Digital currency security: what changes when security enters early?

TL;DR: Digital currency programmes that defer security until after build sign-off accumulate design and key-management risk, according to CertiK, and the article cites 3.35 billion in Web3 losses in 2025 plus 1.31 billion across 344 incidents in H1 2026. Security has to move into the earliest design stages because once money is live, control changes become expensive and confidence is harder to rebuild.

Editorial analysis by NHI Mgmt Group, based on content published by CertiK: “How Central Banks Secure Digital Currency before Launch: Inside the CertiK and NBKR Deal”.

By the numbers:

• Web3 losses reached 3.35 billion in 2025, according to CertiK.
• Web3 losses reached 1.31 billion across 344 incidents in the first half of 2026, according to CertiK.
• CertiK says it has protected more than 600 billion in digital assets across more than 150 countries and regions since 2017.

Key questions

Q: What is the first control to put in place for a central bank digital currency programme?

A: The first control is to make security part of the architecture decision process, not a review step after build completion.

Q: Why do custody and key management matter so much in digital asset systems?

A: Because they determine who can move value, recover access, or override controls.

Q: What are the signs that a digital asset control model is failing?

A: The warning signs are delayed security review, unclear signing authority, weak evidence for supervisory oversight, and reliance on point-in-time assurance for a live system.

Practitioner guidance

• Embed security in the design phase Bring security and resilience review into architecture, key management, and supervisory design before any launch decision is finalised.
• Separate custody from operational access Define who can sign, who can recover, and who can monitor the system, then enforce those roles as distinct privileged functions.
• Use formal verification for high-impact behaviours Apply mathematical proof to the behaviours that matter most, such as value transfer, access boundaries, and recovery logic.

Bottom line: The article shows that digital currency risk grows when security is treated as a final checkpoint instead of a design constraint.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →