$14.6 Million in RWA Hacks This Year Reveals the Gap Between Tokenization Hype and Reality

In 2025, real-world asset tokenization amounted to $35.68 billion, with the Q3 tokenization being over 30 billion (around 10 times as much as in 2022). Standard Chartered forecasts that the market will reach $2 trillion by 2028, a 5600 percent growth.

However, the number of RWA protocol exploits was also more than twice as high in 2025, equating to a total of 14.6 million dollars in cumulative losses. The Zoth hack, totaling 8.5 million dollars, in particular questioned the assumption that the industry had made sufficient security infrastructure before scaling, or that it had been in a rush to market in the middle of a bull cycle.

The Horse-and-Buggy Problem

The regulatory environment is still fragmented six months after the signing of the GENIUS Act, the first federal framework to regulate stablecoins, by President Trump. The Act provides clarity for USD-backed payment stablecoins and regulates settlement, cash flows, and payment flows. It, however, does not cover the full picture of the asset lifecycle, such as valuation standards, custody rules, transferability, secondary trading, and reporting requirements.

Regulators are applying rules created in the telegraph era to today's digital investment landscape. A set of securities laws, prepared in 1933, now regulates blockchain-based assets, thereby generating what critics call the pre-digital regulatory frameworks.

Without federal guidance across the entire asset cycle, institutions face inconsistent requirements across states, custodians, and market venues. The GENIUS Act provides regulatory certainty for stablecoins but leaves fragmentation everywhere else. "The GENIUS Act moves the industry forward by fixing the digital settlement layer," Alex Davis, CEO of Mavryk, notes. "But RWA tokenization will only achieve mass institutional scale once there is a unified, federal regulatory perimeter that covers the full asset cycle, not just the stablecoin component."

Where the Exploits Actually Happened

In the event of building a permissionless yield farm around a tokenized treasury, the picture is vulnerable on the DeFi level of the protocol, and not on the underlying tokenization of the asset.

One area of concern is the implementation of smart contracts. Smart contracts that use languages that are not modestly structured to achieve the security of institutions introduce attack vectors that are not present in conventional finance.

"Most of these exploits didn't occur in tokenized assets themselves," Davis explains. "The breaches happened in DeFi wrappers built around the tokenized assets. A big part of the issue is that much of the industry is still building financial products using smart-contract languages that were never designed for institutional-grade security."

The institutional RWA market is increasingly moving towards architectures that incorporate compliance by design, anchor valuation in trusted oracles, maintain strong control over the secondary venues, and have deep-rooted custody.

The key question is, can this institutional layer scale before retail-facing experiments destroy the credibility of the sector?

When Your Competitors Validate Your Market

In August 2025, State Street anchored a $100 million tokenized deal on JPMorgan's blockchain. The development of this milestone highlighted new opportunities as well as increased threats to blockchain-native platforms.

Custodians with assets of $49 trillion are not testing the waters any longer. BlackRock, Visa, and JPMorgan are actively tokenizing assets, and they are not necessarily separating validation and competition. In the case of startups, it is paradoxical: institutional entry increases the total addressable market, but it also crowds out new entrants with trillion-dollar competitors.

Public blockchain ecosystems differ fundamentally from the institutional approach. Banks develop permissioned, closed systems, which are highly regulated yet not quick to innovate. Ethereum supports unrestricted, permissionless innovation and lacks the resources to manage governed assets. Neither architecture fully solves the interoperability problem.

The move by major custodians should be viewed more as validation than competition. These institutions support the tokenized-finance operating model, although they build on private networks. Their launch drives huge compliance tool demand, valuation infrastructure, and institutional-grade operation systems.

Bridging Institutional Requirements and Public Blockchain Architecture

Various platforms are trying to resolve the issue of interoperability by setting themselves as intermediaries between authorized bank systems and the open public chains.

Mavryk, a Layer-1 blockchain built to tokenize assets in the real world, has just entered into an agreement with Multibank Group to tokenize over $10 billion of MAG's luxury real estate projects onto blockchain rails. The partnership includes properties like The Ritz-Carlton Residences Dubai, Creekside, as well as Keturah Reserve, and they will be promoted with the help of MultiBank.io on the regulated market.

The technical strategy focuses on MRC-30 token standard that incorporates regulatory specifications into asset tokens. The standard captures compliance policies, implements restrictions on transfer, and engages in primary markets, secondary trading markets, and lending procedures. By purchasing a tokenized MAG property fraction, an investor gains economic rights in token capital appreciation and rental dividend income, whereas the ownership is registered on-chain.

The architecture aims to provide what neither pure permissioned systems nor entirely open chains can offer: policy-aware networks in which assets flow with embedded KYC, valuation metadata, and transfer rules, yet are composed across multiple markets. For issuers, this translates to reduced administrative overhead and access to international investor pools. For investors, it means transparent ownership records, automated distributions, and greater liquidity within regulatory boundaries.

The model is a unique perspective on the hybrid-layer issue, in an attempt to ensure institutional compliance needs without losing the interoperability on which the effectiveness of blockchain is based.

From Treasuries to Entire Asset Classes

Given that there are platforms that focus on real estate or customized token norms, some focus on tokenizing U.S. Treasuries as the framework around which institutional adoption can proceed. Ondo Finance combines traditional finance with decentralized finance by transforming short-term U.S. Treasuries into yield-bearing tokens that trade continuously across various blockchain networks.

Ondo flagships include OUSG, which invests in short-term U.S. Treasuries based on the BUIDL fund offered by BlackRock, and USDY, a permissionless token with daily earnings while maintaining a fixed price.

Securitize takes a different approach, which is to act as an infrastructure provider to traditional asset managers entering the tokenization. In May 2024, BlackRock was the first investor in a financing round of Securitize, which confirmed the platform as a transfer agent, tokenization provider and placement agent of institutional products.

The company has a single and the only fully vertically integrated tokenization platform, which has an SEC-registered transfer agent, broker-dealer, alternative trading system, and funds administration features.

Market uncertainty arises as a result of juxtaposition of these approaches. Much of the work of both models aims to alleviate fragmentation, and neither has conclusively demonstrated the possibility of its scaling without creating new bottlenecks.

The $2 Trillion Question: Secondary Markets

For RWAs to reach $2 trillion, investors need more than primary issuance. They need the ability to borrow against these assets and integrate them into broader portfolio strategies. Without secondary-market maturity, tokenization is simply putting traditional assets on-chain without delivering any real efficiency.

The current state falls short. The majority of projects are silo based and focus on one layer: digitization of an asset or running a primary offering. They overlook the infrastructure required for liquidity, secondary markets, lending, and ongoing utility.

Fragmentation, as opposed to regulatory uncertainty, is the biggest threat. When every bank attains its own non-interoperable blockchain system, the industry will result in siloed tokenization of the industry. Trapped liquidity undermines the core benefits of digital assets: portability and composability.

What Needs to Happen in 2026

To prove to the industry that tokenized RWAs can operate at scale, 2026 would have to provide secondary-market depth and institutional-grade lending. Assets should move from the on-chain models to fully tradable portfolio instruments that have:

1. Mechanisms of liquidity that are valuation based.
2. Regulated settlement rails which link venues.
3. Unified metadata with inter-platform security transfers.
4. Technical interoperability of law between jurisdictions.

Without these pillars, tokenization will simply transfer traditional assets on-chain without any efficiency benefit. The 539,000 active RWA users are early adopters, but it will require infrastructures which are at an initial stage to scale to millions of users.

The market has come out of the experimentation phase. The next step depends on whether platforms put more focus on hype or substance, i.e., real assets, real settlement, real yield, real interoperability.

"After more than a decade and a half of endless discussions and empty promises on conference panels, tokenization is finally entering the phase where it is proving itself," Davis explains.

The next stage of expansion will rely on solutions capable of balancing the needs of institutions with the efficiency of on-chain, as well as opening doors to retail investors.

The year 2026 will show whether tokenization will evolve into financial infrastructure or it will be another story about crypto, which turns out to be limited by its inherent constraints.

\