32. Security, Risk, and the Human Factor

Imagine a vault with an unpickable lock. That does not make your valuables safe. A thief can trick you into opening the door, exploit a builder's mistake in the wall beside the lock, or wait for you to write the combination on a sticky note. Web3's cryptography is the unpickable lock. Almost every real theft happens around it, not through it.

Most software is like a building you can renovate while people live in it; if a window won't lock, a workman fixes it. A smart contract is more like a building cast in a single block of concrete and then set adrift, with the blueprints taped to the door. If there is a flaw, everyone can see it, and you cannot send in a workman.

The thieves did not crack the safe. They tampered with the screen the guards were looking at, so that when the guards pressed "approve" on a normal-looking withdrawal, they were really signing the money over to the criminals. Every signature was genuine; the guards simply could not see what they were truly signing.

With a bank, a fraudulent transaction is the beginning of a process that often gets your money back. On a blockchain, a fraudulent transaction is the end of the story. The money is gone the instant it is confirmed, and there is no one whose job it is to return it.

Web3 routinely asks users to sign cryptographic messages they cannot read, in order to use ordinary applications. Attackers exploit this by getting victims to sign a message that looks like the usual permission slip but is in fact a blank cheque. The victim is not careless in the everyday sense; they are being asked to vet contracts written in a language they do not speak, and one bad signature is irreversible.

A blockchain is a sealed room that can only trust what is already inside it. Bridges and oracles are the doors and the messengers that connect it to other rooms and the outside world. Doors and messengers are exactly where you post guards in any fortress — and in Web3 they have been robbed for hundreds of millions of dollars at a time.

You can have a system no one can tamper with, in which case no one can fix it when it breaks; or a system someone can fix, in which case that someone is a target and a master who could betray you. Web3 has spent a decade discovering that it cannot have both at once.

An audit is like a professional inspection of a building's blueprints before construction. A good inspection catches many flaws. It does not guarantee the building will never be burgled, will interact safely with every other building on the street, or that the owner won't be tricked into handing over the keys. "Audited" means "checked," not "safe."