Risk Management in the DeFi Era: What "Institutional-grade" Actually Means | EBC12

Summary

The panel discussed what “institutional-grade” risk management means as traditional financial firms consider DeFi. The core challenge is broader than crypto price volatility: institutions must assess custody, operational, liquidity, smart-contract, regulatory, counterparty, cybersecurity, and compliance risks. Speakers said institutional access is improving through regulated products and specialist intermediaries, but institutions still need to understand the full chain of risks and adapt their processes.

Key themes and frameworks

• Separate market risk from infrastructure and operational risk. Crypto investors also face custody and wallet-management failures, operational problems, inheritance issues, smart-contract exploits, and regulatory uncertainty.
• Build a due-diligence process for DeFi exposure. One panelist described selecting multiple managers, diversifying across protocols, conducting in-house protocol due diligence, requiring manager transparency, and checking that managers use mitigations such as insurance and security platforms.
• Assess the whole transaction chain. Institutional readiness depends on understanding risks across liquidity, protocols, custodians, counterparties, and regulatory requirements—not just the underlying asset.
• Choose custody according to the investor’s capabilities and needs. Speakers cautioned that neither self-custody nor third-party custody is risk-free. Hardware, firmware, code, custodians, and issuers can all be points of failure. One firm used an external consultant to help establish its operational and custody setup.
• Use regulated wrappers where appropriate. ETPs and ETFs were presented as ways for investors to access crypto while delegating custody and some operational responsibilities to regulated providers. One speaker argued that ETPs are a particularly suitable route for many institutional clients.
• Distinguish KYC from KYT. The panel discussed “know your customer” controls on permissioned systems versus “know your transaction” monitoring on public blockchains. Speakers noted that public, permissionless networks do not inherently provide conventional KYC, while permissioned networks can control access.
• Expect TradFi and DeFi to converge. The panel anticipated both traditional assets being tokenized and crypto assets being offered through traditional wrappers, including ETPs, structured products, and QIS notes.

Markets, assets, and instruments mentioned

• Crypto and networks: Bitcoin (BTC), Ethereum (ETH), Solana (SOL), and DeFi protocols and blockchain networks generally.
• Traditional assets and benchmarks: Gold, the S&P 500, Nasdaq, stocks, bonds, foreign exchange, and commodity futures.
• Products and instruments: ETFs, ETPs, stablecoins, tokenized funds, structured products, QIS notes, and perpetual futures.
• Other references: Ledger Nano and Coldcard hardware wallets; SOXL, cited in a comparison about high-volatility products. A subtitle refers to an asset as “Cosbi” with 90% volatility; the name is unclear and may be an auto-caption error.

Numbers and timelines cited

These were figures or recollections stated by panelists, not independently verified during the discussion:

• One speaker said his firm had allocated to hedge funds for 25 years and began exploring crypto for alpha several years ago.
• A crypto hedge fund was said to have launched three years before the panel. One firm had considered DeFi about two years earlier, then began investing in it in January 2025.
• The DeFi allocation process reportedly involved selecting multiple managers and diversifying across protocols. Separately, a speaker described roughly six months to create a product, including three months to agree internally; a risk manager revisited security questions at least 15 times during a later process.
• A panelist said institutional clients increasingly consider crypto exposure of at least 1%, arguing that below 1% is too little. This was his characterization, not a panel consensus or allocation recommendation.
• A speaker cited market volatility of about 30% for Bitcoin and 90% for an unclear asset name transcribed as “Cosbi.”
• Citing Raoul Pal, a panelist stated that global liquidity grows about 8% annually, inflation about 2–3%, and therefore investors need roughly 11% annual returns to preserve purchasing power. He also cited approximate returns over the prior decade of 12% for gold, 30% for the S&P, 20% for Nasdaq, and 60–70% for Bitcoin. The measurement period and exact return methodology were not specified.
• A panelist referred to Bitcoin as a roughly $2 trillion asset class when discussing quantum-computing risks.
• The panel’s outlook question covered the next 3–5 years. A speaker also contrasted blockchain settlement with traditional T+2 securities settlement.

Risks, views, and cautions

• Custody is not risk-free: Self-custody shifts responsibility to the investor and still depends on hardware, firmware, software, and key-generation processes. A speaker cited a Coldcard seed-generation vulnerability as an example; another described difficulty moving assets with a low-battery Ledger Nano.
• No single storage model is ideal. Speakers said investors should choose a model suited to their requirements, while institutions must also meet regulatory and operational obligations.
• DeFi-specific and broader risks remain: Hacking, smart-contract and oracle vulnerabilities, liquidity, concentration, regulatory uncertainty, AML/KYT compliance, privacy and transaction-information leakage, front-running, geopolitical and commercial risks, and potential quantum-computing threats.
• Quantum risk drew differing emphases. Some panelists said it is not an immediate problem and that networks can evolve; another stressed that future software and cryptographic risks are real and should not be dismissed. The discussion also noted that proof-of-work and proof-of-stake systems may face different issues.
• Institutional adoption is a lengthy governance process. A speaker described needing board approval and repeated internal risk reviews before launching crypto products.
• Institutional participation is not uniform. One panelist said that despite interest, he saw relatively few institutional investors in Switzerland investing in DeFi at the time.
• The panel did not offer a unified allocation recommendation. Individual speakers expressed views about crypto exposure and access products, but these were their own perspectives.
• No explicit “not financial advice” disclaimer was given.

Presenters and sources

Panel moderator: Stuart MacDonald, co-chair of the conference; the subtitles also render his surname as “McDonald.”

Panelists: Thomas Uhm (QRT; identified in the discussion as Tom), Cedric Vuignier (Syz Group), Javier Pineda (Renta 4 Cripto), and Roman Gonzalez (A&G Banco).

Other sources referenced by speakers: Raoul Pal, for the liquidity, inflation, and asset-performance figures; The Bitcoin Standard by Saifedean Ammous; and a Bitcoin conference in Las Vegas, mentioned in connection with debate over quantum risk.