Stablecoins have had a good run in the court of public opinion. Faster settlement, round-the-clock liquidity and cheaper cross-border payments have made them one of the most talked-about innovations in corporate finance and payments. What’s had far less airtime is the risk architecture sitting underneath that upside, a set of interlocking exposures that don’t behave like the risks treasurers and insurers are used to pricing.
How a stablecoin failure actually unfolds
The mechanics are worth spelling out because they’re not intuitive to anyone coming from traditional banking. An operational failure, a compromised signing key, a mispriced reserve asset, a custodian outage, doesn’t stay contained. It calls the issuer’s solvency into question. That triggers a race to redeem, since holders who move first get paid in full and holders who wait may not. The redemption race forces a fire sale of reserve assets, often into a market with limited depth. Losses crystallise, the peg comes under pressure and, because many holders diversify across two or three major stablecoins rather than genuinely different structures, a loss of confidence in one issuer spreads to others that had nothing to do with the original failure.
Four risk exposures worth pricing separately:
1. regulatory and compliance risk - the rulebook is being written in real time and not consistently. The US GENIUS Act framework is moving through implementation with FDIC, Treasury and FinCEN rules all out for comment through mid-2026. The EU is simultaneously reopening MiCA itself via a “MiCA 2.0” consultation targeting stablecoin reserve requirements and cross-border transfer restrictions. The Bank for International Settlements has warned that without stronger international coordination, stablecoin regulation risks severe fragmentation and harmful regulatory arbitrage between jurisdictions.
2. operational and liquidity fragmentation - interoperability across multiple, non-fungible blockchain networks fragments liquidity and creates failure points during high-congestion events or sudden redemption runs. The exposure is often indirect, sitting in vendors, payment flows and customers rather than the issuer’s own balance sheet.
3. systemic and contagion risk - the deeper stablecoins are woven into DeFi protocols and broader crypto markets, the more a shock in one venue transmits into payment flows that were never meant to be exposed to crypto volatility at all.
4. credit and counterparty exposure - holding or settling via stablecoins ties a firm’s solvency to the quality and liquidity of somebody else’s reserve assets, commercial paper, short-term treasuries or tokenised money-market funds.
Recent events show each stage in isolation. In July 2026, the AFX bridge on Arbitrum lost $24.15 million in USDC after an attacker obtained enough validator signatures to clear its approval threshold - a credential compromise rather than a code bug. In March 2026, the Resolv protocol saw an attacker exploit compromised off-chain infrastructure to mint tens of millions of dollars of its stablecoin, extracting roughly $23 million and forcing a sharp depeg within minutes. Cross-chain bridges alone lost more than $328 million across at least eight major exploits in the first seven months of 2026. None of these was the “big one” that takes down a top-five stablecoin, but each shows how fast an operational event becomes a market event.
The new layer: AI risk inside the stablecoin stack
There’s a fifth exposure that doesn’t sit neatly in the four above, and it’s growing faster than any of them: the use of AI to attack the identity and transaction layer around stablecoin issuance, custody and redemption. Deepfake-enabled identity fraud is projected to rise roughly 495% year-on-year in 2026, and synthetic identity fraud already costs businesses an estimated $20-40 billion globally each year, with losses growing quietly because there is no real victim to report them. Fraud researchers now describe AI fraud agents, automated systems that combine generated media, scripted behaviour and stolen data, and that adapt in real time when a defence blocks them. For issuers and custodians, this isn’t a side issue for the fraud team. It intersects directly with KYC and AML obligations, the integrity of Proof-of-Reserves processes, and the controls around redemption requests, exactly the workflow AI-driven impersonation is being built to exploit. A synthetic identity or deepfake-authorised instruction that triggers a large redemption at the wrong moment doesn’t just create a fraud loss; in a system already sensitive to redemption pressure, it can help trigger the very run dynamic described above.
The growing role of insurance
Most safeguarding and reserve-protection structures on the market today are built around issuer insolvency, custodian failure and reserve asset impairment - and rightly so, since those are the events that determine whether holder funds come back. But they typically exclude operational and smart-contract risk as a separate line entirely. That separation made sense when the two risk categories were largely independent. It makes less sense now that AI-enabled fraud against the identity layer can plausibly trigger a reserve or liquidity event rather than sit as a contained loss in a different silo. A new generation of products is starting to respond: parametric depeg cover that pays out automatically once a reserve ratio trigger is confirmed, dedicated reserve-shortfall and custodian-insolvency modules paid directly into a ringfenced trust account, and crime and cyber cover designed specifically for digital-asset custody. What’s still rare is a policy built with the AI-fraud-to-reserve-event pathway in mind from the outset.
The road ahead
Three developments look likely:
· regulatory convergence, eventually - fragmented rules across the US, EU and UK will keep creating arbitrage in the near term, but pressure for common standards will grow as more issuers operate cross-border.
· AI risk formally enters the stablecoin conversation - underwriters will need to treat deepfake and synthetic-identity fraud as a genuine trigger for reserve and liquidity events, not a separate line that never touches reserve risk.
· cover design catches up - expect safeguarding and depeg products to start explicitly addressing the identity and transaction-integrity layer rather than treating it as excluded operational risk.
Stablecoins’ upside case is real. So is the less-discussed downside: an architecture where an operational failure, a fraud event and a market panic aren’t three separate risks but three stages of the same event. Those who design cover and treasury policy, with that chain in mind, will be the ones who aren’t caught out when it runs. Stablecoins may ultimately be judged less by how well they hold a peg in normal conditions and more by how their surrounding infrastructure behaves under stress. A compromised identity, fraudulent instruction, custody failure or liquidity shock can each begin as a separate operational event. The more interconnected the system becomes, the greater the possibility that one failure quickly becomes another: fraud becomes redemption pressure, redemption pressure becomes forced selling and forced selling becomes a confidence event.
This raises a harder question for issuers, treasurers, insurers and regulators: are stablecoin risks still being managed as separate categories when, in practice, they may increasingly arrive as one connected chain of events?
This article first appeared in Digital Bytes (27th of October, 2026), a weekly newsletter by Jonny Fry of Team Blockchain.
How can a stablecoin failure affect the wider financial system?