Nothing is secure anymore. Good.

I agree with the diagnosis.

Systems have never needed to be perfectly secure; they needed to be expensive enough to attack that the reward wasn’t worth the effort. AI is eating away at that advantage. Vulnerabilities that once required time, money and highly specialized knowledge to uncover are becoming cheaper to find and easier to exploit.

Guillemet argues that the old security asymmetry needs to be rebuilt around stronger guarantees: cryptography, formal verification and hardware-rooted trust.

Ledger has helped establish many of the hardware wallet industry’s foundational principles. I’m obviously not a neutral observer, but I believe crypto users benefit from hardware wallets—including Ledger’s. My bias is worn openly.

With that said, I’m less convinced by the prescription he lays out.

If the economics of attack have fundamentally changed, building a more expensive castle may not be enough. Before deciding what comes next, there is another question worth asking:

What exactly are we trying to defend?

A perfectly secure device whose manufacturer ultimately determines what software it runs might provide superb asset protection while providing less user sovereignty.

A perfectly secure custodial platform might protect assets better than self-custody while eliminating self-custody entirely.

A formally verified wallet could faithfully execute software whose behavior the user cannot independently inspect.

A Secure Element can make extracting a private key extraordinarily difficult while doing nothing to establish whether the transaction being authorized represents the owner’s intent.

And a system could theoretically become more secure by becoming increasingly restrictive, proprietary, centralized and institutionally controlled.

At some point you can secure crypto so thoroughly that you’ve secured away part of the reason for crypto existing.

We can see this line of thinking in the response to another real-world example of the breakdown of security economics, war. The response to cheap and effective asymmetric drone and electronic warfare has been to layer defenses, distribute capability, assume surveillance, use cheap counters against cheap threats, learn publicly from failure, and adapt faster than the adversary.

This response doesn’t mean that you don’t still want “exquisite platforms” that are well thought out with purpose-built security. It just means that no matter how many fortifications you build, the foe doesn’t owe you the attack you designed against. Biometrics and Secure Enclaves do bring something substantial to the table, but don’t mistake strengthening one layer for strengthening the system.

We also need to consider what it is we are protecting. If the objective were merely maximum asset protection, self-custody itself is questionable. Banks, custodians, withdrawal controls and institutional enforcement can provide formidable security. Crypto deliberately accepts responsibilities and risks because it is trying to preserve something else: individual authority over digital economic activity. We don’t want a system that is completely bought out by government or corporate interests. We don’t want a system that is relegated to the trash heap of scammers and thieves with only a few true believers holding on for dear life. We want a secure future for crypto that allows individual autonomy over global trade, entrepreneurship and freedom from the existing constraints. We can’t do that unless we treat openness to the system as a feature, not a bug.

A wallet isn’t successful merely because nobody can extract its key. If achieving that security requires opaque hardware, unverifiable software, manufacturer authority, institutional attestations the owner cannot independently evaluate, or an ecosystem where users simply have to believe “trust us, it’s secure,” then you have protected one property while compromising another property crypto was supposed to protect.

At the system level, we want something that remains defensible despite scrutiny, disclosed failures, knowledgeable adversaries, compromised layers and changing attack vectors.

Open-source software isn’t automatically secure. Auditable hardware isn’t automatically secure. A five-year-old architecture that has been battle tested isn’t automatically better than a new chip. Their advantage is that security can become an observable process: reproducible builds, independent researchers, coordinated disclosure, public vulnerability histories, patches, community scrutiny and years of real-world adversarial exposure. Secure Elements and formal verification can be part of that system too.

Security is an activity, not a product.

That’s why openness isn’t an ideological ornament, it’s a consequence of the proposed threat model.

If AI increasingly means we have to assume the attacker eventually knows how the system works anyway, then you might as well design the system so the defender, owner, researcher and community get to know too.

The person we should be ultimately trying to empower is the owner—not the castle builder.