固定されたツイート
Many crypto startups claim to be "security first," but the reality is often quite different. It is common to find projects with hundreds of millions in TVL that do not have a dedicated head of security or even a security team. Often, security is just an engineer doing "double duty," which is impossible to maintain given how busy engineers are.
Security is not the default state. You must be intentional about it because it does not happen on its own. Without an explicit effort to understand OpSec and best practices, a project is simply a target waiting to happen.
Security is a difficult sell because its primary benefit is that nothing bad happens. The true ROI becomes clear when you see the consequences of accumulated "crap" like bug bounties, phishing emails, and engineering slowdowns caused by constant bug triaging.
We are building financial infrastructure where trust is the ultimate differentiator. While the "crown jewels" in Web2 are data, the crown jewels in Web3 are money. Because of this, security shouldn't just be viewed as a cost ; it should be a way to build the hype and thought leadership that leadership teams crave.
When a protocol is hacked, it isn't just VC money that is lost; it is the savings of regular people…moms, dads, and grandparents… who use crypto because they may not have access to traditional banking. This makes the lack of dedicated security teams in protocols holding massive TVL even more critical.
In Web3, incident response speed is far more vital than in Web2 because transactions are immutable and funds can vanish instantly. Startups should have incident response plans and retainers in place before a hack occurs, rather than trying to find help while their funds are being drained.
A dedicated security team doesn't just wait for alerts; they hunt for threats. This includes monitoring "breadcrumbs," such as contracts funded by Tornado Cash or suspicious forum inquiries, to stop an attack before it happens. The "attacker’s dilemma" .. where the attacker only needs to set off one alarm for the gig to be up .. only works if someone is actually watching the monitors.
To any founder holding other people's money: go hire a security person. Security is not as difficult or expensive as people think, and there are many experts willing to help. Ultimately, a head of security can be a growth lever that bolsters TVL and generates revenue by making the protocol a trusted place for assets.
The bottom line: In this industry, security isn't just a cost center…it's a necessity. The real cost center is getting compromised, as that is company-ending.
English
