Executive TL;DR• In 2018, security tokens were described as the inevitable next phase of blockchain finance: a regulatory-compliant version of the initial coin offering, turning securities law compliance into a feature rather than an obstacle. tZERO raised $134 million in the largest STO at that point. Polymath launched the ST-20 standard. Securitize began building what would become the dominant institutional tokenisation platform. • The market stalled almost immediately after launch. The three specific failure modes: first-generation platforms focused entirely on issuance and built almost no secondary market infrastructure; the accredited-only investor pools created by Regulation D and Regulation S exemptions were too thin to support trading volume; and the exchange and settlement infrastructure needed to trade tokenised securities did not exist as a regulated institutional product. • Security tokens did not disappear they became invisible. Securitize, Polymath, and tZERO continued operating through the market’s absence of public attention, each building different pieces of what the second generation would need. Securitize accumulated $4 billion in tokenised assets from clients including Apollo, BlackRock, and KKR. Polymath built Polymesh an institutional-grade, permissioned blockchain where compliance is built into the base layer rather than layered on top. tZERO received FINRA regulatory approvals expanding its ability to clear and settle digital asset securities. • The 2026 revival is structural, not speculative. The NYSE named Securitize the first digital transfer agent for blockchain-native securities in March 2026. DTCC conducted first live tokenised securities settlement in July 2026. The second generation is building what the first generation assumed would emerge organically: post-issuance infrastructure for trading, settlement, corporate actions, and investor exit. • The second-generation insight, articulated by Tokenfrastructure (May 2026): the answers to what happens after issuance how shares trade, settle, distribute dividends, accept votes look strikingly little like DeFi. They look like exchanges. |
The security token market of 2018 had all the characteristics of a category that had correctly identified the problem illiquid, access-restricted private markets; the friction cost of manual securities processing; the compliance overhead of managing investor eligibility across jurisdictions and reached the correct conclusion that blockchain-based securities could address those problems. What it had not built was any of the infrastructure between that conclusion and the functional market that would demonstrate the thesis. The result was a four-year period of near-invisibility between a boom that generated significant capital and attention and a revival that is currently building the infrastructure the boom assumed would exist.
The 2018 STO Boom: What Actually Happened
The Players Who Launched
Three platforms defined the 2018 STO era. Polymath positioned itself as the ‘Ethereum of security tokens,’ building the ST-20 token standard to simplify the creation and trading of compliant securities on Ethereum. Its claim was that it would migrate trillions of dollars of securities to the blockchain; its mechanism was a technical standard for compliance-enforced tokens. Securitize launched as an end-to-end compliance and issuance platform, building the DS Protocol and the Digital Securities (DS) Token Standard a compliance layer that embedded transfer restrictions on-chain. tZERO launched as both an STO issuer (raising $134 million in its own token sale) and a regulated alternative trading system for security tokens.
What Was Expected vs What Happened
| Expectation (2018) | Reality (2019-2023) |
|---|---|
| Secondary market liquidity would develop as tokens launched | Secondary markets remained thin; trading volume on tZERO was minimal relative to issued supply |
| Accredited investor pools would grow as more investors recognised the category | Regulation D/S constraints kept pools small; no mechanism to expand beyond accredited US or offshore investors |
| Regulatory clarity would follow institutional adoption | SEC enforcement actions (against ICOs and STOs) created additional uncertainty rather than resolving it |
| Technology would differentiate platforms | The differentiating factor turned out to be relationships which issuer clients a platform could attract not technical superiority |
| A liquid exchange for security tokens would emerge | tZERO existed but never achieved the volume needed for credible price discovery |
The fundamental gap the first generation did not close: a token standard that enforces compliance at the transfer level does not automatically create the buyers, sellers, market makers, price discovery mechanisms, and settlement infrastructure that a liquid securities market requires. Polymath’s ST-20 standard and Securitize’s DS Protocol were technically correct solutions to the compliance problem the problem they did not solve was the market structure problem.
The Invisible Years: What Continued During the Absence of Attention
Between 2020 and 2023, the security token market received almost no public attention. Retail crypto capital was focused on DeFi, then NFTs, then the 2021 bull market and its subsequent correction. Security tokens compliance-enforced, accredited-only, with thin secondary markets had no speculative narrative and no accessible retail participation. They were invisible.
What continued during this period is more important than the visibility. Securitize kept building: it accumulated $4 billion in tokenised assets from institutional clients including Apollo, BlackRock, and KKR. Its DS Protocol continued to process compliant token transfers. Its transfer agency function continued to operate. Polymath built Polymesh not an Ethereum layer-two or an EVM-compatible chain, but an institutional-grade, permissioned blockchain where identity, compliance, and confidentiality are built into the base layer, with every node operator a known, regulated financial entity and every user required to pass identity verification. tZERO received progressive FINRA regulatory approvals expanding its ability to clear and settle digital asset securities.
The invisible years were infrastructure years. The platforms that survived them arrived at 2024-2026 with regulatory standing, institutional client relationships, and technical infrastructure that the 2018 boom era cohort had assumed would emerge from market dynamics rather than deliberate building.
The Second Generation: What Is Actually Different
From Issuance-Only to Post-Issuance Infrastructure
Tokenfrastructure’s May 2026 analysis captures the architectural shift precisely: ‘The first generation of security token offerings, beginning around 2018 with platforms such as Polymath, Securitize and tZERO, focused almost entirely on issuance. The second generation, now under construction, is forced to reckon with what happens after issuance: how shares trade, settle, distribute dividends, accept votes, and stay legally distinct from the wallet they happen to be sitting in. The answers, where they are credible, look strikingly little like decentralised finance. They look like exchanges.’
This is the central insight of the 2026 revival: the second generation has accepted that tokenised securities need exchange-like infrastructure order books, market makers, settlement certainty, corporate action processing and is building that infrastructure rather than assuming it would emerge from blockchain composability alone.
The Regulatory Infrastructure That Now Exists
In 2018, the regulatory framework for security tokens was constructed primarily from SEC exemptions (Regulation D, Regulation S) and the hope that clearer guidance would follow. In 2026, the regulatory infrastructure is materially different:
- Securitize is an SEC-registered transfer agent the entity responsible for maintaining the legal register of security holders and was named by the NYSE as the first digital transfer agent eligible to mint blockchain-native securities in March 2026.
- tZERO has received FINRA regulatory approvals expanding its clearing and settlement authority, positioning it as a liquidity venue rather than only an issuance portal.
- Polymesh’s permissioned blockchain architecture with known, regulated node operators and mandatory identity verification for all users has been recognised as an institutional infrastructure model by compliance-conscious issuers who previously hesitated to use public blockchain infrastructure.
- MiCA in Europe, VARA in Dubai, and MAS guidance in Singapore provide jurisdiction-specific frameworks that did not exist in 2018.
The DTCC and NYSE: Institutional Settlement
The most consequential development separating 2026 from 2018 is the entry of DTCC and NYSE into the active infrastructure building phase. DTCC’s July 15, 2026 first live tokenised securities settlement and NYSE’s March 2026 Securitize appointment represent the two central pieces of US securities market infrastructure treating tokenised equities as a production pathway. No equivalent existed in 2018, when security tokens were a blockchain native innovation seeking traditional market acceptance. In 2026, traditional markets are building the settlement infrastructure for tokenised securities themselves.
Frequently Asked Questions
What were STOs in 2018?
Security Token Offerings blockchain-based issuances of securities using compliant token standards (Polymath’s ST-20, Securitize’s DS Protocol, Harbor’s R-Token) that embedded transfer restrictions on-chain. tZERO raised $134 million in the largest 2018 STO and launched one of the first regulated alternative trading systems for security tokens.
Why did the 2018-2019 STO market fail to develop secondary market liquidity?
Three structural gaps: first-generation platforms focused on issuance infrastructure but built almost no secondary market infrastructure; Regulation D and S exemptions restricted the investor pool to accredited and offshore investors too thin for meaningful trading volume; and the exchange and settlement infrastructure needed for compliant secondary trading did not exist as a regulated institutional product.
What did Polymath and Securitize build during the ‘invisible years’?
Securitize accumulated $4 billion in tokenised assets from institutional clients including Apollo, BlackRock, and KKR, and continued building its transfer agent function. Polymath built Polymesh an institutional-grade, permissioned blockchain where identity, compliance, and confidentiality are built into the base layer with known, regulated node operators and mandatory identity verification.
What makes the 2026 security token revival structurally different from 2018?
Post-issuance infrastructure: the second generation has accepted that tokenised securities need exchange-like infrastructure (order books, market makers, settlement certainty, corporate actions) and is building it rather than assuming it would emerge from blockchain dynamics. Additionally, DTCC and NYSE are now active participants building settlement infrastructure for tokenised securities neither was building in 2018.
What does the NYSE-Securitize partnership mean?
The NYSE named Securitize the first digital transfer agent eligible to mint blockchain-native securities for corporate and ETF issuers on the NYSE Digital Trading Platform in March 2026. This positions Securitize as the infrastructure link between blockchain-native security issuance and US exchange market structure.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Readers should conduct their own research and consult with qualified professionals before making any investment or business decisions.