Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Risks and capability

Four distributed ledger risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence.

6 min read0 figures1 table22 notesNR-XTECH-DLT-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Ledgers are settlement infrastructure and a regulatory subject
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
    1. 4.1 Risk objects
    2. 4.2 Capability ladder
  7. 5Large stablecoin base against uneven rules and theft controls
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

  1. InferredEQL 3RSK-XT11-FIN-001

    Stablecoin reserve and redemption stress

    Driver
    rapid growth against uneven reserve rules617
    Exposure
    holders of the largest stablecoins; short-term funding markets
    Vulnerability
    reserve composition not read from attestations
    Capacity
    GENIUS Act and MiCA reserve rules1314
    Cascade
    FIN → DAT, TRD
    Horizon
    1 to 5 years

  2. InferredEQL 3RSK-XT11-DAT-002

    Theft and sanctions evasion

    Driver
    large single thefts and illicit flows1920
    Exposure
    exchanges, bridges and custodians
    Vulnerability
    key compromise; weak controls at service providers
    Capacity
    FBI attribution; sanctions policy; supervisory rules1921
    Cascade
    DAT → FIN
    Horizon
    1 to 3 years

  3. Expert inputEQL 2RSK-XT11-CRY-003

    Signature exposure to quantum attack

    Driver
    exposed public keys and falling quantum resource estimates2224
    Exposure
    outputs that have revealed a public key
    Vulnerability
    no activated post-quantum output type
    Capacity
    draft proposals and NIST standards222324
    Cascade
    CRY → DAT → FIN
    Horizon
    5 to 10 years

  4. InferredEQL 3RSK-XT11-GOV-004

    Divergent national rules

    Driver
    different statutes and review outcomes12131416
    Exposure
    cross-border issuers and service providers
    Vulnerability
    regulatory arbitrage
    Capacity
    FSB framework and review1112
    Cascade
    GOV → FIN
    Horizon
    1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence for distributed ledger at the global level.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
FunctionRungLevelStrongest public evidence at baseline
Prevention and mitigationEXISTSstatutes for stablecoin issuers in the US and EU1314
Monitoring and observationLISTEDno common tracker of reserves, theft and illicit use on one basis
Early warningLISTEDsupervisory monitoring is not consolidated12
Preparedness and planningEXISTSFSB framework and central bank projects4811
Redundancy and reservesEXISTSreserve requirements of at least 1 to 1 for US issuers13
ResponseLISTEDno tested response to a run on a large stablecoin
Continuity of critical servicesLISTEDsettlement continuity of tokenised money not reported
RecoveryLISTEDrecovery of stolen funds not read
AdaptationLISTEDpost-quantum output types are drafts2324
Social protectionLISTEDnot applicable at baseline
Finance and insuranceLISTEDno insurance data read
Institutional coordinationEXISTSstandard setters and supervisory authorities11121415
Technical infrastructureEXISTSmature protocols and upgrade processes4
WorkforceLISTEDskills gaps not read; no figure bound
Research capacityADEQUATEfoundational papers and public specifications1236373839
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 6BIS (ed.), Annual Economic Report 2025, chapter III, The next-generation monetary and financial system (stablecoins fall short on the tests of singleness, elasticity and integrity; over 99% of stablecoins are US dollar-denominated; first 100,000 characters of the page read). Bank for International Settlements, Basel. Observation year 2025. Accessed 2026-11-03.back
  2. 17Board of Governors of the Federal Reserve System (ed.), Stablecoins in 2025: Developments and Financial Stability Implications, FEDS Notes, 8 April 2026 (market capitalisation USD 317 billion on 6 April 2026; more than 50% above early 2025). Federal Reserve Board, Washington. Observation year 2026. Accessed 2026-11-03.back
  3. 13United States Congress, Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Public Law 119-27, enacted 18 July 2025 (full text read from the Government Publishing Office version). Observation year 2025. Accessed 2026-11-03.back
  4. 14ESMA (ed.), Markets in Crypto-Assets Regulation (MiCA) page (timeline: entered into force June 2023; full application 30 December 2024; grandfathering under Article 143(3) ends 1 July 2026 at the latest; no count of authorised providers). European Securities and Markets Authority, Paris. Observation year 2025. Accessed 2026-11-03.back
  5. 19Federal Bureau of Investigation (ed.), Public service announcement on the Bybit theft (about USD 1.5 billion in virtual assets stolen on or about 21 February 2025; attributed to North Korea). FBI Internet Crime Complaint Center, Washington. Observation year 2025. Accessed 2026-11-03.back
  6. 20Chainalysis (ed.), 2026 Crypto Crime Report introduction (illicit addresses received at least USD 154 billion in 2025, up 162%; sanctioned-entity value up 694%; North Korea-linked thefts USD 2 billion; Bybit nearly USD 1.5 billion; illicit share below 1%; stablecoins 84% of illicit volume). A security-vendor report and a lower-bound estimate, weak evidence. Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  7. 21US Department of the Treasury (ed.), Tornado Cash Delisting (press release of 21 March 2025). Treasury, Washington. Observation year 2025. Accessed 2026-11-03.back
  8. 22NIST (ed.), Post-Quantum Cryptography project page (three finalised standards; announcement of 13 August 2024; HQC selected as a backup on 11 March 2025). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
  9. 24Lopp, J. et al., BIP 361: Post Quantum Migration and Legacy Signature Sunset, Bitcoin improvement proposal, status Draft, assigned 11 February 2026 (states that over 34% of all bitcoin had revealed a public key on-chain on 1 March 2026). Bitcoin improvement proposals repository. Observation year 2026. Accessed 2026-11-03.back
  10. 23Beast, H., Heilman, E. and Duke, I.F., BIP 360: Pay-to-Merkle-Root (P2MR), Bitcoin improvement proposal, status Draft, version 0.12.1 (resists long exposure attacks only). Bitcoin improvement proposals repository. Observation year 2026. Accessed 2026-11-03.back
  11. 12FSB (ed.), Thematic review on the FSB Global Regulatory Framework for Crypto-asset Activities (publication page; October 2025; information as of August 2025; significant gaps and inconsistencies; eight recommendations). Financial Stability Board, Basel. Observation year 2025. Accessed 2026-11-03.back
  12. 16Basel Committee on Banking Supervision (ed.), Prudential treatment of cryptoasset exposures, standard SCO60 (publication page; published 16 December 2022; the page states implementation by 1 January 2025; later date and review known only from search summaries). Bank for International Settlements, Basel. Observation year 2022. Accessed 2026-11-03.back
  13. 11FSB (ed.), FSB Global Regulatory Framework for Crypto-asset Activities (publication page; final report of 17 July 2023). Financial Stability Board, Basel. Observation year 2023. Accessed 2026-11-03.back
  14. 48European Central Bank (ed.), Eurosystem moving to next phase of digital euro project (press release of 30 October 2025; a pilot exercise and initial transactions could take place as of mid-2027 if the Regulation is adopted in 2026; readiness for a potential first issuance during 2029; the decision to issue is taken only once the legislation is adopted). ECB, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
  15. 15EBA (ed.), Asset-referenced and e-money tokens (MiCA) page (requirements for issuers of ARTs and EMTs apply from 30 June 2024; EBA statement; joint reports). European Banking Authority, Paris. Observation year 2024. Accessed 2026-11-03.back
  16. 4Ethereum Foundation (ed.), Ethereum roadmap (project page: Merge 15 September 2022 with a cut in energy use of about 99.95%; Dencun 13 March 2024; Pectra 7 May 2025; Fusaka 3 December 2025). A project-published page, weak evidence for the energy figure. Observation year 2025. Accessed 2026-11-03.back
  17. 1Nakamoto, S., Bitcoin: A Peer-to-Peer Electronic Cash System, white paper, 2008 (PDF read in full for the abstract). Observation year 2008. Accessed 2026-11-03.back
  18. 2Yaga, D., Mell, P., Roby, N. and Scarfone, K., Blockchain Technology Overview, NIST IR 8202 (publication page; published 3 October 2018, page updated 7 May 2026). National Institute of Standards and Technology, Gaithersburg. Observation year 2018. Accessed 2026-11-03.back
  19. 36UNVERIFIED, not opened: Buterin, V., A Next-Generation Smart Contract and Decentralized Application Platform, white paper, 2014, cited from memory. Observation year 2014. Accessed 2026-11-03.back
  20. 37UNVERIFIED, not opened: Castro, M. and Liskov, B., Practical Byzantine fault tolerance, Proceedings of OSDI, 1999, cited from memory. Observation year 1999. Accessed 2026-11-03.back
  21. 38UNVERIFIED, not opened: Lamport, L., Shostak, R. and Pease, M., The Byzantine generals problem, ACM Transactions on Programming Languages and Systems 4(3), 382 to 401, 1982, cited from memory. Observation year 1982. Accessed 2026-11-03.back
  22. 39UNVERIFIED, not opened: Haber, S. and Stornetta, W.S., How to time-stamp a digital document, Journal of Cryptology 3, 99 to 111, 1991, cited from memory. Observation year 1991. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 4: Risks and capability. In Exponential Technology Report 2026: Blockchain and Distributed Ledgers (Baseline Edition 2026, Report No. NR-XTECH-DLT-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Blockchain and Distributed Ledgers.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskExponential Technology

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices