A Moment — When the Code Held and the System Didn't
The attack on JELLY in March 2025 was precise. An attacker opened three positions on Hyperliquid's perpetuals: two leveraged longs and a $4.5 million short on a memecoin with roughly $10 million in market cap. Then deliberately withdrew margin from the short until it crossed the liquidation threshold. The liquidation mechanism triggered exactly as designed. But the order book had no depth to close a position that size in a market that thin. The short transferred to HLP, Hyperliquid's community vault that backstops liquidations, per protocol rules, exactly as it should.
Simultaneously, a Solana-based address began pumping JELLY's spot price across external markets. HLP was now holding a large short against an asset being actively driven against it. The unrealized loss reached $12 million. The fail-safe mechanism, ADL, which is supposed to trigger when liquidation losses grow systemic, did not activate. A design assumption about how losses were pooled across vault strategies meant the threshold was never crossed.
Every automated path forward made things worse.
Validators convened and voted unanimously to delist JELLY perps, settling all positions at the attacker's original entry price. An oracle override, ignoring a pumped market that no longer reflected anything real. The quorum was reached in under two minutes.
I want to dwell on what those two minutes contained. The code ran correctly at every step. The liquidation triggered. The transfer executed. The oracle tracked the market faithfully. The attack was not a technical exploit. It was a design exploit. Someone who read the liquidation logic carefully enough to weaponise it, using the protocol's own rules as the instrument. What the code had no model for was a market being deliberately broken from outside, by an actor who had studied the rules and built the attack around them.
The resolution required a judgment the protocol could not encode: which price to settle at, whether the oracle was trustworthy, when to move. It required validators aligned enough with the protocol's survival to act quickly, unanimously, and correctly, without being required to.
That is not code. That is trust. Earned, in this case. Not guaranteed by design.
A Reframe — The Wrong Aim
The philosopher Onora O'Neill made an observation that keeps surfacing the more I sit with this space: we have been trying to build more trust when what we actually need is more trustworthiness . These are not the same thing. I confused them for longer than I should have. I suspect I wasn't alone. The vocabulary of the space ran faster than its precision. Trustless became shorthand for trustworthy , and in the urgency to build, the distinction quietly collapsed.
Trustworthiness, the thing that earns trust, requires three properties working together: that people can actually assess your claims (intelligibility), that you deliver what you promise (competence), and that you deal honestly (honesty). All three. Any one of them missing and the structure doesn't hold.
A smart contract is competent in the precise sense: if its code says it will do X, it will do X. That is genuinely remarkable. The compliance is perfect. The execution is reliable. The ledger does not lie.
But intelligibility is a different question entirely: can the people this system is supposed to serve actually assess its claims? The contract is readable to engineers. It is opaque to most of the people whose financial lives it is supposed to improve. The governance mechanism is visible onchain. The incentive structures that shape how people vote within it are not. The whitelist logic is auditable in principle. Who controls it, and what they are accountable to, is largely offchain.
And honesty is a different matter again. Not the code, which cannot lie, but the governance layer above it. The track record is what it is.
What the space actually pursued for a decade was not trustworthiness. It was trust-minimisation: remove the human from the transaction, reduce the surface area for betrayal, make the counterparty irrelevant. It worked, technically. The human layer did not disappear. It moved up a level: into the governance forum, the validator set, the whitelist database. And it arrived at that new position without the accountability structures that had made the old position at least partially manageable.
That is the problem worth sitting with.
A Phase — The Skeuomorphic Layer
When the first iPhone shipped, the calculator application looked like a physical calculator.
Not because it had to. The screen could have displayed anything. But users were being asked to accept an alien concept: a device with no physical buttons, no keyboard, no familiar markers for how interaction was supposed to work. And the design team understood that you cannot introduce radical change without a transitional grammar. The calculator looked like a calculator. The notepad looked like a legal pad. The camera shutter made a sound that served no mechanical function. The reference points were familiar even when everything underneath them was new.
Skeuomorphism: designing the unfamiliar to look like the familiar until the unfamiliar becomes native.
I think about this when I look at the accountability structures inside crypto governance today. Multisig key holders. Whitelist managers. Governance token distributions with their informal power concentrations. Validator committees empowered to make judgment calls when the automated system is being attacked. These are not corruptions of the trustless ideal. They are the skeuomorphic layer, the human accountability scaffolding that sits beneath a system not yet mature enough to stand without it.
In eras of compounding innovation, and this is one, technological maturity cannot keep pace. Earlier centuries moved differently. The steam engine arrived and the world had decades to build the institutions, norms, and accountability structures around it. We don't have decades. The DAO experiments of 2021 did not fail because the idea was wrong. They failed because the tools were not ready, the incentive design was not careful enough, and the human accountability layer, the thing that makes governance trustworthy rather than merely functional, was not there. The infrastructure is being rebuilt more carefully now. The governance experiments are more considered. The scaffolding is going up differently.
But scaffolding is not architecture. And there's the question O'Neill asks. Have you made yourself trustworthy in the eyes of the people you serve? It cannot be answered by a governance token distribution. It cannot be answered by a multisig threshold or a validator committee charter. It requires something the protocol cannot encode: the ongoing commitment of the humans inside the system to be accountable for what the system does.
That commitment is not immutable. It does not live onchain. No audit can verify it. And yet it is the only thing that closes the gap between a system that works and one worth trusting.
A Governance — What the Code Cannot Catch
In April 2022, Beanstalk lost $182 million to a flash loan governance attack. The attacker borrowed enough capital within a single block to acquire a supermajority of governance votes, passed a proposal that drained the protocol, and repaid the loan, all within one transaction. The code ran exactly as written. The governance mechanism worked exactly as designed. There was no exploit of the smart contract logic. There was a design assumption: that governance participation would cost something meaningful to its participants. It turned out to be false.
A year later, Tornado Cash's governance was briefly seized by an attacker who passed a malicious proposal granting themselves 1.2 million fake votes, exceeding the entire legitimate voting base. The community's response, a counter-proposal, rapid coordination across decentralised channels, a vote to revert the damage, succeeded. The protocol survived. But the rescue was not automatic. It required community members recognising the attack in real time, trusting each other's reads of a fast-moving situation, and acting collectively on that trust.
That rescue was human. It could not have been anything else.
These are not, I think, evidence of permanent structural failure. They are evidence of immaturity: systems deployed into adversarial conditions before the accountability infrastructure had time to develop. The space will get more robust. Governance delay mechanisms are improving. The attack surfaces are narrowing.
But what saved Tornado Cash, the shared understanding of what the protocol was for, the credibility of the people who raised the alarm, the accumulated trust between community members who had never met, is not onchain. It cannot be. It exists because people built it, over time, through the kind of repeated honest interaction that produces trustworthiness. The code has no model for the difference between a participant building for the long horizon and one borrowing governance power for a single block. That distinction is not technical. It is a judgment about human intent and accountability, exactly the kind of judgment that trustless systems were designed to make unnecessary.
They have not, in practice, made it unnecessary. They have made it less visible.
A Constraint — The Gate Has No Protocol
There is an argument worth steelmanning before setting it down.
Maybe the current arrangement is acceptable. Maybe concentrating trust in onchain-adjacent governance, whitelist managers, multisig holders, validator committees, with some transparency is genuinely better than what came before: opaque centralised intermediaries with no auditability at all. At least you can see the governance votes. At least the ledger is public. At least there are communities arguing about the right thing to do.
This argument has merit. And it is right as a description of the transitional phase.
What it cannot be is a resting point.
The gate cannot be fully redesigned while legacy systems exist. Not because of bad faith, but because the ideal is structurally disruptive to the institutions crypto currently needs to work with. Every project building at the intersection of regulated assets and onchain infrastructure understands this. The compliance architecture is old infrastructure. The rails are new. The gate is at the entrance of the old infrastructure, staffed by the same logic that built it. The path of least resistance is to build toward the gate, not around it. And the tools that amplify this work, which are becoming increasingly powerful, amplify whatever is already pointing. Careful stewardship or efficient capture. The tool does not choose.
A protocol cannot be a custodian. It is a tool. The custodian question, what are you accountable to, who are you building for, what do you owe to the person on the other side of the gate, only ever lands on humans. The people who write the governance rules. The people who hold the keys. The people who decide which wallets get access and which don't.
Most of those people have not been asked what they are accountable to, beyond their token holders and their legal counsel. Most are not sure they want to be asked. The financial incentives do not require it. The protocol does not require it. The market, for now, does not require it.
That is the constraint. Not the technology. Not the regulation. The willingness, or reluctance, of the humans inside the gate to understand themselves as custodians: not architects of a final system, not gatekeepers of an efficient one, but stewards of something that is supposed to outlast them and serve people they will never meet.
A Drive — What We're Actually Reaching For
There is a concept in Islamic theology called fitrah: the innate disposition embedded in every human being toward recognition of the divine, a native orientation toward what is true, what is good, what is whole. Not constructed. Not learned. Already there, beneath everything, before the first transaction and after the last one.
I think about fitrah when I try to understand why people keep building trustworthy systems despite the evidence that trustworthy systems are very hard to build and very easy to corrupt.
The economic incentives do not require it. A system that is merely functional, that executes correctly, settles fast, charges low fees, captures enough value to sustain a business. You do not need to make it trustworthy in O'Neill's sense to make it profitable. Most systems don't, and they survive.
And yet people keep trying. After the governance attacks. After the drift from substance to form. After watching carefully designed incentive structures produce outcomes nobody wanted. People rebuild. They propose mechanisms they know will be imperfect, document the failures, iterate toward something more honest. Not because the protocol requires it. Because something underneath the economic argument wants to build something closer to right.
That impulse is not naivety. It is, I think, the drive to approach what we understand the divine to be: incorruptible, transparent, just. We cannot build that. Human capacity is real and it is bounded, and every system we build will fail in ways we did not anticipate. But we keep reaching toward it because that reaching is written into us. The builders who move from extraction to custodianship, who ask not just "does this work?" but "is this trustworthy to the people it's supposed to serve?"
The system will not achieve a final trustworthy form. It will produce something better than what came before, which will develop new failure modes, which will be rebuilt again. That is not tragedy. That is the shape of the work, bounded by capacity, oriented by something that exceeds it.
What does it actually take to build for the infinite game?
Not better code. Not more audits. Not a governance mechanism clever enough to account for every bad actor before they arrive.
A different kind of accountability. The kind that asks: to whom, and for what, are you answerable, when the protocol doesn't require you to answer to anyone?
I don't have a clean answer. I'm not sure one exists.
What I do know is this: the aspiration is right. The system hasn't earned it yet. And the people who understand the difference, who hold that distance honestly, without flattening it into cynicism or into hope, are the ones worth building alongside.
The rest is the work.
IN.
Previously → Receipts