Opinion by: Darren Carvalho, Co-Founder and Co-CEO of MetaWealth

During Paris Blockchain Week, Securitize Chief Operating Officer Michael Sonnenshein made headlines by dismissing real estate as a sub-optimal asset class for tokenization. This isn’t the first time crypto leaders have underestimated the merits of bringing real estate onchain, and it is likely not the last. While I respect Sonnenshein’s contributions to digital asset adoption, his assessment misses fundamental points about real estate tokenization’s transformative potential.

Real estate represents the world’s largest asset class and is projected to reach a value of $654.39 trillion this year, according to Statista. When industry leaders claim that this massive market isn’t suitable for tokenization, they overlook today’s transformative infrastructure and the core value proposition that extends far beyond liquidity, transforming access to the asset class.

Replacing traditional foundations

Sonnenshein argues that “good systems” already exist for traditional assets. He implies that tokenization offers marginal improvements at best, but this assessment overlooks fundamental inefficiencies in today’s real estate market that tokenization addresses.

The current real estate transaction process involves weeks of paperwork. Within the UK, there are a number of purchasing fees which can easily add 10% to the total bill. Settlement periods can extend to months and complexity multiplies exponentially for cross-border transactions.

These aren’t minor flaws. They’re systemic failures that tokenization technology is uniquely positioned to solve. Take smart contracts’ ability to automate compliance, for instance, enabling verification and payment distribution while reducing fraud through immutable record-keeping.

Redefining demand beyond liquidity

When Sonnenshein says “the onchain economy is demanding more liquid assets,” he misinterprets what everyday investors truly demand. For the 99% excluded from institutional-grade real estate investments, the primary task is not Bitcoin-like liquidity; it’s meaningful access to an asset class that has built more wealth than any other over the past century.

Traditional real estate investment vehicles require significant sums as minimum investments, accredited investor status and multi-year capital lockup periods. These barriers effectively exclude teachers, nurses and middle-class families from participating in prime real estate properties that have historically delivered consistent returns for investors.

Recent: Dubai Land Department begins real estate tokenization project

Tokenization fundamentally changes this equation. Fractionalizing ownership through tokenization, investors can now participate with as little as $100, receive proportional income distributions and eventually trade their positions on specialized secondary markets. The demand for this democratized access is enormous, even if secondary market liquidity initially lags behind liquid markets.

Translation problems? Not quite

Sonnenshein also suggests that tokenization does not “translate well” to representing ownership in real estate. This assessment overlooks the blockchain’s revolutionary capability to enable fractional investments in properties that were previously accessible only to institutional investors.

Tokenization technology excels precisely at creating transparent, secure fractional investment opportunities with minimal overhead. A $50 million residential development project can be divided into 500,000 tokens, each getting an equal share of the rental income and potential appreciation. This dramatically lowers barriers to entry while maintaining the core benefits of real estate as an asset class.

This fractionalization fundamentally transforms how people can build wealth through real estate. Previously, REITs offered the only realistic path to diversified property exposure, often with high fees, no control and limited transparency. Tokenization allows investors to build personalized portfolios across multiple property types, all managed through a single digital wallet.

What does not “translate well” isn’t the technology. Outdated regulatory frameworks and incumbent business models resist this necessary evolution. The UAE government recognizes this reality, supported by its recent initiative to tokenize $1 billion in real estate assets.

Building tomorrow’s infrastructure

The conservative stance on RWA growth projections misses the accelerating infrastructure development underway. BlackRock’s tokenized money market fund BUIDL is quickly approaching $3 billion in assets, demonstrating a significant institutional appetite for tokenized investment vehicles. This isn’t an isolated case.

UBS Asset Management, Hamilton Lane, Franklin Templeton and many more have launched tokenized investment vehicles, signaling a fundamental shift in how traditional finance views tokenization technology.

What critics consistently underestimate is the network effect of financial infrastructure. Each institutional entrant doesn’t just add linearly to the ecosystem. It exponentially increases connectivity and liquidity pools. We’re witnessing the early stages of a self-reinforcing cycle where each new participant reduces friction for subsequent entrants.

The narrative shouldn’t center on current limitations. Instead, there should be a spotlight on what’s being built. Secondary marketplaces optimized for real-world assets are emerging, regulatory clarity is increasing in key jurisdictions, and each development strengthens the foundation for mass adoption at a pace that will likely surprise today’s skeptics.

Democratized wealth creation

Institutional investors have enjoyed privileged access to the most profitable real estate investments for decades, while retail investors were limited to residential properties or high-fee REITs. Tokenization breaks this paradigm by allowing anyone to build a diversified property portfolio spanning commercial, residential and industrial assets across multiple geographies.

When crypto leaders dismiss real estate tokenization based solely on liquidity metrics, they apply the wrong measurement standard. The transformative potential lies in democratizing access to an asset class that has created more millionaires than any other investment vehicle in history.

The endgame of real estate tokenization is making institutional-grade property investments accessible to everyone. The adoption of tokenized real estate and other real-world assets will continue to grow despite skepticism from executives who miss the forest for the trees.

Opinion by: Darren Carvalho, Co-Founder and Co-CEO of MetaWealth.

This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.

The crypto industry is no stranger to controversy, yet few projects have drawn more scrutiny than Sam Altman’s World, formerly known as Worldcoin.

Promising to verify human uniqueness through iris scans and distribute its WLD token globally, World positions itself as a tool for financial inclusion. However, critics argue the project’s biometric methods are invasive, overly centralized, and at odds with the ethos of decentralization and digital privacy.

At the heart of the critique is the claim that biometric identity systems cannot be truly decentralized when they rely on proprietary hardware, closed authentication methods, and centralized control over data pipelines.

“Decentralization isn’t just a technical architecture,” Shady El Damaty, co-founder of Holonym Foundation, told Cointelegraph. “It’s a philosophy that prioritizes user control, privacy, and self-sovereignty. World’s biometric model is inherently at odds with this ethos.”

El Damaty argued that despite using tools like multiparty computation (MPC) and zero-knowledge (ZK) proofs, World’s reliance on custom hardware — the Orb — and centralized code deployment undermines the decentralization it claims to champion.

“This is by design to achieve their goals of uniquely identifying individual humans. This concentration of power risks creating a single point of failure and control, undermining the very promise of decentralization,” he said.

When reached out for comment, a spokesperson for World pushed back against these claims. “World does not use centralized biometric infrastructure,” they said, adding that the World App is non-custodial, meaning users remain in control of their digital assets and World IDs.

The project said once the Orb generates an iris code, the “iris photo will be sent as an end-to-end encrypted data bundle to your phone and will be immediately deleted from the Orb.” The iris code, they claimed, is processed with anonymizing multiparty computation so “no personal data is stored.”

World’s disclosure regarding personal custody. Source: World

Evin McMullen, co–founder of Privado ID and Billions.Network, said that World’s biometric model is not “inherently incompatible” with decentralization but faces some challenges in implementation around data centralization, trust assumptions, and governance.

Related: Sam Altman’s World raises $135M from Andreessen, Bain, to expand network

A pattern of tech overreach?

El Damaty also drew a parallel between OpenAI’s large-scale scraping of “unconsented user data” and World’s collection of biometric information.

He argued that both reflect a pattern of aggressive data acquisition framed as innovation, warning that such practices risk eroding privacy and normalizing surveillance under the banner of progress.

“The irony here is hard to miss,” El Damaty claimed. “OpenAI built its foundation by scraping vast amounts of unconsented user data to train its models, and now Worldcoin is taking that same aggressive data acquisition approach into the realm of biometric identity.”

In 2023, a class-action lawsuit filed in California accused OpenAI and Microsoft of scraping 300 billion words from the internet without consent, including personal data from millions of users, such as children.

In 2024, a coalition of Canadian media outlets, including The Canadian Press and CBC, sued OpenAI for allegedly using their content without authorization to train ChatGPT, claiming copyright infringement.

ChatGPT storing personal information against its claims. Source: Sandi Fatic

World, however, rejects this comparison, emphasizing that it is a separate entity from OpenAI. The company said that it neither sells nor stores personal data, citing its use of privacy-preserving technologies such as multiparty computation and zero-knowledge proofs.

The scrutiny also extends to World’s user onboarding. The project says it ensures informed consent through translated guides, an in-app Learn module, brochures, and a Help Center.

However, critics remain skeptical. “People in developing nations, who World… has mainly been targeting up until this point, are easier to bribe and often don’t understand the risks involved with ‘selling’ this personal data,” El Damaty warned.

Several global regulators have pushed back on World’s operations since its launch in July 2023, with governments like Germany, Kenya and Brazil expressing concerns over potential risks to the security of users’ biometric data.

In the most recent setback, the company faced challenges in Indonesia after local regulators temporarily suspended its registration certificates on May 5.

Related: ‘Humans can tell when it’s a human’ — Community mocks Worldcoin’s Orb Mini

The risk of digital exclusion

As biometric systems like World’s gain traction, questions are emerging about its long-term implications. While the company promotes its model as inclusive, critics say the reliance on iris scans to unlock services could deepen global inequality.

“When biometric data becomes a prerequisite for accessing basic services, it effectively creates a two-tiered society,” said El Damaty. “Those willing (or coerced) into giving up their most sensitive information gain access… while those who refuse… are excluded.”

World maintained that its protocol does not require biometric enrollment for basic participation. “You can still use an unverified World ID for some purposes even if you do not visit an Orb,” it said, adding that the system uses ZKPs to prevent linking actions back to any specific ID or biometric data.

There are also concerns that World could become a surveillance tool — especially in authoritarian regimes — by centralizing biometric data in a way that may attract misuse by powerful actors.

World dismisses these claims, asserting that its ID protocol is “open source, permissionless,” and designed so even government applications cannot tie back a user’s activity to their biometric data.

The debate also extends to governance. While World says its protocol is moving toward greater decentralization — highlighting open-source contributions and the governance section of its white paper — critics argues that meaningful user ownership is still lacking.

“We need to build systems that allow individuals to prove their humanity without creating centralized repositories of biometric or personal data,” said El Damaty. “This means embracing zero-knowledge proofs, decentralized governance, and open standards that empower individuals, not corporations.”

Related: Sam Altman’s eye-scanning crypto project World launches in US

The need for secure identity systems

The urgency behind developing secure identity systems isn’t without merit. As artificial intelligence grows more sophisticated, the lines between human and non-human actors online are blurring.

“Risks at the nexus of AI and identity are not limited to any one kind of government system or region,” Privado ID’s McMullen said. She claimed that without reliable verification for both humans and AI agents, digital ecosystems face growing threats—from misinformation and fraud to national security vulnerabilities.

“This is a national security nightmare, where unaccountable, unverifiable non-human actors may now be able to engage with global systems and networks, and legacy systems are not built for these types of verification and contextual logic,” McMullen added.

Magazine: Bitcoin bears eye $69K, CZ denies WLF ‘fixer’ rumors: Hodler’s Digest, May 18 – 24

AI agents in crypto are increasingly embedded in wallets, trading bots and onchain assistants that automate tasks and make real-time decisions.

Though it’s not a standard framework yet, Model Context Protocol (MCP) is emerging at the heart of many of these agents. If blockchains have smart contracts to define what should happen, AI agents have MCPs to decide how things can happen.

It can act as the control layer that manages an AI agent’s behavior, such as which tools it uses, what code it runs and how it responds to user inputs.

That same flexibility also creates a powerful attack surface that can allow malicious plugins to override commands, poison data inputs, or trick agents into executing harmful instructions.

Amazon- and Google-backed Anthropic dropped MCP on Nov. 25, 2024, to connect AI assistants to data systems. Source: Anthropic

MCP attack vectors expose AI agents’ security issues

According to VanEck, the number of AI agents in the crypto industry had surpassed 10,000 by the end of 2024 and is expected to top 1 million in 2025.

Security firm SlowMist has discovered four potential attack vectors that developers need to look out for. Each attack vector is delivered through a plugin, which is how MCP-based agents extend their capabilities, whether it’s pulling price data, executing trades or performing system tasks.

Data poisoning: This attack makes users perform misleading steps. It manipulates user behavior, creates false dependencies, and inserts malicious logic early in the process.

JSON injection attack: This plugin retrieves data from a local (potentially malicious) source via a JSON call. It can lead to data leakage, command manipulation or bypassing validation mechanisms by feeding the agent tainted inputs.

Competitive function override: This technique overrides legitimate system functions with malicious code. It prevents expected operations from occurring and embeds obfuscated instructions, disrupting system logic and hiding the attack.

Cross-MCP call attack: This plugin induces an AI agent to interact with unverified external services through encoded error messages or deceptive prompts. It broadens the attack surface by linking multiple systems, creating opportunities for further exploitation.

Sequence diagram showing potential cross-MCP attack vectors and risk points. Source: SlowMist

These attack vectors are not synonymous with the poisoning of AI models themselves, like GPT-4 or Claude, which can involve corrupting the training data that shapes a model’s internal parameters. The attacks demonstrated by SlowMist target AI agents — which are systems built on top of models — that act on real-time inputs using plugins, tools and control protocols like MCP.

Related: The future of digital self-governance: AI agents in crypto

“AI model poisoning involves injecting malicious data into training samples, which then becomes embedded in the model parameters,” co-founder of blockchain security firm SlowMist “Monster Z” told Cointelegraph. “In contrast, the poisoning of agents and MCPs mainly stems from additional malicious information introduced during the model’s interaction phase.” 

“Personally, I believe [poisoning of agents] threat level and privilege scope are higher than that of standalone AI poisoning,” he said.

MCP in AI agents a threat to crypto

The adoption of MCP and AI agents is still relatively new in crypto. SlowMist identified the attack vectors from pre-released MCP projects it audited, which mitigated actual losses to end-users. 

However, the threat level of MCP security vulnerabilities is very real, according to Monster, who recalled an audit where the vulnerability may have led to private key leaks — a catastrophic ordeal for any crypto project or investor, as it could grant full asset control to uninvited actors.

Crypto developers may be new to AI security, but it’s an urgent issue. Source: Cos

“The moment you open your system to third-party plugins, you’re extending the attack surface beyond your control,” Guy Itzhaki, CEO of encryption research firm Fhenix, told Cointelegraph.

Related: AI has a trust problem — Decentralized privacy-preserving tech can fix it

“Plugins can act as trusted code execution paths, often without proper sandboxing. This opens the door to privilege escalation, dependency injection, function overrides and — worst of all — silent data leaks,” he added. 

Securing the AI layer before it’s too late

Build fast, break things — then get hacked. That’s the risk facing developers who push off security to version two, especially in crypto’s high-stakes, onchain environment.

The most common mistake builders make is to assume they can fly under the radar for a while and implement security measures in later updates after launch. That’s according to Lisa Loud, executive director of Secret Foundation.

“When you build any plugin-based system today, especially if it’s in the context of crypto, which is public and onchain, you have to build security first and everything else second,” she told Cointelegraph.

SlowMist security experts recommend developers implement strict plugin verification, enforce input sanitization, apply least privilege principles, and regularly review agent behavior.

Loud said it’s “not difficult” to implement such security checks to prevent malicious injections or data poisoning, just “tedious and time consuming” — a small price to pay to secure crypto funds.

As AI agents expand their footprint in crypto infrastructure, the need for proactive security cannot be overstated. 

The MCP framework may unlock powerful new capabilities for those agents, but without robust guardrails around plugins and system behavior, they could turn from helpful assistants into attack vectors, placing crypto wallets, funds and data at risk.

Magazine: Crypto AI tokens surge 34%, why ChatGPT is such a kiss-ass: AI Eye