During Devconnect Buenos Aires, a pivotal event titled "Trillion Dollar Security Day" brought together a distinguished cohort of Ethereum security practitioners. Organized collaboratively by the Ethereum Foundation and Secureum TrustX, the day was dedicated to a singular, ambitious goal: to meticulously explore and define the security measures necessary to underpin an Ethereum economy valued at one trillion dollars. This focused gathering, held amidst the vibrant backdrop of Devconnect, aimed to foster critical dialogue and identify actionable strategies for safeguarding the future of decentralized finance.
The event convened approximately eighty key figures from across the diverse Ethereum security ecosystem. Participants represented a comprehensive spectrum of specialization, including Infrastructure, Interoperability, Layer 1 & 2, Onchain, Offchain, Privacy, and Wallets. The primary objective was to conduct a thorough assessment of the current security landscape, openly discuss shared challenges that impede growth and resilience, and collaboratively pinpoint concrete next steps across the entire technological stack. The discussions and the tangible outputs generated during Trillion Dollar Security Day are integral to the Ethereum Foundation’s ongoing "One Trillion Dollar Security" (1TS) initiative, a long-term commitment to ensuring the robustness and scalability of the Ethereum network.
The Imperative for Trillion Dollar Security Day
The rationale behind dedicating an entire day to "Trillion Dollar Security" was rooted in the need for focused, in-person engagement. By bringing together practitioners who operate within similar layers of the Ethereum stack, the event facilitated candid exchanges about their current security postures, the operational realities they face daily, and the immediate priorities that demand attention. This concentrated approach allowed for a deeper dive into specific challenges and fostered a more nuanced understanding of interdependencies. The outcomes from these specialized sessions were subsequently synthesized to illuminate overarching patterns and critical dependencies that span the broader ecosystem, highlighting how security in one layer can significantly impact others.
The overarching goals of the Trillion Dollar Security gathering were multifaceted:
- Assess Current Security Posture: To gain a clear understanding of the existing strengths and vulnerabilities within each segment of the Ethereum security domain.
- Surface Shared Challenges: To identify common obstacles and risks that affect multiple layers or the ecosystem as a whole.
- Identify Concrete Next Steps: To define actionable, prioritized initiatives that can be implemented to address identified challenges.
- Foster Cross-Layer Collaboration: To encourage communication and understanding between different security domains, recognizing that robust security is an interconnected effort.
- Contribute to the 1TS Initiative: To generate valuable insights and recommendations that directly inform the Ethereum Foundation’s strategic roadmap for large-scale security.
Participants were strategically divided into breakout sessions, each dedicated to a specific layer of the Ethereum stack. Within these groups, discussions centered on what is currently functioning effectively, where significant shortcomings exist, and which areas require the most urgent allocation of resources and attention. This structured approach ensured that all critical aspects of Ethereum’s security were addressed comprehensively.
Snapshot: Cross-Layer Observations and Emerging Themes
Across the seven distinct layers examined, several recurring themes emerged, underscoring the interconnected nature of Ethereum’s security. These cross-layer observations provide a critical overview of the challenges and opportunities ahead.
| Layer | Key Issues | Identified Immediate Next Steps |
|---|---|---|
| Layer 1 & 2 | Quantum risk, weak L1/L2 coordination, cloud dependence, compressed testing | Expand EPF onboarding, create L2 liaisons, improve EIP versioning & ownership |
| Wallets | Blind signing, paywalled security, low coordination | Form an Open Signing Alliance, neutral/on-chain EIP-7730 registry, wallet dashboards |
| Onchain | "Audited" secure, weak IR, OpSec failures | Fund OSS security tooling, create DeFi security visibility, promote SEAL |
| Interop | Unsafe trust assumptions, UX favors speed over safety | Interop trust ratings, clearer disclosures, improve canonical bridge UX |
| Infrastructure | Frontend hacks, RPC centralization, DNS SPOFs | Verifiable frontends, infra transparency dashboards, light-client wallets |
| Offchain | Misaligned incentives, Web2 attack-surface blind spots | Security frameworks, certifications, public-goods staffing models |
| Privacy | UX and infrastructure limitations, RPC-based tracking, private data management | Increased light-client data over P2P RPC, investment in private wallet UX, ZK-capable hardware signer research, regulatory engagement |
The detailed discussions within each layer revealed specific pain points and actionable solutions, which are summarized below.
Layer 1 & 2: Coordination Remains a Bottleneck
The foundational security of Ethereum is robust, bolstered by its multi-client architecture, a commitment to specification-driven development, and a deliberately conservative approach to changes at Layer 1. However, participants identified significant risks stemming from insufficient coordination between Layer 1 and Layer 2 solutions. These risks are compounded by compressed testing timelines for new developments, an over-reliance on centralized cloud infrastructure, and persistent concerns surrounding software supply-chain attacks.
A critical challenge highlighted was the limited participation from the broader community and Layer 2 developers in key coordination forums like All Core Devs calls. The capacity of client teams to thoroughly review evolving Ethereum Improvement Proposals (EIPs) in their early stages is also constrained. Furthermore, ongoing concerns persist regarding the security and resilience of bridging mechanisms between L1 and L2, as well as the centralization risks associated with RPC infrastructure.
To address these issues, proposed next steps include expanding the Ethereum Protocol Fellowship (EPF) program to onboard more developers and researchers, establishing dedicated liaison roles for Layer 2 solutions to improve communication, and refining EIP versioning and ownership expectations to ensure clarity and accountability. Enhancing moderation and accessibility within coordination forums was also identified as crucial for fostering broader engagement.
Wallets: User Security Remains Too Opaque
While progress has been made in signing standards like EIP-7730 and in improving wallet discoverability, significant security challenges persist within the wallet ecosystem. A primary concern is the continued reliance on "blind signing" by most hardware wallets, a practice where users approve transactions without full visibility of their content, potentially exposing them to malicious scripts. Moreover, participation in shared security discussions among wallet providers remains notably limited, hindering collaborative efforts to address systemic risks.
The highly competitive nature of the wallet market was identified as a structural barrier to greater collaboration, with many providers prioritizing unique features over shared security initiatives. This competitive landscape, coupled with an over-reliance on the Ethereum Foundation to drive coordination, has created a fragmented approach to security.
A key proposal put forth was the establishment of an "Open Signing Alliance," a collaborative body that would champion openness, neutrality, and the "walkaway test" – a principle that ensures users can easily disengage from a transaction if they feel unsafe. Additional priorities include hosting the EIP-7730 registry in a neutral, or ideally on-chain, context to ensure its accessibility and immutability, and funding the development of wallet-focused security dashboards to enhance transparency and user trust.
Onchain Security: Tooling and Visibility Lag Behind Risk
The onchain security landscape continues to benefit from a growing pool of experienced security researchers and the development of improved tooling, such as the Foundry smart contract development toolkit. Initiatives like SEAL911 have also increased awareness and capabilities around incident response. However, security is frequently treated as a perfunctory step, and the common conflation of "audited" with "secure" remains a persistent issue.
Participants emphasized that the majority of recent financial losses within the ecosystem stem from operational security (OpSec) failures rather than novel smart-contract exploits. Other significant challenges include the increasing complexity of protocols, a lack of robust invariant monitoring, and a deficit in comprehensive economic audits.
Immediate next steps proposed include sustained funding for open-source security tooling, such as fuzzers, static analyzers, and dynamic analysis tools. Enhancing visibility into the security posture of decentralized finance (DeFi) protocols, perhaps through an approach akin to L2BEAT for L2 solutions, was also deemed essential. Broader adoption of SEAL frameworks and standardized checklists for different classes of smart contracts was recommended to improve consistency and rigor.
Interoperability: Trust Assumptions Must Be Explicit
Ethereum users today benefit from a wide array of interoperability solutions, enabling increasingly fast and low-cost cross-chain transactions. Despite these advancements, a critical concern raised by participants is that many interoperability protocols rely on poorly communicated or opaque trust assumptions. This can lead users to mistakenly equate "fast and cheap" with "safe."
A significant number of non-canonical bridges, which are often more susceptible to exploits, have been observed to fail the "walkaway test." Furthermore, risks often persist even after assets have been bridged, due to the complexities of wrapped assets and intricate downstream dependencies across multiple networks.
Proposed actions to mitigate these risks include the development of interoperability "trust ratings" that clearly articulate the underlying assumptions and verification models employed by different protocols. Stronger expectations for explicit trust disclosures by cross-chain aggregators were also advocated. Efforts to improve the speed and cost-effectiveness of canonical bridges are crucial to reduce the incentive for users to opt for less secure alternatives. A dedicated follow-up workshop focusing on interoperability security was also proposed.
Privacy: UX and Infrastructure Are the Primary Constraints
There was a strong consensus that privacy is increasingly viewed not as an optional feature, but as a normal and necessary component of Ethereum’s future. Encouraging progress has been observed in zero-knowledge proof research and in the institutional adoption of privacy-enhancing technologies. However, significant barriers remain, primarily related to user experience (UX), cost, and infrastructure limitations.
Key challenges identified include the pervasive issue of RPC-based tracking, which compromises user privacy. Difficulties surrounding the secure storage and recovery of private data present another hurdle. A notable absence of developers focused on creating intuitive and private wallet UX was highlighted, alongside the lack of hardware support for privacy-preserving key management.
Suggested next steps include increased utilization of light-client data over peer-to-peer (P2P) RPC connections to minimize exposure, significant investment in improving private wallet UX, and dedicated research into ZK-capable hardware signers. Proactive engagement with regulators was also deemed important to seek clearer guidance for permissionless privacy technologies, fostering an environment where privacy can flourish responsibly.
Infrastructure & Offchain Security: The Invisible Attack Surface
A recurring concern throughout the discussions was the underestimation of risks associated with frontend compromises, DNS hijacks, RPC centralization, and software supply-chain attacks. These "invisible" attack surfaces pose significant threats that are often overlooked. Participants also pointed to a lack of sustainable economic models for non-profit organizations that provide critical security public goods, leading to potential underfunding and resource constraints.
Key challenges include the artificial separation often made between "Web2" and "Web3" security practices, which can lead to blind spots. There is also a lack of clear accountability for off-chain failures, and a pervasive tendency to prioritize speed or convenience over robust security measures. The inability to easily run nodes over privacy-focused networks like Tor was also cited as a limitation.
Proposed next steps include the development of verifiable frontend prototypes to enhance trust, increased transparency regarding the health and security of RPC endpoints and infrastructure, and the advancement of standardized security frameworks and certifications for off-chain components. The creation of structured collaboration models where private companies contribute dedicated resources and expertise to security public goods was also strongly advocated.
Event Reflections: A Catalyst for Action
Participants overwhelmingly lauded the quality of discussions and the relevance of the topics addressed during Trillion Dollar Security Day. The value of in-person, cross-layer exchange was frequently cited as a key factor in fostering a deeper shared understanding and building momentum. The primary areas identified for improvement were logistical in nature, including optimizing group sizes for more effective discussion and creating more structured opportunities for networking among participants.
There was a clear and strong demand for future initiatives focused on developing applied security standards, promoting shared tooling, and providing practical "how-to" guidance for implementing robust security measures. This indicates a shift from theoretical discussions to the practical application of security best practices across the ecosystem.
What Comes Next: Sustaining Momentum for a Secure Future
The Trillion Dollar Security gathering in Buenos Aires served as a potent reminder of the value derived from bringing security practitioners together in person. These face-to-face interactions were instrumental in building shared understanding, fostering alignment on critical standards and tooling, and accelerating the development of practical solutions – outcomes that are significantly more challenging to achieve through asynchronous coordination alone.
The discussions also underscored the critical importance of maintaining a continuously updated, shared view of Ethereum’s overall security posture. As the ecosystem rapidly evolves, staying ahead of emerging risks necessitates a proactive and iterative approach to security. This involves regularly reassessing what is currently effective, identifying where existing assumptions may no longer hold true, and directing renewed attention to areas requiring fortification to support the projected growth of a trillion-dollar economy.
The valuable insights gleaned from this event in Buenos Aires will continue to inform the Ethereum Foundation’s ongoing "One Trillion Dollar Security" efforts. These insights will be integrated alongside the continuous work being undertaken by various stakeholders across the ecosystem. The near-term focus remains steadfast on supporting the practical execution of identified strategies, enabling the widespread adoption of open and neutral security standards, and strengthening the foundational security elements required to ensure Ethereum’s resilience and integrity at scale.
The success of Trillion Dollar Security Day owes much to the dedication of its participants and organizers. Special thanks are extended to the security layer champions: @vdWijden, @barnabas, @zachobront, @ethzed, @mattaereal, @ncsgy, and @ThewizardofPOS. Their expertise and commitment were invaluable. Appreciation is also extended to @0xRajeev and @fredrik0x for their gracious hosting of the event, providing a conducive environment for this critical dialogue.
