The Crypto Industry Must Evolve to Match Real-World Security Risks

Just look at wallets. Security considerations have historically made the wallet user experience horrible, but things are improving thanks to innovations like split wallets with different keys, delegation, and multi-wallet accounts. But, in my experience, balancing usability and security continues to be tricky.

So how do we do better by users?

First, we need to take security issues as feedback. Every breach tells us something about design, not just behavior. Take a stolen password. One response could be, “It’s the user’s fault for getting phished; they shouldn’t fall for that.” Maybe that’s true, maybe it isn’t. But what is true is that when it’s happening millions of times per year on your customer base, it’s an indication that your system isn’t designed for actual people. Adjust accordingly.

Second, we need to incorporate successful examples from the non-web3 space.

Consider the problem of authentication. Using a cryptographic key for access is powerful, but doesn’t confirm that the user is the legitimate owner. That’s why the broader internet long ago adopted layers like multifactor authentication and behavioral signals, and more recently proof-of-human — methods that protect people automatically, without relying on constant vigilance. Crypto can and should follow that lead.

Finally, we have to recognize that the security risks are no longer limited to social engineering tricks.

Cryptocurrency executives and deep-pocketed holders have been hit by a rash of physical assaults, with thieves looking to gain access through not brute force decryption, but plain old brute force. If we design systems that don’t incorporate the possibility of physical abuse, we are not doing our job as designers of those systems. The attack vectors will evolve, and we will have to evolve as well.

Crypto’s rugged ethos of individual responsibility made sense when it was an experiment. However, now that trillions in assets — and human livelihoods — are at stake, we need systems designed for real-world risk rather than for early adopters.

There are no panaceas: cryptographic keys will remain vulnerable to phishing, biometrics will render holders vulnerable to physical attacks, and humans will continue being imperfect. But as we close Cybersecurity Awareness Month, let’s remember who we’re building for. When we design for real people, not ideal users, our products can strengthen lives while protecting against their weaknesses. Security isn’t a user problem anymore; it’s an industry problem.

Just look at wallets. Security considerations have historically made the wallet user experience horrible, but things are improving thanks to innovations like split wallets with different keys, delegation, and multi-wallet accounts. But, in my experience, balancing usability and security continues to be tricky.

So how do we do better by users?

First, we need to take security issues as feedback. Every breach tells us something about design, not just behavior. Take a stolen password. One response could be, “It’s the user’s fault for getting phished; they shouldn’t fall for that.” Maybe that’s true, maybe it isn’t. But what is true is that when it’s happening millions of times per year on your customer base, it’s an indication that your system isn’t designed for actual people. Adjust accordingly.

Second, we need to incorporate successful examples from the non-web3 space.

Consider the problem of authentication. Using a cryptographic key for access is powerful, but doesn’t confirm that the user is the legitimate owner. That’s why the broader internet long ago adopted layers like multifactor authentication and behavioral signals, and more recently proof-of-human — methods that protect people automatically, without relying on constant vigilance. Crypto can and should follow that lead.

Finally, we have to recognize that the security risks are no longer limited to social engineering tricks.

Cryptocurrency executives and deep-pocketed holders have been hit by a rash of physical assaults, with thieves looking to gain access through not brute force decryption, but plain old brute force. If we design systems that don’t incorporate the possibility of physical abuse, we are not doing our job as designers of those systems. The attack vectors will evolve, and we will have to evolve as well.

Crypto’s rugged ethos of individual responsibility made sense when it was an experiment. However, now that trillions in assets — and human livelihoods — are at stake, we need systems designed for real-world risk rather than for early adopters.

There are no panaceas: cryptographic keys will remain vulnerable to phishing, biometrics will render holders vulnerable to physical attacks, and humans will continue being imperfect. But as we close Cybersecurity Awareness Month, let’s remember who we’re building for. When we design for real people, not ideal users, our products can strengthen lives while protecting against their weaknesses. Security isn’t a user problem anymore; it’s an industry problem.