Tokenized gold is safe to the extent that three things are independently verifiable: the vault holds the metal, an independent auditor confirms the supply, and the smart contracts handling the token have been audited and battle-tested. When all three layers hold, holders have a clearer ownership trail than most paper gold instruments.
What "Safe" Actually Means for a Gold Token
Safety in tokenized gold is not a single property. It is a stack of separate guarantees that have to hold simultaneously. A bullion bar in a vault is safe in a physical sense. A token on a blockchain is safe in a cryptographic sense. The connection between the two, the audit attestation, is what links the digital claim to the physical metal. If any layer fails, the whole stack fails.
For gold (XAUT), that stack looks like this. The metal sits in Swiss LBMA-accredited vaults. The vaults are insured. The token is issued on Ethereum and other public chains. BDO Italia, an internationally recognised audit firm, signs periodic attestations confirming that the circulating supply is fully backed.
Layer One: Vault Custody and Insurance
The starting point of any tokenized gold programme is the physical custody arrangement. Switzerland is the dominant jurisdiction for high-value gold storage because of three properties: it has a long-standing legal tradition around private property, the vaults are operated by firms with century-long track records, and the LBMA accreditation ensures that bars meet a strict purity and provenance standard.
LBMA-accredited bars are not generic bullion. They are sourced from refiners on the LBMA Good Delivery List, which screens for responsible sourcing and refining quality. When a token represents one ounce of LBMA gold, the holder is getting a claim on a specific class of metal that the entire global wholesale market accepts.
Vault Insurance
Top-tier Swiss vaults carry insurance against theft, damage, and loss in transit. Insurance does not eliminate risk, but it does mean that a holder of a fully-backed gold token has a reasonable expectation of recovery in even the worst-case operational event. Holders should look for issuers that publish vault location, custodian name, and insurance coverage details.
Layer Two: The Audit Attestation

The audit attestation is what ties the vault to the token supply. Without it, the issuer could in principle mint more tokens than the gold they actually hold. With it, an independent third party periodically verifies the match between vaulted bullion and circulating tokens.
BDO Italia performs this role for XAUT. As one of the largest independent accounting networks in the world, BDO has the institutional weight to conduct a rigorous attestation and the reputational stake to do it honestly. The attestations are published publicly so that anyone can compare the reported gold reserves against the on-chain supply.
What to Look for in an Attestation
- Frequency: Quarterly or more frequent is the standard. Annual is too long for a fast-moving instrument.
- Auditor identity: A top-tier firm like BDO carries far more weight than an unknown local auditor.
- Scope: The attestation should cover the full backing, not a sample.
- Public availability: The report must be downloadable so holders can independently verify.
Layer Three: Smart Contract Security
The token itself is governed by an Ethereum smart contract. That contract handles minting, burning, and transfers. If the contract has a vulnerability, the entire token can be at risk regardless of how much gold sits in the vault. This is why mature gold tokens go through multiple independent code audits before launch and re-audit after any contract upgrade.
For lending against gold (XAUT), there is a second layer of contract risk: the lending protocol itself. Perfolio uses non-custodial Ethereum smart contracts that have been audited, are open-source, and have a multi-year live track record handling production volume. Code audits from reputable firms, formal verification on critical components, and bug bounty programmes are the three signals to look for.
What Is Not the Same as Safety
It is worth separating three things that holders sometimes conflate.
Price stability is not safety. Gold moves, sometimes 10% or more in a quarter. A safe gold token will still have a volatile market price because the underlying metal is volatile. Safety is about the integrity of the backing, not the daily price.
Regulation is not safety. Some tokens are issued by regulated entities, others are not. Regulation reduces certain categories of risk, particularly issuer fraud, but it does not by itself guarantee that the gold is in the vault. The audit attestation does that.
Brand recognition is not safety. A widely traded token with a familiar name still needs to publish proof of reserves. Holders should not assume that popularity equals proof.
Concrete Risks to Understand
A complete picture requires honesty about the residual risks even in a well-run programme.
Custodian Insolvency
If a vault operator went bankrupt, the gold itself would not disappear, but the legal claim on the gold could be slowed by insolvency proceedings. Top-tier Swiss vault operators have very low insolvency probability and segregated client assets, but the residual risk is non-zero.
Issuer Operational Risk
The token issuer manages the minting and redemption process. An operational failure at the issuer level, such as a delayed redemption window, can affect holders. Mature issuers publish redemption policies and have multi-year operational records to evaluate.
Regulatory Action
Tokenized gold is still a relatively new instrument. Regulatory frameworks vary by jurisdiction. Holders should be aware of how their local regulator treats tokenized commodity exposure. Most major jurisdictions now have clear paths, but enforcement risk exists in some markets.
How to Verify a Gold Token Yourself
Before holding any gold-backed token, walk through this checklist.
- Find the most recent attestation report. Confirm the audit firm and the date.
- Check the on-chain circulating supply. Confirm it matches the attested gold weight.
- Read the vault custodian name. Confirm LBMA accreditation.
- Read the smart contract audit reports. Confirm at least two independent firms.
- Check the redemption policy. Confirm whether and how holders can convert tokens to physical metal.
The Bottom Line on Safety
Tokenized gold is safer than many holders assume and not as automatically safe as the marketing suggests. The verifiable audit chain, when it is real, is genuinely strong. Vault custody by LBMA-accredited Swiss operators, attestations by BDO Italia, audited non-custodial Ethereum smart contracts: these are not theoretical guarantees, they are documented and public.
The work for a holder is to actually verify the chain rather than assume it. When the chain holds, gold (XAUT) is one of the most transparent forms of gold ownership available, more auditable than ETF shares and more useful than a bar in a private safe.
