III · The Supply Chain of Trust
A system engineered to abolish intermediaries has, in practice, grown a dense and physical layer of them: miners burning power, validators posting bonds, exchanges holding keys, issuers holding Treasuries. These are the rails — and the places where the machine's trustlessness quietly leaks back into trust.
The Machine That Was Meant to Have No Operator
The founding promise of trustless money is stark: a ledger no one owns, secured by mathematics rather than by the good behaviour of banks. In the pure account you need trust no counterparty, no vault, no clearing house; the chain is the arbiter. Yet the moment a protocol meets the world, it acquires a body — and bodies have organs. To move value from a bank account into a wallet, to keep a network honest, to price an asset, to store a key that cannot be forgotten: each of these tasks has, in practice, been delegated to someone. The system engineered to abolish intermediaries has instead grown a dense and specialised layer of them.
This is not hypocrisy so much as physics. A protocol is a set of rules; a usable system is a supply chain. Between the abstract elegance of a consensus algorithm and a person actually spending money sits a stack of real machines in real buildings, run by real firms with real incentives and real failure modes. The honest question is not whether intermediaries exist — plainly they do — but where they have accreted, how much trust each silently absorbs, and what happens on the day one of them breaks.
What follows is a tour of that supply chain, layer by layer, where the same tension recurs at every level: decentralisation is expensive, convenience is centralising, and markets, left alone, concentrate.
Trustlessness is a property of the protocol. It is almost never a property of the system you actually use.
The Physical Layer: Energy as the Anchor
Proof-of-work does something subtle: it converts electricity into finality. To rewrite history on a chain like Bitcoin, an attacker must out-compute the honest network, and computation costs power. Security is therefore not a clever cryptographic trick alone but a standing commitment of physical resources — the chain is expensive to attack precisely because it is expensive to run. That is the source of both proof-of-work's robustness and its notoriety.
The tools of that work have evolved through a relentless arms race. In the earliest days a laptop's CPU sufficed; hobbyists then discovered that graphics cards, built for parallel arithmetic, were far more efficient; and finally the market produced ASICs — chips that do nothing but hash, endlessly, at the thermodynamic edge of what silicon allows. Each step raised the capital required to compete and pushed mining from the bedroom toward the industrial park.
Because the input is electricity, mining migrates toward wherever power is cheapest, and it moves fast. For years a large share of the world's hash rate sat in China, exploiting seasonal hydropower and cheap coal. Then in mid-2021 Beijing banned the activity outright, and within months an entire industry physically relocated — hash rate collapsed and rebuilt itself, with the United States and Kazakhstan absorbing much of the displaced capacity. Few events have so vividly shown that the "cloud" of a blockchain is, in the end, a map of substations and shipping containers.
That same hunger produces one of the field's more genuinely interesting arguments. Miners can site themselves at power that would otherwise be wasted — natural gas flared at remote oil wells, curtailed wind and solar, stranded hydro far from any city. As a buyer of last resort for otherwise-worthless electrons, mining can, in specific cases, improve the economics of clean generation and reduce flaring. This does not settle the environmental debate; proof-of-work still consumes on the scale of a mid-sized country. But it reframes it: the physical layer is not merely a cost — it is the thing being bought.
The Digital Bond Market
Proof-of-stake replaces the electricity bill with a security deposit. Instead of burning power to earn the right to propose blocks, validators lock up the network's own token as collateral; misbehave, and the protocol destroys part of that stake through slashing. The anchor moves from the physical world to the financial one. Ethereum's shift to this model in 2022 quietly created something new: a native, protocol-guaranteed yield on capital — in effect, a digital bond market, where the "coupon" is paid in freshly issued tokens plus a share of fees.
That yield is a gravitational force, and it pulls toward concentration. Running your own validator means locking a fixed, non-trivial sum and keeping a node online continuously — friction most holders would rather avoid. Enter liquid staking: deposit tokens with a protocol like Lido, receive a tradable receipt that keeps earning while remaining usable elsewhere. It is elegant, and it is popular — and that popularity is precisely the problem. When one liquid-staking protocol intermediates a large fraction of all staked value, the network's security begins to lean on the honesty of a layer the base protocol never sanctioned.
Concentration matters because proof-of-stake security has sharp thresholds. Roughly speaking, an actor controlling more than a third of the stake can stop the chain finalising, and one past two-thirds can finalise fraudulent history. These are not gradual risks that grow smoothly with size; they are cliffs. A staking-as-a-service industry — exchanges and specialist firms running validators for millions of depositors — makes those cliffs easier to approach, because a handful of large operators can, between them, cross a threshold no individual ever chose to breach.
Restaking is the rehypothecation of trust: the same collateral, promised twice, securing risks it was never underwritten for.
The frontier of this layer is restaking, pioneered by EigenLayer, which lets staked collateral be reused to secure additional services beyond the base chain. The capital efficiency is obvious; so is the hazard. Staked value that already backs one network is pledged again to back others, and the failure of any of those secondary obligations can, through slashing, reach back and impair the original stake. Finance has seen this shape before — collateral pledged more than once, risk layered on risk. Restaking may prove safe and useful, but it should be understood for what it is: leverage on trust itself.
Where the Money Actually Changes Hands
For all the ideological weight placed on self-sovereignty, the overwhelming majority of people enter and exit this economy through an exchange — and most through a centralised one. The split is instructive. Decentralised exchanges (DEXs) are smart contracts: they never take custody, they run on-chain, and they embody the trustless ideal most faithfully. Centralised exchanges (CEXs) are companies: they hold your coins, match orders on private servers, and connect crypto to the banking system. Yet price discovery and, above all, the fiat on-ramp still happen predominantly at the centralised venues. The gateway between dollars and tokens is manned.
The reason is custody, the original sin of convenience. When you leave assets on an exchange, you no longer hold the private keys; you hold a database entry — an IOU. The exchange promises the coins are there. Usually they are. The entire edifice of counterparty risk that crypto was designed to eliminate reappears, intact, the moment a user prioritises ease over control. "Not your keys, not your coins" is not a slogan; it is a description of the legal reality of an exchange balance.
No event taught this lesson more expensively than the collapse of FTX in November 2022. A large, glossy, seemingly reputable exchange — sponsor of stadiums, courter of regulators — was revealed to have quietly lent customer deposits to an affiliated trading firm. When confidence cracked, the withdrawals could not be met, because the assets backing them were gone. Nothing about the underlying blockchains failed; the failure was entirely at the intermediary layer, exactly where the technology was meant to make one unnecessary. FTX was not a crypto failure. It was a custody-and-fraud failure wearing crypto's clothes.
The industry's answer was proof of reserves: exchanges publishing cryptographic evidence that they hold the coins they claim. It is a genuine improvement over pure faith, and yet it is only half a balance sheet. Proving you own assets says nothing about the liabilities stacked against them, nor about coins borrowed for the day of the audit. Real assurance still requires an independent examination of both sides of the ledger. Until then, depositing at an exchange remains an act of trust, dressed in the language of trustlessness.
The Vault and the ETF
Custody is the question of who can move a coin, and it admits a spectrum. At one pole is pure self-custody: you alone hold the private key, answerable to no one, exposed to no one — and solely responsible if you lose it. At the other is institutional custody, where a regulated firm safeguards keys for clients who cannot or will not manage cryptographic secrets themselves. Between these poles sits most of the real economy, and its centre of gravity has been drifting steadily toward the institutional end.
Nothing accelerated that drift like the approval of US spot Bitcoin ETFs in January 2024. For the first time, ordinary investors and vast pools of institutional capital could gain exposure to bitcoin through a normal brokerage account, inside the familiar wrapper of a regulated fund. But an ETF does not hand its shareholders private keys; it holds the underlying coins through a custodian. And here the concentration is striking: a single firm, Coinbase, was named custodian for a large share of the new spot-Bitcoin ETF complex. An asset conceived to have no central point of control now has much of its institutional supply sitting behind one company's security perimeter.
An asset with no central point of control now keeps much of its institutional supply behind a single custodian's door.
This is not a criticism of the custodian, which may be excellent; it is an observation about systemic shape. When one entity secures a meaningful fraction of a chain's most institutionally significant holdings, it becomes a target of extraordinary value, a single point whose compromise or coercion would ripple across the whole complex. The professional response is to eliminate single keys — through multisignature schemes, which require several independent keys to authorise a move, and multi-party computation (MPC), which splits a key into shares held separately so no one place ever holds the whole secret. These techniques harden the vault considerably. What they cannot change is that, for most of the money, there is now a vault at all.
The Reserve Question
Stablecoins are the plumbing of everyday crypto — the dollars in which prices are quoted, trades settled, and value parked between bets. A dollar stablecoin promises one thing: that each token is redeemable for one real dollar. That promise is only as good as the reserves behind it, and the reserves sit not on-chain but with an issuer — Tether, Circle, and a handful of others. A dollar-pegged token is, in the end, a claim on a private company's balance sheet.
What backs that claim has converged on the safest, most liquid instrument available: short-dated US government debt. To hold their pegs, the major issuers keep large reserves in Treasury bills and equivalents — with a remarkable result. The crypto industry, through its stablecoin issuers, has become a significant holder of US Treasuries, large enough that its buying is noticed in that market. The most rebellious corner of finance turns out to be funded, at its core, by lending to the American state.
The critical and often-blurred distinction is between an attestation — a snapshot confirming reserves were present on a given date — and a full audit of the issuer's entire financial position. The industry has leaned heavily on the former. That leaves a residue of trust that no amount of on-chain transparency can dissolve: you can verify that a token exists and moves, but you cannot, from the chain alone, verify that the dollar behind it is real, unencumbered, and available on the day you demand it. When you hold a stablecoin, you are not holding a dollar. You are holding an issuer's word that it has one for you.
The Weakest Links
A blockchain is, by design, a closed world. It knows only its own state and cannot, on its own, see a stock price, the weather, or the balance on another chain. Bridging that isolation requires infrastructure that sits at the seams of the system — and it is at the seams that things tear.
Oracles are the services that feed external data, above all prices, into smart contracts. A lending protocol must know what its collateral is worth; a derivative must know the settlement price. But an oracle is a channel, and a channel can be poisoned. If an attacker can distort the price an oracle reports — often by manipulating a thin market the oracle happens to read — they can trick a contract into releasing funds it never should have. A long history of exploits follows exactly this template: the code executed perfectly, on data that was a lie.
More brutal still are bridges, the contracts that let assets move between chains by locking value on one side and minting a representation on the other. To function, a bridge must hold an enormous pool of assets in one place, governed by complex code — a concentration of value that has made bridges the single most catastrophic failure category in the field. The record is grim and specific: the Ronin bridge lost roughly six hundred million dollars in 2022, Wormhole several hundred million the same year, and Poly Network a comparable sum before it. Cumulatively, bridge exploits have drained value into the billions. Bridges concentrate exactly what the rest of the system tries to disperse.
There is a quieter dependency beneath all of this. When a wallet or application "reads the blockchain," it rarely runs its own node — it queries a provider, and a small number of firms, chiefly Infura and Alchemy, answer a large share of those queries. Run your own node and you verify reality yourself; trust a provider and you accept the reality it reports. Most applications, for cost and convenience, choose the provider — so the last mile to the "decentralised" chain often passes through a handful of centralised endpoints that could, in principle, filter, censor, or simply fail.
This is the recurring lesson of the rails, in its most literal form. Decentralisation is not free; it is bought, node by node, in effort and expense that most participants decline to pay. Every layer offers the same bargain — surrender a little verification for a lot of convenience — and, layer upon layer, the surrenders compound. The protocol may need trust no one. The system, as built, quietly asks you to trust almost everyone. Naming those intermediaries is not a betrayal of the project; it is the first honest step toward deciding which of them are worth keeping.