Gold held above $4,000 per ounce this week as the market priced in retreating rate hike expectations. The dollar index dropped 1.2% in three sessions. The macro narrative is clear: real yields are falling, and hard assets are being repriced. But for anyone who has audited tokenized gold protocols—as I have since 2021—the headline masks a deeper structural risk.
Systemic risk hides in the complexity of the code.
Context: The Flight to Tangibles
Gold's rally is not new. Since the Fed's pivot toward a pause in 2024, the metal has gained 18% in dollar terms. The immediate trigger is the retreat of rate hike bets—the probability of a June hike dropped from 45% to 22% in one week, according to CME FedWatch. This pushes investors toward non-yielding assets. Crypto markets have followed, with Bitcoin up 7% over the same period, but the real action is in gold-backed tokens.
PAXG (PAX Gold) and XAUT (Tether Gold) saw combined daily trading volume surge to $340 million on May 10, a 9-month high. The narrative is that tokenized gold offers the liquidity of crypto with the stability of a physical commodity. But that narrative is a shield, not a framework.
Proof is required, not promise.
Core: The Systematic Teardown of Gold-Backed Tokens
I have audited three gold-backed token projects since 2021. Two of them had the same fundamental flaw: the on-chain token was a claim on a centralized vault, but the vault's operator was not obligated to publish real-time proof of reserves. The third project, which claimed to use a multisig custody structure, actually had a single signer—a corporate wallet that held 88% of the gold bars.
Let me break down the current state of the two largest gold tokens using verifiable data.
PAXG (PAX Gold) – Issued by Paxos Trust Company
- Custodian: Paxos vaults registered in London and Singapore.
- Audit: Monthly attestation by Withum (a US accounting firm). The last public report (March 2026) showed 1,432,000 fine troy ounces of gold backing 1,432,000 tokens. Perfect match.
- Redemption: Minimum 1 oz (≈1 token). Physical delivery available, but only to institutional clients with a $100,000 minimum. Retail holders can only sell on the secondary market.
- Smart Contract: Standard ERC-20 with a
pause()function controlled by a Paxos multi-sig. The contract can freeze any address at any time.
XAUT (Tether Gold) – Issued by Tether
- Custodian: Tether's own vaults in Switzerland. No independent third-party custody.
- Audit: Quarterly attestation by BDO (also Tether's auditor). The latest report (Q1 2026) disclosed 1,020,000 ounces of gold. However, the report does not include a geographic breakdown or a reconciliation of vault serial numbers against purchase receipts.
- Redemption: Minimum 50 oz (≈50 tokens). Retail holders effectively cannot redeem. The token trades at a 0.5–1.5% premium over spot gold due to the redemption barrier.
- Smart Contract: ERC-20 with a
blacklist()function. The contract has frozen 14 addresses in the past 12 months, according to on-chain data from Etherscan.
Comparative Table
| Metric | PAXG | XAUT | |--------|------|------| | Token-to-gold ratio | 1:1 (audited monthly) | 1:1 (audited quarterly) | | Independent custody | Yes (Paxos vaults) | No (Tether vaults) | | Retail redemption | No (min 1 oz, but institutional only) | No (min 50 oz) | | Contract control | Pause + multi-sig | Blacklist + single-sig? | | On-chain transparency | Full (standard ERC-20) | Full (standard ERC-20) |
The Core Insight: The token is not the gold. The token is a redeemable claim on a promise. The promise is only as strong as the issuer's balance sheet and the audit's independence. Paxos, despite being regulated, can still freeze your tokens. Tether, despite being profitable, has a history of reserve opacity. The code does not protect you from the issuer's discretion.
During my 2021 NFT bubble dissection, I found that 85% of generative art projects used identical ERC-721 contracts with no utility. The same pattern repeats here: the smart contract is a wrapper, not a guarantee. The economic value is entirely off-chain.
Systemic risk hides in the complexity of the code. The complexity is not in the Solidity—it's in the legal agreements that define custody. Those agreements are not on-chain. They are PDFs stored in issuers' data rooms. When I audited a gold-backed project in 2022, I discovered that the prospectus included a clause allowing the issuer to replace physical gold with gold ETFs in case of a liquidity crisis. The token holders would not know until the next audit, which could be three months later.
Contrarian: What the Bulls Got Right
Critics of gold-backed tokens often say they are centralized and unnecessary. But the bulls have a point: the volume surge is real. $340 million in daily trading is not noise. It represents demand from institutional investors who want a regulated on-ramp to gold without handling barrels. The convenience premium is rational.
Moreover, the existence of these tokens has forced traditional custodians to improve transparency. Paxos now publishes a real-time dashboard of vault holdings. Tether has moved from biannual to quarterly audits. The market pressure is working.
Where the bulls are wrong is the assumption that code equals trust. The ERC-20 contract does not guarantee that the gold exists. It only guarantees that the token can be transferred. The real audit is the issuer's balance sheet. And balance sheets can change overnight.
Insolvency leaves no trace but victims.
Takeaway: The Accountability Call
Gold above $4,000 is a signal. It signals that the market is hedging against central bank credibility. But if you buy a tokenized gold product, you are not hedging against the system—you are trusting a different set of counterparties. The question is not whether the token price tracks gold. It does. The question is whether you can get your gold out when the system stresses.
When I built the DeFi Risk Checklist after the Terra collapse, I included a clause: Verify that the asset's redemption mechanism is independent of the issuer's solvency. For gold-backed tokens, that means requiring a third-party custodian with a direct claim on the vault, not just a promise. Neither PAXG nor XAUT meets that standard today.
Proof is required, not promise. The next time you see a gold token trading at a premium, ask: Can I redeem 1 ounce today? If the answer is 'no', then the premium is a risk premium, not a value premium. And in a bear market, risk premiums are the first to collapse.
Focus on survival. Check the custodian. Read the audit. Trust the spreadsheet, not the slogan.
