Chapter 2: The state of blockchain security

This chapter examines the current state of blockchain security—or more accurately, persistent insecurity. Despite ideological commitments to cryptographic guarantees and protocol-level integrity from project founders, blockchain systems remain vulnerable. Security is not guaranteed by design but is continuously negotiated by a patchwork of stakeholders. Drawing on ethnographic analysis of security incidents as well as publicly available data on high-profile exploits, this chapter maps key attack vectors, threat actors, and stakeholders. It presents a matrix of the decentralised security ecosystem, characterised as much by fragmentation and improvisation as by technical sophistication. This ecosystem has evolved to include software auditors, bug bounty hunters, protocol security teams, white hat hackers, user education initiatives, insurance providers, policy makers, and more. These stakeholders operate according to various incentives and an ethos of decentralisation that complicates traditional notions of responsibility, liability, and enforcement across protocols, projects, and users.