The Ethereum Foundation has released the first report in its most comprehensive security initiative to date, which maps the critical risks Ethereum (ETH) must address to support trillions in global on-chain value.
The first Trillion Dollar Security (1TS) report outlines what individuals, institutions, and governments require to entrust significantly larger sums to the network. The report follows multiple similarly in-depth initiatives taken by the foundation in recent weeks following a restructuring effort.
Based on extensive feedback from developers, users, and security professionals, the report identifies vulnerabilities across six core areas: user experience, smart contracts, infrastructure, consensus, incident response, and governance.
The report will serve as a foundational roadmap for Ethereum’s next phase of security improvements.
Vulnerabilities in the ecosystem
According to the report, much of Ethereum’s security burden still falls on end users due to poor wallet UX, blind signing, and inconsistent permission controls. These issues continue to create recurring threats, while fragmented wallet standards hinder safe usage.
Additionally, institutional users face additional friction in managing keys, audit trails, and custom workflows, which are poorly supported by the current infrastructure.
The report also highlighted that smart contract security, though improved, still suffers from upgrade risks, access control failures, and low adoption of formal verification.
Meanwhile, dependencies on centralized infrastructure, like RPC providers, DNS, and cloud hosts, undermine Ethereum’s decentralization guarantees. Layer-2 solutions introduce new complexities, while the potential for ISP-level censorship and DNS hijacking remains underacknowledged.
At the protocol level, the report noted that validator centralization and unclear recovery procedures continue to raise concerns about Ethereum’s resilience in edge-case failures.
It also flagged a long-term transition to quantum-resistant cryptography as an essential step.
Coordinating a secure future
According to the report, Ethereum’s ability to respond to threats remains limited by gaps in monitoring, coordination, and recovery.
Responders often face delays when trying to contact compromised teams or escalate issues across platforms. Without clear communication channels or pre-established contacts, valuable time is lost during incidents.
The report also noted a lack of effective monitoring tools for detecting on-chain and off-chain threats early. In many cases, security breaches go unnoticed until after damage is done.
Insurance coverage remains scarce. Unlike traditional financial systems, Ethereum applications have limited access to insurance, leaving users and organizations exposed to total loss in the event of an exploit.
On the governance side, the report warned that Ethereum’s social layer, its network of developers, institutions, and cultural norms, is itself a potential vector for attack. It highlighted risks from stake centralization, regulatory pressure, and organizational influence that could shift Ethereum’s direction away from neutrality.
The lack of established processes for “social slashing” was also flagged as a critical gap in the event of validator collusion or protocol capture.
