Risk assessment must evolve to navigate digital asset M&A

When a company acquires or merges with a digital asset business, they’re not just acquiring people, products, and intellectual property — they’re acquiring every onchain transaction that has ever occurred on that technology stack. These touchpoints could range from the mundane to high risk; from routine operational activity to exposure to sanctioned entities or opaque fund flows.

As traditional finance and digital asset markets continue to converge, mergers and acquisitions are gathering pace in both directions; from Stripe’s $1.1 billion acquisition of crypto infrastructure company Bridge, to Ripple’s $1.25 billion purchase of prime brokerage Hidden Road. In 2024 alone, digital asset M&A volumes reached $15.8 billion, an incredible surge from just $1 billion in 2019. 

In this converging market, digital footprints on the blockchain aren’t just background noise. They’re risk signals; without proper onchain analysis, they can quickly become potential liabilities. Legacy frameworks, focused on balance sheets, market position, leadership, and reputation factors, remain essential but don’t tell the whole story. 

Without integrating traditional risk assessments with onchain data, businesses operate with an incomplete picture. This can be detrimental not just for the deal but also for wider trust and stability in the industry when products are being developed at the nexus of fiat and crypto. 

That’s why today’s M&A deals require an evolved risk assessment. 

Onchain data is the layer of truth 

Traditional risk assessments start with the fundamentals: order book depth, workforce structure and leadership stability, treasury and reserve transparency and reputation, as well as regulatory compliance — all central to traditional deal-making.

However, this process alone is no longer sufficient for digital asset M&A. Analyzing and understanding onchain data in combination with conventional methods is the only way to reveal certain risk pockets and operational red flags. In short, reconciling onchain insights with off-chain data.

Consider this scenario. An assessment of a digital asset firm may pass standard reputational due diligence, with traditional compliance checks revealing no direct exposure to sanctioned jurisdictions or entities. These checks don’t account for blockchain transactions’ decentralized or pseudonymous nature and may have no visibility into wallet transactions or previous DeFi activity. Critical risks can be missed without integrating and analyzing onchain data. 

Historical transactions with high-risk wallets or protocols can indicate reputational and legal red flags. Mixers, for example, can be used as obfuscation tools to conceal the origin and destination of funds. 

Further onchain analysis may uncover repeated treasury interactions with wallets tied to a darknet marketplace offering stolen data, money laundering services, or tools to conduct fraud. These onchain indicators represent more than compliance oversights; they introduce tangible reputational, financial, and legal risk and potential penalties from regulators and other agencies. 

This is just one example. Other onchain risk indicators can range from overexposure to a specific token to illiquid or highly concentrated positions, as we saw with the collapse of crypto lender Celsius, or even extend to unreliable technical infrastructure that could challenge future integrations.

Governance structure matters too; onchain voting data can reveal which actors in an ecosystem truly direct and make decisions about the blockchain, further informing actual ownership and corporate structure.

Despite its apparent benefits, onchain data alone can miss critical off-chain exposures. In 2022, FTX appeared healthy. Blockchain data could have flagged certain risks like low liquidity in its token FTT, or movement of large sums between FTX and Alameda Research. Still, it wouldn’t have revealed the core fraud, which was the commingling of customer funds by Sam Bankman-Fried and the false claim of solvency. 

Moving toward a hybrid, holistic approach 

To understand the risks and opportunities in a digital asset M&A, off-chain data must supplement onchain risk signals to achieve a flexible and evolved risk management framework. This is the only way to adequately equip businesses to assess and identify risks originating from M&As. 

Most importantly, this hybrid approach doesn’t replace legacy frameworks; it enhances them. A recent EY report found that 83% of institutional investors plan to increase allocations to digital assets. With that level of interest comes greater pressure to apply rigorous, fit-for-purpose oversight. Data-first due diligence, combining onchain and off-chain signals, will be essential for assessing counterparties, managing integration, and safeguarding long-term value.

Trust remains the linchpin of successful M&A. Blockchain, with its immutable trails, is a powerful tool for building, confirming, and maintaining this trust. But this can only be achieved if the right data is being used and the right questions are being asked. 

The future of finance depends on our ability to bridge old and new systems. That means evolving how we see and manage risks; meeting transparency with intelligence.