Learn / Experienced · Foundations
Trust: who holds the record?
Every system for money answers one question: who keeps the record of who owns what? At a bank, the bank does. On a shared spreadsheet, whoever has edit rights does. On a blockchain, thousands of computers keep copies and follow shared rules. This module is about learning to ask that question about any crypto product, because the answer tells you what you are really trusting.
You already know what a blockchain is and what decentralised means. Here we go a step further and treat trust as something you can examine, like a lock on a door.
Education only, not financial advice. Examples use made-up numbers, not live prices.
Three ways to keep a record
Imagine a village savings club with three possible record keepers. Each one asks you to trust something different.
- The treasurer’s notebook. One person writes everything down. It is quick and easy to fix mistakes, but you trust that person to be honest, careful and available. If the notebook is lost, so is the record.
- A shared spreadsheet. Many people can see it, but the owner of the file decides who may edit. You trust the owner and the people with edit rights.
- A blockchain. Many independent computers each hold a copy and check every new entry against public rules. You trust that enough of them are independent and that the rules are sound. No single person can quietly rewrite history.
What you trade away
Moving trust from a person to rules and many copies has real benefits: it is harder to censor a payment, harder to rewrite old entries, and the record is open for anyone to check. It also has costs that beginners rarely hear about.
- No helpdesk. If you send funds to a wrong address or lose your keys, there is usually no one who can reverse it. A bank can reverse a mistaken transfer; most chains cannot.
- Rules are only as good as their code. A flaw in the rules or in a program built on top of them can be used by anyone, and the record will faithfully record the theft.
- Final means final. Once enough blocks are added on top, a transaction is practically permanent, including a transaction you regret.
- You become your own security team. Keeping your own keys moves the job of protecting them from a bank to you.
Decentralised is a spectrum, not a badge
Projects love the word “decentralised”, but it is not an on and off switch. It helps to ask four plain questions about any chain, app or exchange:
- Who can change the rules? A small team, a vote of token holders, or a slow public process involving many parties?
- Who can freeze or block you? Some systems have an admin who can pause transfers. That may be sensible for safety, but it is a power someone holds.
- Who holds the keys? If you keep your own keys you hold the power, and the risk. If an exchange holds them, the exchange does.
- How many independent operators keep the record? Hundreds of independent computers is very different from a handful run by one company.
A case study: when a few keys held everything
In March 2022, the Ronin network, which supports the game Axie Infinity, lost about 173,600 ETH and 25.5 million USDC, worth roughly 625 million US dollars at the time. Reports say the attackers took control of validator nodes, and the network had only nine of them. It was reported that the theft went unnoticed for around six days.
Nothing in the idea of a blockchain failed here. The weakness was how few parties held the power to approve withdrawals. The lesson is not “blockchains are unsafe”. It is that the number of independent holders, and how well their keys are protected, matter more than the label on the project.
A Caribbean angle
In Trinidad and Tobago, a bank account sits inside a system of regulators, deposit rules and complaint routes. When you hold crypto yourself, you step outside that safety net. That is not automatically bad, but you should choose it knowingly. Later modules cover safe habits and the local rules; for now, notice that every convenience you gain or lose is really a change in who you trust.
Common mistakes
Treating “no middleman” as “no risk”. The middleman is removed, but the risk moves to code, keys and the people operating the network.
Believing a label. A project calling itself decentralised proves nothing. Look at who can change rules and who holds keys.
Assuming permanent means correct. A permanent record also permanently stores mistakes and thefts.
Thinking only exchanges can fail. Self-held wallets, bridges and apps fail too, in different ways.
Try it yourself
Choose one crypto product you have heard of, such as an exchange, a wallet or a game. On paper, answer the four questions: who can change the rules, who can freeze you, who holds the keys, and how many independent operators keep the record. Write one sentence on what you would be trusting if you used it. If you cannot find an answer, that missing answer is itself useful information.
Keep in mind
- Trust never disappears. It moves from people to rules, code and keys.
- Ask who can change the rules, who can freeze you, who holds the keys and how many operators there are.
- Fewer, more concentrated holders usually means a larger single point of failure.
- Nothing here is financial advice.
Key terms from this lesson
- Custody — who actually controls the keys to a set of funds.
- Validator — a computer that checks and approves new entries on some chains.
- Finality — the point after which a transaction is practically impossible to reverse.
- Single point of failure — one part whose failure breaks the whole system.
- Trust assumption — what you must believe is true for a system to be safe.
Sources and credits
- Bitcoin: A Peer-to-Peer Electronic Cash System (original paper) — background on replacing a trusted record keeper
- ethereum.org: What is Ethereum? — plain explanation of a shared network
- Security Affairs: Ronin bridge theft report, March 2022 — figures and validator count
- Fortune: biggest crypto hacks of 2022 — second source for the Ronin figure
- ethereum.org: Intro to Ethereum — shared network and who runs it
Explained in our own words from these sources. Figures are approximate and reported by the sources named; check them yourself. Education only, not financial advice.
Module quiz
3 questions. Tap an answer to see if you are right and why. Get 2 right to complete the module.
1. A project says it is “decentralised”. What is the best next step?
The label is not proof. Examine who holds power and keys.
2. What was the key weakness in the Ronin case?
The network relied on nine validators, so taking control of enough of them was enough.
3. Which is a real cost of moving trust from a bank to a blockchain?
Final transactions and self-held keys mean mistakes are often permanent.