At Devconnect Buenos Aires, the Ethereum Foundation and Secureum TrustX brought together Ethereum security practitioners for Trillion Dollar Security Day, a focused event exploring what it would take to securely support a trillion-dollar Ethereum economy.
The event brought together approximately eighty participants from across the Ethereum security ecosystem (infrastructure, interoperability, layers 1 and 2, Onchain, Offchain, privacy, and wallets) to assess the current security landscape, surface common challenges, and identify concrete next steps across the stack.
Discussions and results from this event contribute to the Ethereum Foundation’s ongoing One Trillion Dollar Security (1TS) initiative.
Why a billion dollar safety day?
Trillion Dollar Security Day was designed to create focused, in-person discussions across tiers, bringing together practitioners who work on similar parts of the stack to assess current security posture, share operational realities, and identify near-term priorities. The results from these sessions were then synthesized to highlight patterns and dependencies across the ecosystem.
The goals of the Trillion Dollar Security gathering were to:
- Assess Ethereum Security Posture across the entire stack, identifying emerging gaps, challenges and risks
- Enable short-term execution by aligning ecosystem players around achievable priorities
- Strengthening long-term security through coordination, shared standards and ecosystem empowerment
Participants broke into breakout sessions by level, discussing what is working today, what is not working, and where efforts are most urgently needed.
Snapshot: multi-layer observations
Across the seven levels, participants highlighted several recurring themes:
- Security is often seen as a milestone rather than an ongoing process
- Confidence assumptions are insufficiently communicated to users
- Critical security tools and public goods lack sustainable funding
- Coordination and incentives, not crypto, remain dominant risk factors
The table below provides a condensed view of the key questions and immediate next steps identified during the sessions.
| Layer | Key questions | Immediate next steps identified |
|---|---|---|
| Layer 1 and 2 | Quantum risk, weak L1/L2 coordination, cloud dependency, compressed testing | Expand EPF integration, create L2 bindings, improve versioning and EIP ownership |
| Wallets | Blind signature, paid security, weak coordination | Form an open signing alliance, neutral/on-chain EIP-7730 ledger, wallet dashboards |
| On chain | “Audited ≠ secure”, low IR, OpSec failures | Fund OSS security tools, create visibility on DeFi security, promote SEAL |
| Interoperability | Dangerous trust assumptions, UX prioritizes speed over security | Interop trust assessments, clearer disclosures, canonical bridge UX improvement |
| Infrastructure | Frontend hacking, RPC centralization, DNS SPOF | Verifiable frontends, infrared transparency dashboards, thin client wallets |
| Off-chain | Misaligned Incentives, Web2 Attack Surface Blind Spots | Security frameworks, certifications, staffing models for public goods |
Key themes by layer
Full walkthroughs for each layer can be found here.
Layers 1 and 2: coordination remains a bottleneck
Ethereum’s multi-tenancy architecture, specification-driven development, and conservative Layer 1 change process continue to provide a strong security foundation. However, participants highlighted risks arising from limited coordination between Tiers 1 and 2, compressed testing timelines, over-reliance on cloud infrastructure, and concerns about supply chain attacks.
Key challenges include limited community and Tier 2 participation in All Core Devs calls, limited ability of the customer team to quickly review evolving EIPs, and ongoing Tier 1-2 transition and RPC resiliency issues.
Proposed next steps focus on expanding the Ethereum Protocol Fellowship (EPF), creating clearer L2 liaison roles, improving expectations for EIP versioning and ownership, and strengthening moderation and accessibility in coordination forums.
Wallets: user security remains too opaque
Progress in signing standards such as EIP-7730 and improvements to portfolio visibility were seen as positive. At the same time, most hardware wallets still rely on blind signing, and wallet participation in shared security discussions remains limited.
Participants highlighted the competitive wallet landscape as a structural barrier to collaboration, as well as an over-reliance on the Ethereum Foundation to drive coordination.
A key proposal was the creation of an Open Signing Alliance, anchored in Ethereum’s values of openness, neutrality and exit testing. Additional priorities include hosting the EIP-7730 registry in a neutral or on-chain context and funding portfolio-focused security dashboards to improve transparency and legitimacy.
Onchain security: tools and visibility lag behind risks
Onchain security continues to benefit from a growing pool of experienced security researchers, improved tools (e.g. Foundry), and increased awareness of incident response through efforts such as SEAL911. However, security is still often seen as a box to check, and “audited” is often confused with “secure”.
Participants emphasized that the most recent losses stem from operational security failures and not new smart contract exploits. Other challenges include increasing protocol complexity, limited invariant monitoring, and a lack of economic audits.
Immediate next steps include sustained funding for open source security tools (fuzzers, static and dynamic analyzers), improved visibility into DeFi security posture (an “L2BEAT-like” approach), and broader adoption of SEAL frameworks and checklists for different classes of contracts.
Interoperability: trust assumptions must be explicit
Ethereum users benefit from a wide range of interoperability options and an increasingly fast and inexpensive UX. At the same time, participants pointed out that many interoperability protocols rely on poorly communicated trust assumptions, leading users to confuse “fast and cheap” with security.
Many non-canonical bridges fail the exit test, and the risk often persists after bridging due to wrapped assets and downstream dependencies.
Proposed actions include developing interop trust ratings that clearly specify assumptions and verification models, setting strong expectations for explicit trust disclosures by cross-chain aggregators, and improving the speed and cost of canonical bridges to reduce reliance on insecure alternatives. A follow-up workshop on interoperability was also proposed.
Confidentiality: UX and infrastructure are the main constraints
There has been broad consensus that privacy is increasingly seen as a normal and necessary part of Ethereum’s future, with encouraging progress in zero-knowledge research and institutional adoption. However, user experience, costs and infrastructure limitations remain major obstacles.
Key challenges include RPC-based tracking, difficulties with storing and retrieving private data, lack of UX-focused builders of private wallets, and lack of hardware support for privacy-preserving keys.
Suggested next steps include increased use of thin client data on P2P RPC, investment in private wallet UX, research into ZK-enabled hardware signers, and engagement with regulators for clearer guidance on permissionless privacy technologies.
Infrastructure and off-chain security: the invisible attack surface
Front-end compromises, DNS hijacking, RPC centralization, and software supply chain attacks have been repeatedly cited as underappreciated risks. Participants also noted a lack of sustainable economic alignment for nonprofits providing security-critical public goods.
Key challenges include the false separation between “Web2” and “Web3” security, limited liability for off-chain outages, and the tendency to trade security for speed or convenience. The inability to easily run nodes on Tor was also highlighted.
Proposed next steps include creating verifiable frontend prototypes, increasing transparency around RPC and infrastructure status, advancing security frameworks and certifications, and creating structured collaboration models in which private companies dedicate time and resources to securing public assets.
Thoughts on the event
Participants rated the quality of the discussions and the relevance of the topics as excellent, highlighting the value of in-person and cross-level exchanges. The main areas for improvement were logistics, including group sizes and opportunities for structured networking.
There was strong demand for future work focusing on applied security standards, shared tools and practical guidance for implementation.
What comes next
The Trillion Dollar Security gathering highlighted the importance of bringing security practitioners together in person to create shared understanding and momentum. Focused face-to-face discussions helped accelerate alignment on standards, tools, and practical solutions in a way that is difficult to achieve through asynchronous coordination alone.
The discussions also highlighted the importance of maintaining a shared and continually updated view of Ethereum’s security posture. As the ecosystem evolves, staying ahead of emerging risks requires regularly reassessing what’s working, what assumptions no longer hold, and what areas need renewed attention to support a trillion-dollar economy.
The insights gathered in Buenos Aires will continue to inform the Ethereum Foundation’s trillion-dollar security efforts, alongside ongoing work across the ecosystem. In the near term, the focus remains on supporting execution, adopting open and neutral security standards, and strengthening the foundations needed to keep Ethereum secure at scale.
Thanks to security layer champions @vdWijden, @barnabas, @zachobront, @ethzed, @mattaereal, @ncsgy and @ThewizardofPOS. And @0xRajeev and @fredrik0x for hosting.
