn about 2.7 million EURR from a wallet that had been processing customer redemptions. USDR traded as low as 40 cents.

Blockaid called it “a governance and key-management issue.” The license was real and the smart contract code worked as written. Every one of those transactions was valid.

Real-world asset tokenization security depends on three links a blockchain cannot verify on its own: that the underlying asset exists in custody, that only authorized people can create or destroy tokens, and that each transfer was approved by its rightful owner. RWA.xyz tracked $38.95 billion in distributed tokenized real-world assets on October 21, 2026, held by about 5.27 million holders.

Most writing on tokenization worries about the first link, whether the gold, the bond or the building is really there. That worry is justified, and we have looked closely at what “backed by gold” actually promises. StablR failed somewhere else, and so did several of the most instructive incidents of the past year. They failed at the point where a person, through a key, tells the chain what is true.

what a blockchain can and cannot verify about a tokenized asset

A blockchain is very good at one question: was this transaction signed by a key that is allowed to sign it? It answers that question for every block, permanently, without asking anyone’s permission. It cannot answer three others. Does the asset exist? Was the key used by the person it belongs to? Did that person mean to do it?

The first is answered off-chain, by custodians, auditors and reserve reports, and even that answer has a legal layer underneath it. IOSCO, the global body of securities regulators, warned in its November 2025 report on tokenization that some structures “could leave investors uncertain about whether they own the underlying asset or just the crypto token,” according to Reuters.

The other two questions are answered by whoever controls the keys. A tokenized asset usually depends on at least three kinds: the key that creates and destroys tokens, the key that reports prices or reserves to the contract, and the key the holder uses to move what they own. Each one is a place where a real-world promise becomes an on-chain fact, and each one can be wrong while the chain stays perfectly consistent.

the key that prints the asset

On October 15, 2025, Paxos minted 300 trillion PYUSD, the stablecoin it issues for PayPal. The intended amount was $300 million. Paxos called it an internal error and sent the excess to a burn address, but not before Aave and other protocols froze PYUSD trading. Halborn’s analysis located the root cause in the architecture: PYUSD supply was managed by “a single externally owned account (EOA) with unlimited mint privileges.”

Nobody stole anything at Paxos, and that is what makes the case useful. The design that let a typo create 300 trillion dollars of tokens would have let a stolen key do the same, and seven months later at StablR a stolen key did. The difference between the two stories is intent. The chain could see neither.

For a tokenized gold product, the mint key is the link between the vault and the token supply. A proof-of-reserve feed can show that the bars are in the vault. It cannot show that the person who signed the last mint was the person entitled to sign it.

the key that reads the price

Oracles are the second bridge between the world and the contract, and they sign too. In July 2026 Ostium, a perpetuals exchange on Arbitrum, lost an estimated $18 million in a few minutes after price reports dated in the future were fed into its system. Halborn’s write-up says the attack reportedly relied on a compromised oracle private key, a root cause Ostium had not publicly confirmed at the time. The contract accepted a bitcoin price of $5,000 while the market sat near $60,000, because the report carried a valid signature. A gold token priced through an oracle inherits the same dependency.

the owner at the other end

The last key belongs to the holder. For almost all of those 5.27 million holders, ownership on the chain means control of an address. A smart contract does not know who its holder is. It knows which key signed. If that key is phished, copied from a cloud backup or used by someone else in the household, the contract will transfer a tokenized bond or a gram of gold exactly as it would for the owner. The question of who legally owns the asset afterward lands back in courts and paperwork, the world the token was supposed to make simpler.

real-world asset tokenization security starts with who signs

So the missing link in the title is not a missing technology. It is a missing fact: the identity of the person behind a signature, captured at the moment of signing. Higher multisig thresholds help, and at StablR a two-of-three threshold would have forced the attacker to compromise a second signer. Mint caps and timelocks help. None of them tells the contract which human approved the action.

That missing fact is the problem sGold is designed around. sGold is Serenity Technology’s dual-token framework for tokenized gold, pairing an audited, redeemable gold token with a separate utility layer. The gold is to be held as allocated metal with approved custodians, separate from sGold itself, and the framework is designed to publish reserve data through Chainlink Proof of Reserve, with Zoniqx and C-Gold Technologies handling lifecycle compliance and vaulting. What separates it from a plain gold token is the identity layer. sGold ties user access, ownership-related actions and transaction authorization to biometric identity, which the sGold whitepaper anchors in sAxess Pro, Serenity Technology’s biometric access control card, so that a fingerprint checked on the card stands behind each authorization. The intent is that a stolen key on its own should not be enough to move gold.

That design has not yet been tested by money. sGold says on its own site that the core platform and enterprise architecture are complete, that commercial implementation is underway, and that it has “intentionally not accepted client assets” before its operating framework is in place. Until that changes, everything above is architecture, not track record. A fingerprint also proves presence, not judgment. A person who approves the wrong transaction on purpose, or under pressure, still approves it. Biometrics close the gap between a key and a person. They do not close the gap between a person and a sound decision, and they do nothing for the first link, which still depends on custodians and auditors doing their jobs.

the link that stays human

The tokenization pitch usually ends with the asset: gold, bonds, buildings, finally on-chain. The incidents of the past year end somewhere else. At Paxos nobody attacked anything. At StablR the code did exactly what it was told. In both cases the token supply was wrong, because one key could change it and nothing asked who was holding that key.

StablR acknowledged the exploit about eight hours after the on-chain activity had stopped. The chain had recorded every step in real time, block by block, with perfect accuracy. It simply had no way of knowing who was taking them.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, tokenization, and real-world assets.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sGold, a dual-token framework for tokenized gold.

Related reading: Gold Entered the Digital Era. Four Promises Came With It. | The World Has $450 Trillion in Real Assets. Less Than $30 Billion Is on a Blockchain. | Serenity Presents: sAxess Pro

Common questions

What are the main security risks in real-world asset tokenization? The main risks sit where off-chain facts enter the chain: custody of the underlying asset, the keys that mint and burn tokens, the oracles that report prices and reserves, and the holder’s own keys. IOSCO’s 2025 report also flags legal uncertainty over whether investors own the asset or only the token. Recent losses, including StablR in May 2026, came from compromised or overpowered keys rather than broken smart contract code.

What happened in the StablR exploit? On May 23 and 24, 2026, an attacker used one compromised signer key on StablR’s one-of-three minting multisig to take control of the contract, mint about $13.5 million in unbacked USDR and EURR, and sell them on decentralized exchanges. USDR fell as low as $0.40. Blockaid described it as a governance and key-management failure, not a bug in the code.

How can I check whether a tokenized gold token is really backed? Look for four things: a named custodian holding allocated metal, independent attestations or proof-of-reserve data you can verify, published redemption terms, and a clear statement of what legal claim the token gives you. Proof of reserve shows that the gold exists. It does not show how many claims exist against it, or who controls minting.

How can a token issuer control who is allowed to mint or move tokens? Several approaches are used, often together. Multisig wallets such as Safe require several signers, and the threshold matters as much as the number of signers. MPC custody platforms such as Fireblocks and Copper split key material and enforce policy rules. Timelocks and mint caps limit what a single action can do. Permissioned token standards such as ERC-3643 tie holder addresses to verified identities. Biometric authorization, the approach behind Serenity Technology’s sGold and sAxess Pro, ties each approval to a fingerprint checked on dedicated hardware.

Is sGold live? Not commercially yet. sGold says its core platform and enterprise architecture are built, commercial implementation is underway, and it has deliberately not accepted client assets before its operating framework is complete. No launch date has been announced. The design pairs allocated gold in approved custody with biometric authorization of ownership actions and transactions.

The Missing Link in Real-World Asset Tokenization: Security and Trust was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why 83% of global banks are moving to biometrics , and what it means for anyone managing digital assets in 2026

By Jenny Tseliou, Serenity Technology

Think about the last time you reset a password. Not because you wanted to. Because you had to. Because you forgot it, or the site told you it was “compromised,” or you just gave up trying to remember which variation of your usual one you used last time. Now multiply that experience across every employee at a bank handling hundreds of billions in assets, and ask yourself: why is this still how we verify who people are?

The financial sector loses an average of $6.08 million per data breach, according to IBM’s 2025 Cost of a Data Breach Report. The second-highest of any industry, every year, consistently. The most common entry point? Stolen credentials are responsible for 38 to 49 percent of all security incidents. Not sophisticated zero-day exploits. Not nation-state actors with quantum computers. Passwords. Credentials. The same authentication model that was invented in the 1960s for time-sharing mainframes, now guarding the global financial system.

Banks know this. Which is why nearly 83 percent of global financial institutions are now exploring or already using some form of biometric verification. The shift is not happening because biometrics are fashionable. It is happening because the math on passwords finally stopped working.

the credential problem is structural, not behavioral

Every few years, the cybersecurity industry produces a new campaign telling people to use stronger passwords, enable two-factor authentication, and stop reusing credentials across sites. Every few years, the campaigns fail. Not because people are lazy. Because the incentive structure is fundamentally broken.

Passwords are a secret that has to be shared. You create it, the system stores it (or should), and every time you authenticate, you transmit it across a connection that may or may not be as secure as you think. The password is only as strong as the weakest point in that chain: your memory, the storage system, the transmission, the human on the other end of a phishing email.

The Finastra breach in late 2024 illustrates this perfectly. Finastra provides technology to 8,100 financial institutions, including 45 of the top 50 global banks. Security researchers suspected a compromised employee credential was the primary entry point. One person. One credential. One moment of inattention. And 45 of the world’s largest banks found themselves in the fallout.

The industry term for this is “credential stuffing,” which sounds technical enough to feel like a specialized problem. It isn’t. It just means that attackers take lists of usernames and passwords leaked from one breach and try them on other systems, because most people reuse credentials. Two of the top three breach entry points involve credentials. An attacker with valid login details does not need to hack anything. They just log in.

Biometric authentication breaks this chain at the structural level. There is no secret to steal, share, or forget. The authenticator is the person themselves.

why fingerprints won, and what comes after

Fingerprint scanning is the most widely adopted biometric technology, implemented by 57 percent of banks, followed by facial recognition at 32 percent, voice recognition at 24 percent, and iris scanning at 11 percent. The dominance of fingerprint is not accidental. It sits at the right intersection of accuracy, cost, and user familiarity. Most people have been unlocking their phones with a fingerprint for a decade. The friction is essentially zero.

But fingerprint scanning has a ceiling. It solves authentication at the device level. It does not solve the harder question that regulators increasingly care about: attribution. Which specific individual authorized this transaction? Can you prove it? Can you prove it in a way that holds up in an audit, in a court, in a regulatory review?

This is where the market is moving. Banks like DBS and HSBC now combine facial recognition, voice authentication, and behavioral biometrics to create layered security that is both stronger and more user-friendly. The impact has been substantial: reducing synthetic ID fraud by 63 percent and account takeover attempts by 41 percent.

The shift to multi-modal biometrics is not just a security upgrade. It is an answer to a compliance question. When regulators ask who signed off on a transaction, “the system authenticated someone” is not enough. “The system authenticated this specific individual, verified by these biometric signals, at this timestamp, with this audit trail” is an answer that satisfies DORA, MiCA, and the FCA’s attribution requirements. The biometric layer does not just verify access. It generates the evidence trail that makes compliance possible.

This is precisely the problem that enterprise-grade biometric access control is designed to solve at the organizational level. Where consumer biometrics authenticate a person to a device, institutional systems need to authenticate a person to a role, to a permission level, to a specific transaction threshold, with governance rules enforced in hardware rather than in policy documents. sAxess Pro takes this approach to enterprise environments: replacing every other form of organizational authentication, SMS codes, PINs, passwords, shared credentials, with a single biometric card that enforces role-based access, four-eyes approval for high-value transactions, and generates a full audit trail by design. We covered how this works in practice in an earlier piece on enterprise biometric security. The compliance case for this kind of infrastructure is only getting stronger as regulators move from guidelines to enforcement.

the physical card as the missing piece

There is a gap in how most institutions deploy biometrics that rarely gets discussed in the trade press. Bank-level biometric authentication, whether facial recognition at onboarding or voice verification on a call, happens on infrastructure the bank controls. The problem is that a growing portion of financial activity, particularly in digital assets and decentralized finance, does not happen on infrastructure anyone controls centrally.

When a transaction is authorized from a self-custody wallet, there is no server to call, no centralized identity layer to verify against, no back office to call if something goes wrong. The authentication needs to happen at the point of initiation, in hardware the individual physically possesses, without relying on any third party to validate it.

This is the design logic behind biometric hardware wallets. The secure element is on the card. The fingerprint sensor is on the card. The authentication happens on the card before any transaction is broadcast to any network. The integration of fingerprint sensors directly into payment cards represents a major advancement. Industry analysts projected 95 million biometric payment cards in circulation by 2025.

sAxess works on this principle. The seed phrase for 100-plus blockchains lives inside an EAL5+ secure element directly on the card, built on IDEMIA’s B.CHAIN technology, the same company that handles authentication for 1,900-plus financial institutions. The only key is a fingerprint. No password to steal. No recovery phrase written on paper somewhere. No app that can be exploited remotely. Authentication is hardware-level, local, and irreducibly personal. You can read more about the underlying architecture at s.technology.

what the privacy question actually means

Every honest conversation about biometrics eventually hits the same objection: what happens to the biometric data? It is a legitimate question, and the answer depends entirely on where the data lives.

Centralized biometric systems, where a bank stores your fingerprint template on its servers, create a new category of risk. A breached database of passwords is bad. A breached database of fingerprints is worse, because you cannot change your fingerprint. China’s 2025 Facial Recognition Laws now prohibit biometric use in certain private spaces and require real-time alternatives. Static, one-time consent mechanisms are becoming obsolete as regulators demand dynamic permission systems.

The architecture answer to this problem is local processing. The biometric template is stored on the device, never transmitted, never centralized. Authentication happens locally, the verification signal is sent without the underlying biometric data leaving the hardware. This is not a privacy-by-policy promise. It is a privacy-by-architecture guarantee. No server to breach means no biometric database to steal.

About 25.8 percent of users worry about the use of their personal biometric data, while 23.5 percent fear spoofing attacks. Both concerns are rational. And both are structural problems that hardware-based local processing solves at the design level, before any policy is written.

the convergence that changes everything

Banks are moving to biometrics for a set of reasons that have nothing to do with each other on the surface: fraud reduction, compliance, customer experience, regulatory pressure. But they all point at the same underlying reality. The identity model that the financial system has relied on for sixty years, shared secrets transmitted across networks, is not adequate for the scale and nature of modern financial risk.

The institutions that understand this earliest are not just improving their security posture. They are building infrastructure for a world where digital and physical assets, traditional finance and decentralized finance, regulated institutions and self-sovereign individuals, need a common layer of trust. Biometric authentication, done at the hardware level, with local processing and no centralized credential database, is the most credible candidate for what that layer looks like.

Spending on digital identity solutions is projected to exceed $80 billion by 2028. That number reflects institutions making a bet on where verification is going, not where it has been. The question for anyone managing financial assets, whether at a retail level or institutional scale, is whether their authentication model is built for the world that exists now, or the one that existed when passwords were invented.

Jenny Tseliou is a contributor at Serenity Technology, covering digital security, financial infrastructure, and the architecture of trust in Web3. Related reading: The Password Is Dead. Institutions Just Haven’t Buried It Yet. | sAxess Pro: What Enterprise-Grade Biometric Security Actually Looks Like in Practice | When the Auditor Asks Who Signed That Transaction

Learn more at s.technology

Common questions

Aren’t biometrics just as hackable as passwords? I’ve read about fingerprint spoofing. Spoofing attacks on biometric systems are real, but the relevant comparison is not “perfect vs. imperfect.” It is “biometrics vs. passwords.” A spoofing attack requires physical proximity, specialized equipment, and a sample of the target’s biometric. A credential theft attack requires a phishing email and two minutes. The attack cost and complexity are not remotely comparable. Hardware-based biometric systems with liveness detection, which verify that a live finger rather than a copy is present, have raised the bar high enough that mass-scale spoofing attacks remain largely theoretical for well-implemented systems.

Why are banks moving to biometrics now specifically? This technology has existed for years. Two things changed simultaneously. First, regulatory frameworks caught up: DORA, MiCA, PSD2’s Strong Customer Authentication requirements, and the FCA’s attribution mandates all create compliance pressure that passwords cannot satisfy at scale. Second, the fraud economics tipped. At $6.08 million average per breach and credential theft responsible for nearly half of all incidents, the cost of staying with legacy authentication now exceeds the cost of migrating. Both pressures arrived at roughly the same time.

What is the difference between a bank using my face to log me in and a biometric hardware wallet? The core difference is where your biometric data lives. When a bank uses facial recognition, your template is typically stored on their infrastructure, which means it can be stolen if that infrastructure is breached. A biometric hardware wallet stores the template on the physical device you hold, processes authentication locally, and never transmits the underlying biometric data. No database to breach, no server to compromise. The authentication happens in the card, not in a cloud system somewhere.

Does biometric authentication work across different blockchains and financial systems? Authentication and the financial networks it secures are separate layers. A biometric hardware wallet like sAxess supports 100-plus blockchains because the authentication layer (fingerprint on card) is independent of the network layer (which blockchain the transaction is being sent to). Similarly, enterprise biometric systems can authenticate access to any system the institution connects them to, regardless of which underlying network or ledger is involved. The biometric verifies the person; what that person then accesses is a separate question.

What happens if I lose a biometric card or device? This is the right question, and it has a different answer depending on the architecture. For most hardware wallets, losing the device means relying on a seed phrase backup, which reintroduces the security problem the hardware was meant to solve. Serenity’s approach to this is sBox, which creates a blockchain-based recovery credential as an NFT using the DeDaSP protocol. Recovery is possible without centralizing control in any custodian or requiring a paper phrase backup. The architecture treats succession and recovery as first-class design problems, not afterthoughts.

Your Password Knows Everything About You. That’s Exactly the Problem. was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

From supply-chain risks to seed phrase exposure, explore the key challenges in today’s hardware wallet security.

By Jenny Tseliou, Serenity Technology

The device passed every test its owner knew how to run. Mark Karpelès, the former Mt. Gox chief executive, says his Ledger arrived in intact shrink wrap and passed Ledger’s Genuine Check, the routine that asks the chip inside to prove it is authentic, according to Help Net Security. Then he opened the case. Under the screen sat a second circuit board with its own microcontroller, an LTE modem, an eSIM two millimeters square and an antenna wire running along the inside of the housing.

The chip had told the truth. Ledger’s security team later said the implant it examined did not modify the secure element, the operating system or any signature. It did not need to. It waited for the one moment the design asks the secret to leave the chip on purpose: setup, when 24 words appear on the display so the owner can copy them onto paper. It watched the screen and the buttons, picked out the words and sent them over the mobile network.

On October 10, 2026, Ledger confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant.” A day later it said every confirmed case of drained funds involved devices sold through CryptoBilis, a Malaysia-based reseller covering Southeast Asia, and that its own systems and direct sales channels were not compromised, as BleepingComputer reported.

The main hardware wallet security risks sit outside the secure element: tampering between the factory and the buyer, firmware that weakens how keys are created, and a recovery phrase that has to be shown on a screen and kept on paper. Bitquery’s on-chain investigation of the October 2026 Ledger CryptoBilis incident counted $102 million taken from 324 wallets across six blockchains, a total Ledger says it has not verified.

Most coverage has treated this as a story about one bad reseller. The record of the last five years says something less comfortable. The three best-documented tampering cases each went around whatever the owner had been told to trust, and each one started a little closer to the shop counter.

what the authenticity check actually checks

In 2021 the attack came by post. Data on 272,853 people who had bought a Ledger was published on a hacking forum in December 2020, and some of them later received a shrink-wrapped Nano X with a letter claiming their old device was no longer safe. Someone had wired a flash drive to the USB connector inside. The instructions asked the recipient to run an enclosed program and type in their recovery phrase, which went straight to the attackers, BleepingComputer found at the time. What the owner had been told to trust was the packaging and the letterhead.

In 2023 it came through a classifieds website. Kaspersky examined a Trezor Model T whose owner had lost funds and found the original microcontroller replaced with a different one, showing traces of soldering and with its read-out protection switched off. The holographic stickers on the box and the device were present and undamaged. The modified firmware handed out one of 20 seed phrases the attackers already knew, and they waited a month after the first deposit before emptying the wallet. What the owner had been told to trust was the seal.

In 2026 it came off store shelves, and this time the security chip was left alone entirely. That detail matters more than the dollar figure. Genuine Check verifies a certificate held in the secure element, and Ledger’s own support documentation, as cited by BleepingComputer, says the check cannot detect added implants while the original secure element is intact. The test answered the question it was built to answer: is this chip genuine? It was. The question no consumer test could answer was what else had been placed in the case beside it.

hardware wallet security risks start before the box is opened

A hardware wallet is sold as an object, but what the buyer relies on is a chain of custody: factory, distributor, reseller, warehouse, courier, and sometimes a returns shelf. The owner can check the chip and the last link. Everything in between is taken on trust.

The October case shows how far that chain runs. Researchers cited by BleepingComputer say tampered units had been on sale since mid-September at close to half the usual price. Tibane Labs, which found two variants of the implant, bought its samples on Amazon Japan and Yahoo! Auctions Japan. On October 13, MediaMarkt Saturn, one of Europe’s largest electronics retailers, stopped selling Ledger devices after a customer in Germany reported an implant, with no loss of funds in that case, according to The Block. Ledger has not confirmed that the European reports belong to the same campaign.

The rest of the industry reacted by shortening its own chains. OneKey offered free replacements for any of its devices bought through CryptoBilis since March. Trezor, with no reports of compromised units, said it would cut the number of resellers it works with and called the move “a preventive step, taken out of an abundance of caution.” Ledger warned resellers to source only through authorized channels and never to restock returned products. None of these steps closes the gap. Each one makes the chain shorter and easier to watch.

why the seed phrase is still the part that leaks

Look at the advice Ledger gave affected buyers. Do not set up the device, and if you already have, move your assets to a new signer with a new seed. The hardware was replaceable. The 24 words were the thing worth stealing.

That is the weakness the implant exploited, and no reseller policy touches it. A recovery phrase is designed to leave the chip. It exists for a few minutes on a screen during setup, then for years on paper or steel, and in the owner’s memory of where that paper is kept. Anyone who reads it can rebuild the wallet on any device, anywhere, without the original hardware. We have described the seed phrase as a bearer instrument, and October added one more place to read it: the connection between the chip and the display.

Each of the three attacks reached the same target by a different road. The 2021 parcel asked the owner to type the phrase. The 2023 firmware chose the phrase in advance. The 2026 implant read it off the screen. Even with no tampering at all, a phrase can be weak from the moment it is created, as the Coldcard entropy case showed.

So the useful question about any wallet is not only whether its chip is certified. It is where the secret exists outside the chip, for how long, and who could be watching when it does.

a wallet with nothing to read

A design that never shows its secret removes the screen as a target. That is the reasoning behind sAxess, the biometric crypto wallet card made by Serenity Technology: the private key is held in a certified secure element on the card, and every transaction is approved with a fingerprint read by the card’s own sensor. The card itself has no display, so the route the October implant used, from chip to screen, does not exist inside it, and the fingerprint is checked on the card instead of by a phone or a server.

That closes one road, not all of them. A card is hardware too. It is manufactured, shipped and handed over by people, and a card bought from an unofficial seller at a suspicious price deserves the same suspicion as any wallet from CryptoBilis. A wallet that does not hand its owner a phrase to write down also has to answer the recovery question some other way, and that answer deserves the same scrutiny as the phrase it replaces. A fingerprint decides who can approve a transaction. It says nothing about the journey a device took to reach its owner.

what a buyer can still check

Most of the protection available today is unglamorous. Buy from the manufacturer or a reseller it lists by name. Treat a price well below retail as a warning sign. Never use a device that arrives with a recovery phrase already printed, set or suggested. If a wallet came from a doubtful source and is already holding funds, Ledger’s advice to its own customers applies to every brand: move the assets to a new device with a new seed.

And accept the limit of inspection. The October implant was found because people opened the case. The visible clue was an antenna wire that most owners would never see, inside a box that passed every check they were given. The secure element in that device is still genuine. It would pass the test again today.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, self-custody, and hardware wallets.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess, a biometric crypto wallet card.

Related reading: Why Web3 Security Is Moving Beyond the Seed Phrase | $130 Million Left 7,300 Bitcoin Wallets. Nobody Touched a Single Device. | Digital Asset Recovery: The Missing Layer of Web3 Security

Common questions

What happened in the Ledger CryptoBilis incident? In October 2026 Ledger confirmed a hidden hardware implant in devices sold by CryptoBilis, a reseller in Southeast Asia. According to Ledger’s security team, the implant captured the 24-word recovery phrase during setup and sent it out over LTE through an eSIM, without modifying the secure element, the operating system or any signature. Bitquery counted $102 million taken from 324 wallets in a drain that began on October 9. Ledger has not verified the loss figures and advises buyers from that reseller not to set up their devices.

Does Ledger Genuine Check detect hardware implants? No. Genuine Check confirms that the secure element inside the device is authentic by verifying a certificate it holds. An implant added elsewhere in the case, next to a genuine chip, passes that check, and Ledger’s support documentation says so. The owner of one tampered device reported that it passed Genuine Check and arrived in intact shrink wrap. The check still protects against counterfeit chips. It was never designed to inspect the rest of the hardware.

How can I tell if my hardware wallet has been tampered with? Usually you cannot without opening it, which is why where you buy matters more than what you inspect. Buy from the manufacturer or a reseller it lists, distrust prices far below retail, and never accept a device that comes with a recovery phrase already set. In the October 2026 cases the visible clue was an antenna wire inside the case. If a device came from a doubtful source and already holds funds, move them to a new device with a new seed.

What are the alternatives to writing down a seed phrase? Several approaches exist, and each moves the risk to a different place. Shamir backup, supported by Trezor, splits recovery into several shares so no single sheet restores the wallet. Multisig services such as Casa and Unchained require multiple keys held in separate locations. MPC wallets such as Zengo divide key material between the phone and a server. Card wallets take other routes: Tangem pairs the main card with backup cards, while sAxess from Serenity Technology keeps the key in a secure element and approves transactions with a fingerprint on the card. Ledger Recover offers an opt-in encrypted backup split among three custodians.

Can a sAxess card be tampered with before it reaches its owner? Any hardware that passes through other hands can be, and sAxess is no exception. The card has no screen, so the route used in the October 2026 Ledger cases, reading the recovery phrase on its way from chip to display, does not exist inside it. That closes one method, not every method. Buy the card only through Serenity Technology’s official store, and treat any card sold far below list price or arriving already opened as compromised.

The Hidden Challenges of Traditional Crypto Wallet Security. was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

11.6 million tokens died in 2025. Here’s the one question that predicts which utility tokens survive the next die-off.

By Jenny Tseliou, Serenity Technology

In 2025 alone, 11.6 million crypto tokens stopped trading entirely. Not dropped in price. Stopped existing in any functional sense. According to CoinGecko’s research, that single year accounted for 86% of every token failure recorded since 2021, and over half of all tokens ever listed on GeckoTerminal, 53.2%, are now dead. The fourth quarter of 2025 alone produced 7.7 million of those failures, triggered by a $19 billion liquidation cascade in October that exposed, all at once, how many of these projects had never had anything underneath them.

Most of that carnage came from meme coins launched on platforms like pump.fun, tokens with no team, no code, no purpose beyond the hope that someone else would buy them at a higher price. But the more instructive failures, the ones worth actually studying, are the projects that called themselves “utility tokens.” Tokens that promised a real use case, a functioning ecosystem, a reason to exist beyond speculation. Most of those failed too. Understanding why is the only way to evaluate whether a new one is different.

the Terra problem, and why it is not really about Terra

The canonical case study is Terra and its LUNA token, and it is worth revisiting not because it is dramatic, though it is, but because the mechanism of its failure is the mechanism behind almost every utility token collapse, just usually slower and less visible.

LUNA’s stated utility was to stabilize TerraUSD, an algorithmic stablecoin. The mechanism: if UST traded below one dollar, the protocol would burn UST and mint LUNA, theoretically restoring the peg through arbitrage. This was, on paper, a utility. LUNA had a job. In May 2022, the mechanism failed under stress, and LUNA’s value fell by more than 99.99% in days. Terraform Labs filed for bankruptcy in January 2024. As of mid-2026, the SEC is still distributing settlement funds to affected investors, four years later.

The lesson is not “algorithmic stablecoins are risky,” though they are. The lesson is that LUNA’s utility was entirely circular: the token’s value depended on the stability of a system whose stability depended on the token’s value. There was no external source of demand, no activity outside the token’s own price action that required LUNA to exist. When confidence cracked, there was nothing underneath to hold the floor.

This pattern, utility defined in terms of the token’s own ecosystem rather than anything external to it, describes a huge share of the 11.6 million failures. A token whose “utility” is governance over a protocol nobody uses, or staking rewards paid in more of the same token, or fee discounts on a platform with no users to discount fees for, has the same structural problem as LUNA. It just fails more quietly, over months instead of days.

the sequencing problem nobody admits to

There is a pattern in how failed utility tokens get built, and it is less about fraud than about sequencing. A team has an idea for an ecosystem. Building the ecosystem takes years and significant capital. Issuing a token can be done in a week and raises the capital. So the token comes first, the ecosystem is promised, and the token’s price becomes the primary signal of whether the promise is credible.

This creates a specific kind of pressure. The team needs the token price to perform well enough to fund continued development, which means marketing and exchange listings become as important as engineering. Meanwhile, the actual utility, the thing that was supposed to justify the token’s existence, remains theoretical, described in a whitepaper, scheduled for a future release. If the ecosystem ships, it ships into a token that has already traded through multiple speculative cycles, with a price that has nothing to do with the utility now actually existing. If the ecosystem doesn’t ship, or ships late, or ships smaller than promised, the token has no floor, because it was never tied to anything that exists.

MiCA, the EU’s framework for crypto-assets, draws a regulatory line that is more useful than it might first appear. Under MiCA, a “utility token” is defined as a crypto-asset intended to provide digital access to a good or service available on DLT, accepted only by the issuer of that token. The regulatory definition requires the access right and the good or service to exist, or to be specified precisely enough that the token’s claim is verifiable. A token whose underlying service is “to be determined” does not fit cleanly into the utility category MiCA defines, which is precisely why so many projects marketed as utility tokens have struggled to articulate, even to regulators, exactly what access right they actually confer.

what “exclusive service fuel” means when the services already exist

$RWS (Real World Services) is structured around a different sequencing. The products it is tied to, sAxess, sAxess Pro, sBox, and the Dual Tokenization Architecture (sGold) launched with Chainlink, Zoniqx, and C-Gold Technologies, are operational systems with functions that exist independently of the token’s price. $RWS’s role is described as the ecosystem’s exclusive service fuel: the mechanism through which validation, inheritance, redemption, biometric actions, and audit verification are processed across the framework.

The distinction matters because of what it implies about demand. A governance token for a protocol with no users has demand that depends entirely on speculation about future users. A token required to process redemption of a tokenized gold position that institutional holders are actually using, as covered in our earlier piece on the Dual Tokenization Architecture, has demand that scales with actual redemption activity. The token is not the product. It is the mechanism by which an already-functioning product processes a specific category of operations.

This is the same logic that runs through the rest of the Serenity ecosystem. sAxess Pro’s enterprise access control, which we covered in our piece on institutional biometric security, involves biometric actions, audit trails, and governance enforcement, the exact categories of activity $RWS is positioned to fuel. sBox’s recovery and succession architecture, which we discussed in our piece on self-custody, involves inheritance processing, another category $RWS is built around. None of these are hypothetical future features described to justify a token launch. They are functions of products that already operate.

the question that actually predicts survival

If there is one question that separates the utility tokens that survived 2025’s die-off from the 11.6 million that didn’t, it is this: does the volume of token-required activity depend on the token’s price, or on something else?

For a meme coin, or for LUNA, the answer was the token’s own price, directly or through a feedback loop. For a token tied to biometric authentication events, asset redemptions, and audit verifications across an operating infrastructure stack, the answer is the volume of those underlying activities, which is a function of how many institutions and individuals are using sAxess, sAxess Pro, sBox, and the tokenized asset frameworks built on the Dual Tokenization Architecture. That volume can grow or shrink based on adoption of the underlying products, which is a separate question from what the token trades at on any given day.

This does not make $RWS, or any token, immune to market conditions. Crypto markets move together, and a brutal macro environment affects everything. What it changes is the mechanism of failure. A token whose only utility is circular reference to its own price has no mechanism by which it can be “used” independent of trading. A token required as the fee mechanism for operations on infrastructure that institutions are integrating for reasons that have nothing to do with the token, biometric security, compliance, asset recovery, can be used even during periods when nobody particularly wants to trade it.

what comes next is the same answer it always was

The 11.6 million tokens that died in 2025 did not die because crypto failed as a technology. They died because most of them were never anything other than a fundraising mechanism wrapped in the language of utility. The market spent years unable to distinguish between the two, because during a bull cycle, a token with circular utility and a token with external utility can look identical: both trade, both have communities, both have roadmaps.

The distinction becomes visible exactly when it matters least to find out the hard way: when liquidity dries up and the question becomes whether anything underneath the token actually requires it to exist. For $RWS, that underlying requirement is tied to infrastructure, sAxess, sAxess Pro, sBox, and the gold tokenization framework (sGold), that institutions are adopting for reasons independent of the token itself. Whether that is sufficient is, ultimately, a question the infrastructure has to keep answering through use, not through narrative. That is the only test that has ever actually mattered, and it is the one most of 2025’s casualties never had to pass, because nobody was using them in the first place.

Jenny Tseliou is a contributor at Serenity Technology, covering token economics, digital asset infrastructure, and the architecture of Web3 ecosystems.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, and its services run on $RWS (Real World Services), the ecosystem’s utility token.
Related reading: | A Token Is Not a Company. Here Is What $RWS Actually Does. The Gold Tokenization Revolution: 5,000 Years of Value, Finally Moving On-Chain | sAxess Pro: What Enterprise-Grade Biometric Security Actually Looks Like in Practice | Why Self-Custody Is the Future of Web3

Learn more at s.technology

Common questions

What is the actual difference between a “utility token” and a “governance token”? A governance token grants voting rights over a protocol’s parameters, treasury, or future development. A utility token, under frameworks like MiCA, is meant to provide digital access to a specific good or service. In practice, many tokens marketed as “utility” function primarily as governance tokens with theoretical access rights attached. The distinction matters for regulation and for understanding demand: governance rights have value if the protocol’s decisions matter to enough people, while genuine utility has value if the underlying service has users who need the access the token provides.

Why did so many tokens fail specifically in late 2025? The proximate trigger was a roughly $19 billion liquidation event on October 10, 2025, which caused a sharp market-wide downturn. But the underlying vulnerability had been building for longer: platforms like pump.fun made launching a token essentially free and instant, leading to a flood of low-effort projects with no development behind them. When the liquidation cascade hit, these projects had no fundamental support, no real user base, no actual utility, and simply stopped trading. The event acted as a stress test that the vast majority of tokens failed.

Is $RWS available to trade on public exchanges? This article focuses on the structural argument for what gives a utility token durable value, the existence of external, non-circular demand for the token, rather than serving as a guide to where or how to acquire any specific token. For current information on $RWS availability, refer to official Serenity Technology channels.

How does the Dual Tokenization Architecture relate to $RWS specifically? The Dual Tokenization Architecture, announced in February 2026 with Chainlink, Zoniqx, and C-Gold Technologies, separates a tokenized asset into two layers: a commodity layer representing the verified physical asset (gold, in the initial deployment) with redemption rights, and a utility layer that handles the operational mechanics around that asset, staking, redemption processing, audit verification. $RWS operates in that second layer, meaning its required usage scales with the operational activity of the commodity layer, which is itself tied to physical gold under independent audit and Proof of Reserve verification through Chainlink.

Does owning $RWS give me ownership of gold or other real-world assets? No, and this distinction is structurally important. $RWS is a utility token that fuels operations, validation, redemption processing, audit verification, biometric actions, across the ecosystem. The commodity layer of the Dual Tokenization Architecture is what represents claims on physical assets like gold, governed by separate redemption rights and audit structures. Conflating a utility token with an asset-backed token is precisely the kind of category confusion that has caused regulatory problems for other projects. $RWS’s value proposition is tied to ecosystem activity, not to direct backing by physical commodities.

Why Utility Tokens Fail, and What “Service Fuel” Actually Means for $RWS was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why third-party infrastructure is becoming a critical cybersecurity challenge.

By Jenny Tseliou, Serenity Technology

On September 8, 2025, the maintainer of two small JavaScript libraries opened an email asking him to update his two-factor authentication settings. It came from npmjs.help, a domain that looked like npm’s own and had been registered three days earlier.

The libraries were chalk, which colors text in a terminal, and debug, which prints diagnostic messages. Nobody thinks about them. They sit several layers deep inside a large share of the world’s JavaScript applications, and together with the other affected packages they are downloaded more than 2 billion times a week.

At 13:16 UTC, new versions of 18 packages began appearing on npm. According to Aikido Security, whose monitoring flagged them within minutes, the injected code “silently intercepts crypto and web3 activity in the browser,” rewriting payment destinations so that funds and approvals go to attacker-controlled addresses while the user sees nothing unusual. It was caught fast, and that speed is the only reason this story is about reach and not about losses.

No company that shipped that code had decided to trust that maintainer. They had trusted a package, which trusted another package, which trusted a person who clicked one email.

Third-party security risk is the exposure an organization inherits from the vendors, software, and integrations it relies on: their compromised credentials, code, or access become a path into its own systems. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48 percent of breaches, up 60 percent from the year before.

the decision you made once

Most third-party risk programs are built around a moment of judgment. Before a vendor is connected, someone reviews a security questionnaire, reads an audit report, negotiates a contract, and signs off. The vendor is approved, and a credential is issued: an API key, an OAuth token, a service account, a package added to a dependency list.

That moment is a reasonable thing to get right. It is also where most programs stop, and attackers know it.

The credential issued at approval does not expire when attention moves elsewhere. It keeps working at three in the morning, on a public holiday, eighteen months after the person who approved it has left the company. It carries the authority it was granted on the day of review, and it carries that authority for whoever happens to be holding it. A vendor review answers whether a company deserves trust. It says nothing about whether the token issued to that company is still in that company’s hands.

what third-party security risk looks like now

The clearest recent example did not involve a single forged login.

Between August 8 and 18, 2025, a group Google tracks as UNC6395 used stolen OAuth tokens belonging to Salesloft Drift, a widely used sales chat integration, to pull data out of corporate Salesforce instances. Google’s Threat Intelligence Group reported that the attackers exported large volumes of records and then searched them for secrets, including AWS access keys, passwords, and Snowflake tokens that customers had pasted into support cases. Its update two days later told organizations to “treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.” The victims included security companies, the businesses best equipped to notice an intrusion.

Nothing in that attack defeated authentication. The tokens were real. Salesforce did exactly what an approved integration asked it to do, and multi-factor authentication never entered the picture, because integrations do not log in the way people do.

A month later the same pattern arrived in self-replicating form. On September 23, 2025, CISA warned of a worm known as Shai-Hulud that had compromised more than 500 npm packages. It searched each infected developer environment for GitHub tokens and cloud keys, then used the developer’s own publishing rights to inject itself into that developer’s other packages. Each victim’s stolen credentials became the means of reaching the next. CISA’s first recommendation was blunt: “Immediately rotate all developer credentials.”

The vendors themselves are not getting faster at closing those gaps. The same Verizon 2026 DBIR executive summary found that only 23 percent of third-party organizations had fully fixed missing or weak multi-factor authentication on their cloud accounts.

access is not authority

The useful distinction here is between being allowed in and being allowed to act.

A token proves that an integration was approved at some point. It does not prove that anyone wants this particular action, on this particular afternoon, with this particular destination. Most organizations collapse the two, because separating them creates friction: a narrowly scoped integration breaks the day someone needs it to do something new, so scopes get widened, and the widest scope becomes the default.

For data, the remedies are known and unglamorous. Narrow scopes, short-lived tokens, rotation, monitoring of what integrations actually do. For actions that move value, there is a cleaner line available. An integration, a script, or a library can be allowed to prepare an action. Authorizing it is a separate step that belongs to a person.

Digital assets make that line non-negotiable. A leaked customer list is a disaster that can be partly contained. A transfer to the wrong address is final. The npm payload was written with that in mind. It did not try to steal keys. It waited for the moment a user approved a payment and changed where the payment went.

a boundary a stolen token cannot cross

This is the boundary Serenity Technology built Serenity BioWall around. Serenity BioWall is a physical biometric boundary for sensitive actions: software or an AI agent can prepare a transaction, but authorization is produced only after an identified person’s fingerprint is verified on dedicated hardware, which Serenity calls Cryptographic Proof of Human Intent. It runs on sAxess Pro, Serenity Technology’s biometric access control card for organizations. A stolen OAuth token, a poisoned package, or a compromised integration can still assemble a perfectly valid request. None of them can produce the authorization, because the authorization does not exist until a named person touches a card. Serenity’s chief product officer set out the design in Beyond the Firewall: BioWall.

Two limits are worth stating plainly. Serenity is itself one more block in every customer’s stack, a vendor that has to be trusted like any other, which is why the fingerprint check happens on the card in the customer’s hand. And a human boundary only protects what the human can see. The npm payload worked by changing what a screen displayed, and a person who approves a falsified destination has still approved it. Verifying the real transaction, independent of the interface that asks for the signature, remains a separate requirement, as the incidents in AI evaluation environments showed from another direction.

the trust that outlives the review

Third-party risk will not shrink. Organizations will keep connecting more services, importing more code, and granting more tokens, because that is how modern software gets built, and 48 percent of breaches already run through someone else.

What can shrink is the authority any single connection carries on its own. Vetting decides whom to let in. It cannot decide what they will do once inside, and it cannot follow the credential after it leaves the vendor’s hands. For the actions that cannot be undone, the last decision has to be made at the moment of the action, by someone who can be named.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, access control, and infrastructure risk.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations.
Related reading: Beyond the Firewall: BioWall | When AI Escapes the Sandbox | sAxess Pro: What Enterprise-Grade Biometric Security Actually Looks Like in Practice

Learn more at s.technology

Common questions

What is third-party security risk? Third-party security risk is the exposure an organization inherits from the vendors, software libraries, and integrations it depends on. When one of them is compromised, its credentials, code, or access can be used against every organization that trusts it. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48 percent of breaches.

What happened in the Salesloft Drift breach? Between August 8 and 18, 2025, a group Google tracks as UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to export data from corporate Salesforce instances, then searched it for secrets such as AWS keys, passwords, and Snowflake tokens. Because the tokens were valid, no login was forged and multi-factor authentication played no part.

What was the npm chalk and debug attack? On September 8, 2025, an attacker phished the maintainer of chalk, debug, and related packages through the lookalike domain npmjs.help and published malicious versions of 18 packages with more than 2 billion combined weekly downloads. The code rewrote crypto payment destinations in the browser. Security firms detected it within minutes.

How can organizations reduce third-party security risk? Most combine several layers. Vendor risk platforms such as SecurityScorecard and BitSight assess suppliers before and after onboarding. SaaS security tools such as AppOmni monitor what connected integrations actually do. Narrow OAuth scopes, short-lived tokens, and regular rotation limit what a stolen credential can reach. Dependency pinning and software composition analysis from vendors such as Socket and Snyk catch poisoned packages. For actions that move value, human authorization on dedicated hardware, such as Serenity BioWall on Serenity Technology’s sAxess Pro card, keeps a valid token from completing a transfer on its own.

Is Serenity Technology itself a third party? Yes, for every organization that uses its products, and the same scrutiny applies. That is the reason Serenity’s approval model keeps the deciding step on hardware the customer holds: the fingerprint is verified on the card itself, so authorizing an action depends on the person present at that moment and not on a remote service being trustworthy at that moment.

Your Security Is Only as Strong as What You Trust. was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

How autonomous AI wallets created an attack surface nobody designed security for — and what it takes to constrain them

By Jenny Tseliou, Serenity Technology

On May 4, 2026, someone posted a message on X in Morse code. Nobody typed wallet instructions. Nobody clicked a phishing link. Nobody entered a password. An AI agent connected to a live crypto wallet read the post, decoded the Morse, interpreted the hidden instructions, and executed a transfer of three billion DRB tokens, worth between $150,000 and $180,000, from a wallet associated with Grok. The transaction was cryptographically valid. The wallet signed it. The agent decided to.

Two weeks later, an AI trading service called Bankr paused all swaps and transfers after reporting that an attacker had compromised 14 user wallets. Investigators traced roughly $440,000 in affected holdings. Some users reported losses near $150,000 per wallet. The attack did not involve a protocol vulnerability or a stolen private key. It involved steering autonomous agents into executing transactions they were never authorized to make.

This is the newest version of the oldest problem in crypto security: unauthorized transfers of real money. What changed is where the decision happened. Not in a human mind manipulated by a phishing email. Not in a smart contract exploited through a code bug. In an AI agent’s inference process, manipulated through its inputs.

Brian Armstrong, founder and CEO of Coinbase, observed in early 2026 that there would “very soon” be more AI agents than humans making transactions on the internet. That observation is accurate and its security implications are still being worked out in real time, sometimes expensively.

what AI agents with wallets actually are

The concept is straightforward enough. An AI agent is software that can observe inputs, reason about them, and take actions autonomously. When that agent is given access to a crypto wallet, it can hold funds, sign transactions, and interact with smart contracts without a human in the decision loop. In March 2026, Alchemy launched a flow where an AI agent uses its own wallet as identity and payment source, receives an HTTP request for payment, and automatically tops up using USDC on Base, all without human input. Software paying software to continue a workflow.

This architecture has obvious utility. An agent that can autonomously rebalance a portfolio, execute trades based on market conditions, or pay for computational resources as needed removes friction from complex financial workflows. It also creates a new security question that traditional crypto security thinking was not designed to answer: how do you secure a decision, not just a key?

In traditional crypto security, protecting assets means protecting private keys. If the key is on hardware that cannot be compromised remotely, the asset is protected. An AI agent changes this model because the agent holds the key, and the agent can be manipulated without compromising the key directly. As one security researcher studying the problem described it: prompt injection is dangerous because it “targets the decision layer rather than the cryptography.” You do not need to break encryption if you can manipulate the system into authorizing the wrong action.

A 2025 study that built a benchmark of 847 adversarial test cases covering direct injection, instruction override, and data exfiltration found that without defenses, 73.2% of attacks succeeded against AI agents. With a combined defense framework, that dropped to 8.7%. Those numbers describe a technology category that is being deployed into real financial environments before the security baseline is established.

the three ways AI changes the attack landscape

The Morse-code incident and the Bankr compromise illustrate one attack vector: prompt injection, feeding malicious instructions to an agent through channels the agent is programmed to read and act on. But AI changes the Web3 threat landscape in two other dimensions that matter just as much.

The first is the commoditization of smart contract exploitation. Finding a vulnerability in a smart contract used to require significant expertise: reading Solidity, understanding protocol mechanics, identifying edge cases in financial logic. AI-assisted auditing tools have dramatically lowered this barrier. The same tools that defenders use to audit contracts before deployment, AI systems that can scan thousands of lines of code for known vulnerability patterns in minutes, are also available to attackers. The asymmetry that used to favor defenders, because responsible disclosure required building a proof of concept that demanded real skill, has narrowed. Researchers at blockchain security firms noted in 2025 that AI-assisted vulnerability discovery was making it measurably faster to find exploitable bugs in deployed contracts.

The second is the acceleration of personalized social engineering at scale. We covered deepfake and voice cloning attacks in detail in our analysis of how hackers actually bypass biometric systems. What AI adds here is not just better fakes but industrialized targeting. A manual social engineering campaign requires a human attacker to research each target individually. An AI system can analyze on-chain activity, social media patterns, and communication history for thousands of potential targets simultaneously, then generate personalized attack content for each. The phishing email that looks exactly like a message from someone’s DeFi protocol of choice, written in the exact tone of their previous correspondence, is now producible at scale.

what AI does well on the defense side

The picture is not uniformly dark. AI has also materially improved the defensive side of Web3 security, and being honest about this matters for understanding where the real problems are.

Chainalysis, TRM Labs, and Elliptic all run AI-powered transaction monitoring that can identify anomalous patterns in on-chain activity and flag potential exploits, money laundering, or sanctions violations in near real time. The speed of AI-powered detection has shortened the window between attack initiation and freezing mechanisms. The Arbitrum Security Council’s ability to freeze 30,766 ETH within hours of the KelpDAO exploit, which we analyzed in our post-incident piece on the $292 million hack, depended partly on AI-assisted tracing of fund flows.

Smart contract auditing is another area where AI-powered tools have genuinely raised the security floor. Automated audit tools can run through common vulnerability classes, re-entrancy, integer overflow, access control gaps, with a speed and consistency that human auditors cannot match. This does not replace expert review, but it does mean that obvious vulnerability patterns are less likely to survive to deployment undetected.

The honest framing is that AI improves both sides of the security equation. The attacker benefits because AI lowers the skill floor for sophisticated attacks. The defender benefits because AI scales monitoring and detection in ways that were not previously possible. The net effect depends on who is investing more, moving faster, and adapting more quickly. At this moment, the attack side is moving faster specifically in the new category of agentic finance, where the security frameworks are still catching up.

where regulation is trying to catch up

The EU AI Act, which took effect in February 2025, classifies AI systems used in financial services as high-risk, requiring conformity assessments, transparency obligations, human oversight mechanisms, and robust data governance. This interacts directly with MiCA, which governs crypto-asset services, creating an overlap that most compliance teams are still untangling.

The intersection is practically significant: an AI agent that autonomously executes crypto transactions on behalf of users may simultaneously fall under AI Act obligations as a high-risk AI system and under MiCA as a crypto-asset service. The AI Act’s human oversight requirement creates specific friction for fully autonomous wallet agents, because “meaningful human oversight” over every transaction authorization is in direct tension with the operational model of an agent designed to act without human input.

Travel Rule implementation continues to pose challenges for both crypto businesses and regulators, including around the treatment of unhosted wallets and the adequacy of technical and risk expertise. Autonomous agents that hold their own wallets and execute transactions independently sit in an ambiguous regulatory category that neither the AI Act nor MiCA was fully designed to address. Regulators in 2026 are actively developing guidance, but the products are already deployed.

the authorization question that hardware answers

For individuals and institutions navigating this landscape, the most practically useful question is not “how do I prevent AI agents from being manipulated?” That is a hard open problem in AI security. The more tractable question is “what constraints can I put on what a manipulated agent can actually do?”

The answer exists in where authorization is anchored. If a crypto wallet can authorize transactions solely through software-level instructions, then a manipulated agent is sufficient to authorize any transaction within the agent’s permission set. If authorization for transactions above a defined value threshold requires a hardware-level biometric signal, then a manipulated agent hits a wall it cannot cross programmatically. The agent can decide to execute a transaction. The transaction cannot complete without a live fingerprint physically present at a hardware device.

This is the architectural argument that connects AI risk to hardware-level security. For individual self-custody, sAxess, Serenity Technology’s biometric crypto wallet card, establishes a physical authorization layer that autonomous software cannot replicate: the seed phrase is in an EAL5+ secure element on a card the user holds, and every transaction requires a fingerprint from a live person. An AI agent operating with delegated permissions can act within defined limits, but the keys themselves cannot be accessed without physical presence. For organizations deploying AI agents in treasury or DeFi operations, sAxess Pro establishes the institutional version: multi-party biometric authorization enforced at hardware for high-value operations, meaning no single agent decision, however manipulated, can result in irreversible high-value loss without multiple humans physically authenticating. More on the architecture at s.technology.

The harder question, one the industry has not yet answered, is how to build AI agents that are genuinely useful for autonomous financial operations while maintaining meaningful constraints on what they can do unilaterally. The products are ahead of the governance frameworks. That gap will close, but not before more incidents demonstrate exactly what it costs.

the question worth sitting with

In every previous phase of crypto security, the primary attack targeted either the protocol or the human. Audits addressed protocol vulnerabilities. Security awareness addressed human vulnerabilities. AI agents create a third category: software that holds real money, makes real decisions, and can be steered by adversarial inputs in ways that neither protocol audits nor human training can fully address.

Coinbase founder Armstrong’s prediction about AI agents making more transactions than humans is not a distant forecast. The infrastructure is live, the products are deployed, and the first significant incidents have already happened. The security frameworks that will govern this new category are being built under live fire, in an environment where the cost of getting it wrong is immediate and irreversible.

Jenny Tseliou is a contributor at Serenity Technology, covering AI security, digital asset infrastructure, and the evolving threat landscape in Web3.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess, a biometric crypto wallet card.
Related reading: They Didn’t Hack the Fingerprint Scanner. They Hacked the Person Watching It. | The $292 Million KelpDAO Exploit: How DeFi’s Worst Weekend Was Built Over Months | The Good News Is That Crypto Phishing Dropped 83%. The Bad News Is What Replaced It.

Learn more at s.technology

Common questions

What is a prompt injection attack and why is it dangerous for crypto wallets? A prompt injection attack inserts malicious instructions into inputs that an AI agent is designed to read and act on, whether that is a social media post, a document, a website the agent browses, or a message in its context window. Because the agent interprets these inputs as instructions, it can be steered into taking actions its operators never authorized: changing a destination address, approving a malicious contract, or widening its own permissions. The attack does not require compromising any cryptographic key. It requires feeding the agent text that it reads as a legitimate instruction. For wallets where the agent has transaction signing authority, the consequences are directly financial.

Are AI agents in DeFi a new thing or have they existed for a while? Automated trading bots have existed in crypto for years, but they operated on rigid rule-based logic: “sell if price drops 10%”, “buy if this signal triggers.” Modern AI agents using large language models are categorically different. They can reason about novel situations, interpret unstructured inputs, coordinate with other agents, and adapt their behavior in ways that rule-based bots cannot. The combination of LLM reasoning with on-chain transaction capability is genuinely new, becoming commercially significant in late 2025 and accelerating rapidly through 2026. The security implications of this architecture are still being discovered.

Does the EU AI Act apply to AI agents that manage crypto wallets? Almost certainly for agents that manage wallets on behalf of third parties, though the regulatory guidance is still developing. The AI Act classifies AI systems used in financial services as high-risk, requiring conformity assessments, human oversight mechanisms, and data governance documentation. If the same agent also provides crypto-asset services, it may simultaneously fall under MiCA obligations. The critical ambiguity is the human oversight requirement: an agent designed to act autonomously without human input for each transaction may not satisfy the AI Act’s oversight standards for high-risk financial AI. Regulatory clarity is expected through 2026, but products are already deployed in advance of that clarity.

Can AI actually find smart contract vulnerabilities faster than human auditors? Yes, for known vulnerability patterns. AI-assisted auditing tools can scan contracts for common classes of bugs, re-entrancy, integer overflow, access control gaps, with speed and consistency that human review cannot match. For novel vulnerability classes that do not match existing patterns, human expert analysis remains essential. The practical implication is that obvious bugs are less likely to survive to deployment, while novel and complex vulnerabilities are still primarily discovered by experienced human auditors, sometimes on both the defense and offense sides.

If I use an AI agent to manage my crypto, am I responsible for what it does? In most current legal frameworks, yes. An AI agent acting on your behalf, with access to your wallet, operates under your authorization in the eyes of regulators and counterparties. If the agent executes a transaction you did not intend due to a prompt injection attack, recovering those funds depends on the same mechanisms available for any unauthorized transaction: which is to say, very limited ones. This is one reason why constraining what an agent can do unilaterally, particularly for high-value operations requiring hardware-level biometric confirmation, is architecturally important rather than merely convenient.

AI in Web3: The Agents Hold the Keys Now. That’s Where the New Risk Lives. was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

FTX customers got paid in 2025 at $18,000 per Bitcoin. Here’s what that tells you about who actually owns your crypto.

By Jenny Tseliou, Serenity Technology

On November 8, 2022, Binance CEO Changpeng Zhao(Cz) tweeted that he intended to sell Binance’s entire FTT position due to risk management concerns. By November 10, FTX had paused withdrawals. By November 11, it had filed for Chapter 11 bankruptcy. In 96 hours, 4.3 million customers discovered that the exchange which held their funds had been lending those funds to its affiliated trading firm, Alameda Research, which had been using them for speculative bets. FTX reported outflows of 37% of customer funds, almost all withdrawn in just two days.

The money was gone. The assets customers saw in their FTX accounts were not their assets. They were IOUs from an entity that no longer existed in any functional form.

FTX began repaying customers in early 2025, with distributions valued at petition-date prices: Bitcoin below $18,000. Bitcoin in early 2025 was trading between $95,000 and $100,000. The customers who waited three years for partial recovery received their distributions at roughly 20 cents on the dollar relative to what their Bitcoin was actually worth at the time they received it. Not because of fraud, technically, though fraud was involved. Because that is what happens when you are an unsecured creditor in a bankruptcy proceeding. Your claim is worth the asset’s value at the date of the petition, not on the date you eventually get paid.

This is not a FTX story. This is the story of every custodial collapse in crypto, told four times in the same decade, with the same structural explanation each time.

the pattern that keeps repeating

Mt. Gox handled approximately 70% of all Bitcoin trading when it filed for bankruptcy in February 2014. 850,000 BTC, worth approximately $450 million at the time, was gone. Customers waited over a decade for partial recovery through the bankruptcy process, receiving a fraction of their original holdings while Bitcoin appreciated by orders of magnitude during the wait.

Celsius and Voyager both succumbed to the collapse of stablecoin TerraUSD and the implosion of hedge fund Three Arrows Capital, to which they had both made substantial loans using customer assets. The customers of Voyager and Celsius had not agreed to lend their funds to Three Arrows Capital. They had no way of knowing that was happening. They found out when withdrawals were frozen.

Many customers of Voyager Digital and Celsius expressed surprise when they discovered that neither firm had properly segregated or accounted for customer assets, even in accounts designated as “custodial.” This is the legal reality of custodial crypto that most users never read in the terms of service: in most custodial arrangements, your deposited crypto is not held in segregated accounts with your name on them. It is commingled with the exchange’s assets. You are an unsecured creditor. If the exchange becomes insolvent, you are in the same queue as any other creditor, behind secured lenders and bankruptcy professionals who will bill millions in fees before your claim is addressed.

The five major crypto firms that collapsed, FTX, Celsius, Voyager, BlockFi and Genesis, did so because they offered customers instant withdrawals while their assets were locked inside illiquid, risky investments in an attempt to generate unsustainable yields. The business model required this. An exchange offering 10% annual yield on stablecoins is earning that yield by deploying customer deposits into higher-risk instruments. The promise is that the returns will materialize before enough customers want their money back simultaneously. When the market moves against the position, or when confidence erodes, the bank run happens and the mismatch becomes visible.

The pattern has run four times in twelve years: Mt. Gox, Celsius, FTX, BlockFi. Every time, the structure was the same. Custody without segregation. Yield without disclosure. And customers holding a claim against an insolvent estate rather than holding their own assets.

what “ownership” actually means on a blockchain

There is something philosophically unusual about crypto assets that took years for the industry to articulate properly, and that most custodial platforms actively discouraged users from thinking about. The Bitcoin network does not know who you are. It knows who controls the private key. Control of the key is ownership. There is no distinction between the two. The phrase “not your keys, not your coins” is not a security recommendation. It is a precise technical and legal description of how ownership works on a public blockchain.

When you deposit Bitcoin to an exchange, the Bitcoin does not move to an account with your name on it. It moves to a wallet controlled by the exchange. The exchange’s database records that you have a claim on that amount. The claim is valuable as long as the exchange remains solvent and chooses to honor it. The moment the exchange freezes withdrawals, that claim is worth whatever a bankruptcy court determines it is worth.

In self-custody, the relationship is direct. The private key controls the asset. Whoever controls the key controls the asset. The network enforces this without intermediaries. No terms of service, no counterparty, no solvency risk, no freeze. Ownership on a blockchain is uniquely absolute in a way that traditional finance cannot replicate because there is no custodian who could, in principle, decide to restrict access. The property right and the technical capability are the same thing.

This is why self-custody is not primarily a security argument, though the security benefits are real. It is a property rights argument. Holding your own keys is the only way to hold crypto in the sense that “holding” actually means what it sounds like.

where self-custody has historically broken down

The case for self-custody is philosophically clean. The implementation has been messy enough to keep most users in custodial systems despite everything the custodial failures demonstrated.

The original failure mode was irreversible loss through human error. A seed phrase written on a piece of paper that burns in a house fire. A hardware wallet firmware update that corrupts the device. A recovery phrase stored in a password manager that gets hacked. When your exchange dies, you don’t just lose access to your crypto. You lose access to the data that proves what you paid for it. When you lose your self-custody keys, you lose the assets themselves. No bankruptcy trustee, no customer support line, no dispute process. The finality cuts both ways.

The second failure mode, less discussed, is succession. The estimated 3.7 million Bitcoin that may be permanently inaccessible due to lost keys, forgotten phrases, or deceased holders without succession plans represents the individual-scale version of the same problem. A self-custody arrangement that depends entirely on one person’s memory and one piece of paper is not meaningfully more resilient than a custodial arrangement with counterparty risk. It just has a different failure mode.

These two problems, recovery and succession, are what gave custodial services their durable value proposition even after FTX. For users who were not confident they could manage keys without making an irreversible error, handing them to an exchange felt safer than the alternative. That trade-off was real. It just came with risks that were not disclosed on the homepage.

Serenity’s sBox addresses recovery and succession at the architecture level. The recovery credential is not a phrase written on paper. It is an NFT on-chain, created using the DeDaSP protocol (patent publication 20240249276A1), which means succession can be planned and executed without recreating the centralized custody problem that self-custody was meant to solve. For anyone serious about self-custody, having a clear answer to “what happens when I cannot access my wallet” is not optional. It is a design requirement.

the regulatory tailwind that most people are reading backwards

The EU Travel Rule became enforceable on December 30, 2024, with no transitional grace period. Under the revised Transfer of Funds Regulation, CASPs must collect and transmit identifying information for both the sender and the recipient of any crypto transaction, regardless of amount.

Most coverage of the Travel Rule has focused on the compliance burden it places on exchanges. That is real. But the more interesting regulatory dynamic is what happens at the boundary between custodial and self-custody systems. The Travel Rule applies to CASPs, not to individuals holding their own keys. When you send Bitcoin from your own self-custody wallet, you are not a CASP. The reporting obligations fall on the exchange on the other end of the transaction, not on you. Regulated exchanges in the EU are now required to verify the recipient of any outgoing transfer and maintain detailed records. Self-custody positions you outside that reporting infrastructure, which is precisely what regulators wanted to prevent with shadow finance, but also means that the friction falls on intermediaries, not on individuals managing their own keys.

The net regulatory effect is not a ban on self-custody. It is increased compliance cost for custodial services, which makes the value proposition of custody less attractive for exchanges and more expensive for users. The institutions best positioned for the post-MiCA environment are the ones that have solved the self-custody usability problem: how do you give users the security and finality of holding their own keys without requiring them to be expert cryptographers?

the answer to the question that held self-custody back

The barrier that kept millions of users in custodial systems was not ignorance of the risks. After FTX, the risks were not ignorable. The barrier was that the user experience of managing private keys, the seed phrase written on paper, the hardware device that could be lost or broken, the technical friction of every transaction, was not adequate for mass adoption.

That barrier is shrinking. The hardware wallet market has evolved significantly from the early devices that required USB connections and command-line interfaces. Modern biometric hardware wallets, where the only key is a live fingerprint and the seed phrase never exists as a written string, have removed most of the failure modes that made self-custody feel dangerous for non-technical users. No paper to lose. No phrase to forget. No credential to steal. The custody model that protects against counterparty risk no longer requires the user to become their own security expert.

sAxess, the biometric crypto wallet card made by Serenity Technology, is built on this design logic: the seed phrase for 100-plus blockchains lives inside an EAL5+ secure element on the card, and the only authentication is a fingerprint. The UX comparison to a contactless payment card is not accidental. The goal is for the security properties of self-custody to become as frictionless as tapping a card at a terminal. Not because security was compromised to achieve that simplicity, but because the security architecture no longer requires complexity to be effective. You can explore the design further at s.technology.

what the history actually argues

The custodial collapses of 2014, 2022, and the years between were not anomalies in an otherwise sound model. They were the predictable output of a model that gave users the appearance of ownership while providing the legal reality of a credit claim. The industry built trust through marketing and convenience. The reckoning came when liquidity met structural insolvency and customers discovered that the promise of instant withdrawal had never been backed by segregated assets.

Self-custody does not eliminate all risk. It changes the failure mode from “someone else’s decisions destroy your assets” to “your own decisions can destroy your assets.” For users with adequate tooling, that is a dramatically better risk profile. For users without it, the danger is real, which is why the tooling has to be part of the argument, not an afterthought.

The industry is at the point where the tooling has caught up with the philosophy. Self-custody with biometric hardware and on-chain recovery is not significantly harder than using an exchange. It is just fundamentally different in who bears the risk when things go wrong.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, self-custody infrastructure, and the architecture of Web3 ownership.
Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess, a biometric crypto wallet card.
Related reading: The Good News Is That Crypto Phishing Dropped 83%. The Bad News Is What Replaced It. | Nobody Loses Their Life Savings to a Cold Wallet | The Real Reason Crypto Has Only Reached 5% of the World

Learn more at s.technology

Common questions

If self-custody is clearly better, why do most crypto users still use exchanges? Two reasons, and both are legitimate. The first is convenience: an exchange account works like a bank account, instant access, simple interface, easy to use on a phone. The second is the fear of irreversible mistakes. A password can be reset. A forgotten seed phrase cannot. For users who are not confident they can manage private keys without an error, the convenience and perceived safety net of a custodial service has felt worthwhile, even knowing the counterparty risk. The shift toward self-custody requires solving both of these problems simultaneously: reducing the friction of self-custody to match the convenience of an exchange, and solving the recovery problem so that a forgotten phrase or lost device is not a total loss.

When FTX collapsed, customers eventually got some money back. Doesn’t that mean custodial systems have protection? The recovery was partial and arrived years later at the wrong price. FTX customers who had Bitcoin in their accounts received distributions in early 2025, valued at Bitcoin’s price at the date of the bankruptcy filing, below $18,000. At the time of distribution, Bitcoin was trading near $100,000. The legal system protected their claim in nominal terms while the asset they were waiting to recover appreciated by more than 5x during the wait. In self-custody, your Bitcoin would have been worth $100,000 when you chose to sell it. In a bankruptcy estate, your claim was worth $18,000 when the trustee decided to honor it. That is not a safety net. That is a different kind of loss.

Does the Travel Rule make self-custody illegal in the EU? No. The Travel Rule applies to regulated crypto-asset service providers, meaning exchanges and custodians, not to individuals managing their own wallets. Sending from a self-custody wallet is not regulated under the Travel Rule. What the regulation does is increase the compliance burden on exchanges for transactions involving unhosted wallets, requiring them to collect identifying information about the self-custody wallet owner. The effect is friction at the exchange interface, not a ban on self-custody itself.

How do I know a hardware wallet’s secure element is actually secure? Hardware security is certified through standardized evaluation frameworks. EAL5+ certification under the Common Criteria standard is the relevant benchmark for banking-grade secure elements. It involves independent third-party evaluation of the hardware against defined security requirements. The same certification standard applies to banking cards and passport chips. Manufacturers whose products carry EAL5+ certification have had the hardware independently evaluated to confirm it meets those requirements, as distinct from self-claimed security properties.

What is the succession problem in self-custody and how is it actually solved? The succession problem is what happens to your digital assets if you die or become incapacitated without leaving a recovery mechanism. In a custodial system, a legal heir can potentially claim the account through probate. In standard self-custody, there is nothing to claim unless the key or seed phrase was passed on, which requires creating the very physical backup that self-custody was designed to eliminate. The on-chain approach resolves this by creating a recovery credential as a blockchain-native object, meaning the succession mechanism is built into the digital infrastructure rather than depending on a physical document or a third-party custodian. The result is that recovery can be structured, documented, and executed without reintroducing the centralized custody that self-custody was meant to replace.

Why Self-Custody Is the Future of Web3: The Case History Has Been Making Since Mt. Gox was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why institutional crypto adoption depends on secure digital asset infrastructure.

By Jenny Tseliou, Serenity Technology

On July 18, 2024, the Indian exchange WazirX had almost everything an auditor would ask to see. Its main wallet was a Safe multisig with six signatories. Every transfer needed three approvals from the WazirX team, each signer using a Ledger hardware wallet, followed by a final check from its custody partner Liminal. Destination addresses were restricted by a whitelist.

Four approvals came in. More than $230 million left.

According to WazirX’s own preliminary report, the attack “stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents.” Every signer performed their role. Each approved what their screen showed them, and what their screens showed them was not what they signed.

That incident is the most useful way into institutional crypto in 2026, because the institutions are arriving now, and they are bringing exactly the structure WazirX already had.

Institutional crypto security is the set of controls that let an organization hold digital assets the way it holds any other asset: authority divided by role, every approval tied to a named person, and a record an auditor can verify. Under the EU’s MiCA regulation, every crypto-asset service provider serving EU clients had to be authorised by 1 July 2026, according to ESMA.

a private key has no job title

Institutions manage money through structure. The person who initiates a payment is not the person who approves it. Approval limits rise with seniority. Two sets of eyes see anything large. When something goes wrong, there is a name in the approval column. These controls are older than computers, and every bank, fund, and corporate treasury is built on them.

A private key recognizes none of that. It recognizes possession. Whoever can produce a valid signature is, as far as the blockchain is concerned, the owner, with no concept of initiator, approver, limit, or role. For an individual that is the point of self-custody. For an organization it is a structural mismatch.

Almost everything institutional custody has built over the past decade, from multisig wallets to multi-party computation to policy engines and approval workflows, is an attempt to make a key behave as if it had an org chart. WazirX shows how far that retrofit has come and where it still breaks.

the institutions arriving in 2026

The regulatory and accounting barriers that kept large institutions at a distance have mostly come down in the past two years.

In the United States, the SEC issued Staff Accounting Bulletin 122 in January 2025, withdrawing the staff guidance that had pushed banks to record crypto held for customers as a liability on their own balance sheets. For a regulated custodian, that guidance made the business close to uneconomic. With it gone, the largest custodians moved. On August 18, 2026, Citi announced Custody+, a platform through which clients will access traditional and crypto custody within the same framework, with bitcoin custody expected to go live before the end of the year. Citi joins BNY and other global custodians that have moved into digital asset custody over the past few years.

In Europe, the change arrived as a deadline. MiCA allowed firms already operating before its full application to keep serving clients during a transitional period, but ESMA confirmed in an April 2026 statement that the period ends at the latest on 1 July 2026, “at which point all CASPs must be authorised.” Several member states, including Germany and Ireland, closed their windows much earlier. Firms without authorisation were told to prepare orderly wind-down plans.

What banks and licensed providers bring to crypto is not better cryptography. The cryptography was never the weak point. They bring the org chart: segregation of duties, named approvers, audit, and legal accountability. That is why their arrival matters, and also why WazirX is the right warning to carry into it. WazirX had the org chart.

what institutional crypto security actually requires

An approval structure only protects anything if two conditions hold for every signature on it.

The first is that each role is held by a specific, identifiable person. In most custody setups, a role is held by a device or a credential: a hardware wallet in a drawer, a key share on a laptop, a login to a policy dashboard. Whoever can operate that device or credential can perform the role. When a role belongs to an object that anyone at the desk can pick up, the approval column records which device signed, and the name next to it is an assumption.

The second is that each approval is a decision about the real transaction. This is where WazirX failed. Hardware wallets protected every key from the signers’ computers, which is what they are designed to do. The decision itself, though, was made by reading an interface, and the interface lied. Four independent-looking approvals were four copies of one decision, made on the basis of the same falsified display.

That is the uncomfortable property of a quorum. Each additional signer adds a person an attacker has to fool, but if every signer reads the same compromised screen, the quorum stops being several judgments and becomes one. It is the same failure that makes three recovery custodians under one authority no safer than one: the parts are distributed on paper and share a single point of failure in practice.

how the approval step gets tied to a person

This is the layer sAxess Pro is built for. sAxess Pro is Serenity Technology’s biometric access control card for organizations. It replaces passwords, SMS codes and PINs with a fingerprint checked on the card, so every sensitive approval is tied to a named person and recorded in an audit trail. In practice it moves a role from an object anyone can operate to a person who has to be physically present, which is what segregation of duties assumed all along. A stolen credential or a compromised laptop cannot produce the approval on its own, and the record of who approved what exists before an auditor asks for it. More detail is in Serenity’s sAxess Pro overview.

The limit matters as much as the benefit. Tying an approval to a person solves the first condition, not the second. A named, physically present signer can still approve a manipulated transaction if the screen in front of them is lying, and WazirX’s signers were real people doing their jobs. Institutions need both: approvals that belong to identifiable people, and a way for those people to verify what they are actually signing, independent of the interface that asks for the signature.

what growing up means

Institutional crypto growing up does not mean institutions buying more of it. The volumes will follow or they will not. It means that the controls finance has used for a century start to apply to the one asset class that was designed without them.

That work has two halves. Regulators and custodians are now building the first: licensing, accountability, and a named approver for every role. The second is harder, and it is the one WazirX exposed. Every signature on the chart has to be a person’s informed decision about the transaction that will actually execute.

The key still does not know what a job title is. The infrastructure around it has to know it on the key’s behalf.

Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, institutional custody, and access control. Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations. Related reading: sAxess Pro: What Enterprise-Grade Biometric Security Actually Looks Like in Practice | Why Biometric Hardware Is Becoming the New Standard for Institutional Crypto Compliance | Digital Asset Recovery: The Missing Layer of Web3 Security

Learn more at s.technology

Common questions

What is institutional crypto security? Institutional crypto security is the combination of custody, access control, and approval processes that lets an organization hold digital assets under the same controls it applies to any other asset. That means dividing authority by role, requiring more than one person for large transfers, tying each approval to a named individual, and keeping a record an auditor can verify.

Can banks hold crypto for clients in 2026? Yes. In the United States, SEC Staff Accounting Bulletin 122 withdrew in January 2025 the guidance that had pushed banks to book customer crypto as a balance-sheet liability, and custodians including BNY and Citi have since moved into digital asset custody. In the EU, crypto-asset service providers must be authorised under MiCA, with the transitional period ending no later than 1 July 2026.

What happened in the WazirX hack? On July 18, 2024, attackers took more than $230 million from a WazirX Safe multisig wallet. The wallet required three WazirX approvals, each on a Ledger hardware wallet, plus a final check by custody partner Liminal. According to WazirX, the data displayed on Liminal’s interface did not match what was actually signed, so the signers approved a transaction they could not see.

How do institutions secure crypto custody? Most combine several approaches. Regulated custodians such as BNY, Citi’s Custody+, Coinbase Custody and Anchorage Digital hold assets on a client’s behalf. Multi-party computation platforms such as Fireblocks and Copper split key material so no single party holds a full key. Smart-contract multisig wallets such as Safe require several approvals on chain. Hardware security modules protect keys inside certified devices. Biometric approval cards such as Serenity Technology’s sAxess Pro tie each approval to a named person’s fingerprint. Each covers a different part of the problem, and larger organizations usually layer two or more.

Is a multisig wallet enough for an institution? Not by itself. A multisig divides authority among several signers, which is necessary, but it assumes each signer makes an independent, informed decision. WazirX had a six-signer multisig with hardware wallets and a third-party policy check, and it still lost more than $230 million because every signer relied on the same manipulated interface. Institutions also need approvals tied to identifiable people and an independent way to verify what is being signed.

Institutional Crypto Is Growing Up. was originally published in Serenity Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.