Resources Categories
INDUSTRY FACT FILE · BLOCKCHAIN, WEB3 & VIRTUAL DIGITAL ASSETS
Main Products and Services in Blockchain, Web3 and Digital Assets
What India's VDA exchanges, brokers, custodians, wallet providers, Web3 and DeFi projects, NFT and gaming platforms and enterprise blockchain providers deliver, the systems behind each, and where those systems create cyber and compliance exposure.
|
In this document 1. How blockchain and digital asset businesses create value 2. Products and services by organisation type 3. The trading and custody layer: exchanges, brokers and wallets 4. The protocol layer: smart contracts, DeFi, NFTs and enterprise ledgers 5. The systems behind the products and services 6. Trends that change the attack surface 7. Mapping operations to Codec Networks engagements |
1. How blockchain and digital asset businesses create value
|
Revenue stream |
How it works |
Security relevance |
|
Trading fees and spreads |
Fees on spot and derivatives trades, and spreads on brokered and OTC orders |
Matching engine integrity, API security, account takeover |
|
Deposits and withdrawals |
Fees and float on rupee and VDA deposits and withdrawals |
Hot wallet exposure, payment fraud, mule accounts |
|
Custody and staking services |
Fees for safekeeping, administration and staking of client assets |
Key protection, MPC and HSM controls, insider risk |
|
Protocol fees |
Fees earned by DeFi protocols on lending, swaps and bridging |
Smart contract flaws, oracle manipulation, upgrade risk |
|
NFT and in-game sales |
Primary mints, marketplace royalties and in-game item sales |
Phishing, drainer contracts, community account security |
|
Enterprise and platform services |
Licences, blockchain-as-a-service and integration fees |
Node, certificate and access control security, data privacy |
2. Products and services by organisation type
|
Organisation type |
Main products and services |
Key systems |
|
VDA exchanges |
Spot and derivatives trading, INR deposits and withdrawals, APIs for traders, mobile apps |
Matching engine, wallets, KYC, payment integrations, APIs, cloud |
|
Brokers and OTC desks |
Assisted and app-based execution, block trades, liquidity sourcing |
Order routing, operational wallets, partner venue API keys |
|
Custodians |
Cold storage, MPC custody, staking and administration for clients |
HSMs, MPC nodes, signing policies, key ceremonies, vaults |
|
Wallet providers |
Custodial and self-custody wallets, browser extensions, SDKs |
Mobile and extension apps, key storage, RPC connections |
|
Web3 and DeFi projects |
Lending, decentralised exchange, staking and bridging protocols |
Smart contracts, admin keys, oracles, front ends, nodes |
|
NFT and gaming platforms |
Mints, marketplaces, in-game assets and community programmes |
Token contracts, marketplaces, game wallets, community channels |
|
Enterprise blockchain and tokenisation |
Permissioned ledgers for trade, supply chain, records and tokenised assets |
Nodes, chaincode, certificate authorities, APIs, HSMs |
3. The trading and custody layer: exchanges, brokers and wallets
Exchanges and brokers are, in practice, large web and mobile businesses with a bank-like treasury attached. Customers onboard through KYC systems that FIU-IND's 2026 Guidelines expect to capture liveness-checked selfies, geo-location, IP and device data and to verify bank accounts by penny drop. They deposit rupees through banking and payment partners, or VDAs to deposit addresses watched by blockchain monitoring services; they trade through a matching engine, mobile apps and APIs that professional traders and bots call thousands of times a minute; and they withdraw through a withdrawal engine that must screen destinations, apply travel rule data to transfers and sign transactions from hot wallets. Each of those systems carries ordinary application security risk, from broken authorisation to credential stuffing, and each sits close to money.
Custody is where most of the value sits and where the largest thefts happen. Platforms typically keep a small share of assets in hot wallets for instant withdrawals, larger reserves in warm wallets, and the rest in cold storage protected by multisig schemes, multi-party computation (MPC) or hardware security modules, often through third-party custody software. WazirX's loss in 2024 and Bybit's in 2025 both came from multisig wallets where signers approved what they believed was a routine transaction, and CoinDCX's 2025 loss came from an internal operational account used for liquidity on a partner exchange. The lesson is that custody security depends as much on what signers see, how signing tools are delivered, how operational wallets are governed and whether every address is monitored as on the strength of the keys themselves.
4. The protocol layer: smart contracts, DeFi, NFTs and enterprise ledgers
Web3 and DeFi projects publish their business logic as smart contracts on public chains such as Ethereum, Solana and Polygon. Lending pools, decentralised exchanges, staking contracts and cross-chain bridges hold user funds directly in code, and anyone can read and call that code. A logic error, a missing validation, a manipulable price oracle or an unsafe upgrade can be exploited within minutes, and copycats often repeat a successful exploit once it is visible on-chain, as happened when a faulty upgrade left the Nomad bridge open in August 2022. Admin keys that can pause or upgrade contracts are themselves high-value targets. NFT marketplaces and Web3 games add a community layer: mints announced on social channels, moderators with privileged accounts and players who sign token approvals they may not fully understand, which is why drainer links and phished community accounts cause so much loss.
Enterprise blockchain looks different but carries its own risks. Permissioned ledgers for trade finance, supply chains, land and academic records and tokenised assets run on known members' nodes, with identities issued by a membership certificate authority and business rules written in chaincode. MeitY's National Blockchain Framework, launched in September 2024 with the Vishvasya blockchain technology stack and hosted at NIC data centres, offers permissioned blockchain-as-a-service for government applications, and the e-rupee pilots show the central bank testing digital currency rails. In these systems the main risks are member node compromise, stolen signing certificates, weak access control in chaincode, exposed APIs and personal data written to ledgers that cannot easily be erased, a design issue that matters under the DPDP Act.
|
Highest-risk moments Listing a new token or chain, launching or upgrading smart contracts, migrating custody software or wallet providers, rotating signers and key ceremonies, sharp market moves that bring traffic and withdrawal surges, mints and community launches, onboarding new banking, liquidity or node partners, FIU-IND registration and renewal cycles, and staff exits from treasury or DevOps roles are where digital asset incidents typically begin or escalate. |
5. The systems behind the products and services
Figure 2: Where cyber risk sits across the digital asset lifecycle.
|
Product / service |
Systems that deliver it |
Key cyber and compliance touchpoints |
|
Onboarding and KYC |
KYC and liveness checks, penny drop, risk scoring, sanctions screening |
Synthetic identity and mule defences, data minimisation, audit trails |
|
Deposits and funding |
Banking and payment integrations, deposit addresses, chain watchers |
Payment fraud controls, deposit validation, address monitoring |
|
Trading |
Matching engine, order books, mobile apps, trading APIs |
API key security, account takeover defences, rate limits |
|
Custody and signing |
Hot, warm and cold wallets, MPC nodes, multisig, HSMs, custody software |
Signing policies, transaction decoding, key ceremonies, PAM |
|
Withdrawals and bridging |
Withdrawal engine, travel rule messaging, bridges, nodes and RPCs |
Destination screening, limits and time-locks, node hardening |
|
Reporting and recovery |
STR workflows, logs, reserve reporting, on-chain analytics |
Tamper-proof trails, six-hour reporting, forensic readiness |
6. Trends that change the attack surface
|
Trend |
What is changing |
Security implication |
|
Tighter AML expectations |
FIU-IND's 2026 Guidelines add liveness, geo-tagging, travel rule and unhosted wallet controls |
KYC, monitoring and record systems need security testing |
|
Cyber audits for registration |
FIU-IND linked registration to a CERT-In empanelled cyber security audit in 2025 |
Annual audit cycles and evidence become routine |
|
Attacks on signing interfaces |
2024 and 2025 thefts came through what multisig signers were shown |
Independent decoding and tooling assurance needed |
|
Cross-chain activity |
Bridges and multi-chain wallets move value between networks |
Bridge, validator and relayer security matters more |
|
State-linked theft |
Chainalysis attributes most 2025 theft by value to North Korea-linked hackers |
Social engineering of staff and developers must be expected |
|
Tokenisation and enterprise DLT |
Permissioned ledgers and government blockchain services expand |
Node, certificate and data privacy controls needed |
7. Mapping operations to Codec Networks engagements
|
If the organisation operates… |
Recommended starting engagement |
|
A VDA exchange or broker |
CERT-In empanelled audit for FIU-IND registration, exchange app and API VAPT, wallet and withdrawal path review |
|
Custody, MPC or multisig wallets |
Custody architecture, signing policy, HSM and key ceremony review, signer interface assurance |
|
DeFi protocols or smart contracts |
Smart contract audit with fuzzing, oracle and upgrade review, admin-key and timelock review |
|
Nodes, validators, RPCs or bridges |
Node and infrastructure hardening review, bridge and relayer assessment, monitoring |
|
NFT marketplaces or Web3 games |
Token contract audit, marketplace and game wallet testing, community account security |
|
Enterprise blockchain or tokenisation |
Chaincode and access control review, node and certificate security, DPDP design review |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by organisation, activity, chains supported and agreements in force. Nothing in this document is investment advice or an endorsement of any asset or platform.